Welcome to Support Portal

Overview

Users with valid roles and permissions may see only a subset of Code Repository (Supply Chain Security) repositories, or no repositories from a given source control platform. A frequent cause is an Application Scope on the user’s role that uses AND logic across attributes—for example, requiring GitHub and a specific repository topic—so repositories that fail any single condition are hidden.

This article explains how Code Build scope filters affect repository visibility, how to include Azure DevOps repositories, and how to verify scope configuration after changes.

Understanding Application Scope and repository visibility

How scopes filter repositories

Application Scopes limit which assets a user can see and manage based on attributes such as:

• Source code management (SCM) provider (GitHub, Azure DevOps, Azure DevOps Server, and others)
• Repository topics or tags (for example, aqua.topic.<name>)
• Other product-specific attributes configured in the scope

When multiple attributes are combined with the AND operator, a repository must satisfy every condition to appear. A scope that lists only GitHub excludes all Azure DevOps repositories regardless of other permissions.

Role assignment chain

For a user to see repositories:

• The user has a role with Supply Chain / Code Repository permissions.
• That role is associated with an Application Scope (or global scope).
• Each repository in the SCM integration must match the scope’s filter rules.

Permissions alone do not override a restrictive scope filter.

Symptoms

• User cannot see all repositories that administrators expect them to access.
• Azure DevOps (or Azure DevOps Server) repositories are missing while some GitHub repositories appear.
• Only repositories with a specific topic are visible; other repositories in the same organization are hidden.
• Administrators see repositories when using a broader scope or global view; the affected user does not.
• No error message—UI shows a partial list or an empty repository list.

Root cause example

A scope configured for Code Build with logic equivalent to:

aqua.source_code_management.github AND aqua.topic.<custom-topic>

implies:

Azure repositories fail the GitHub condition and never appear until the scope includes Azure (or Azure Server) as an allowed SCM provider.

Solution

1. Update the Application Scope for required SCM providers

• Sign in as an administrator and open Settings → Application Scopes.
• Edit the scope assigned to the user’s role (for example, a team- or application-specific scope).
• Under Code Build (or Supply Chain repository section, depending on console version), add Azure DevOps or Azure DevOps Server if those repositories must be visible.
• Retain or adjust GitHub settings as needed for GitHub-hosted repos.

2. Align repository topics with scope rules

If the scope requires a topic (for example, aro-digital-onboarding):

• Apply the corresponding topic or tag to each repository that should be in scope in GitHub and Azure DevOps, or
• Broaden or remove the topic filter if the business no longer requires that restriction.

3. Save and validate user access

• Have the user refresh the console or sign in again.
• Confirm expected GitHub and Azure repositories appear under Supply Chain / Code Repositories.
• If repositories are still missing, compare with an administrator view to confirm SCM integration sync is healthy for Azure.

Verification and monitoring

If issues persist after scope updates, capture one or two example repository names (GitHub and Azure) that should be visible, note what the user still sees, and confirm whether an administrator sees those Azure repos with a permissive scope.

Platform coverage

Related Resources

• Creating and Updating Application Scopes via API