Conversation
![hyperspace-pr-bot[bot]](https://avatars.githubusercontent.com/u/2531208?s=60&v=4){kind=small}
There was a problem hiding this comment.
The single change in this PR switches the Black Duck scan mode from RAPID (with BOM_COMPARE) to FULL, dropping the compare-mode setting that prevented pre-existing vulnerabilities from blocking PRs. This will likely increase scan duration and may cause PRs to be blocked by issues unrelated to the changes they introduce.
PR Bot Information
Version: 1.29.33
- Event Trigger:
pull_request.opened - Agent Instructions:
- File Content Strategy: Full file content
- LLM:
anthropic--claude-4.6-sonnet - Correlation ID:
f9261600-9cc1-11f1-89a6-321298d15f4b
| included-modules: cds-feature-attachments,cds-feature-attachments-oss,cds-feature-attachments-fs | ||
| scan_mode: RAPID | ||
| rapid_compare_mode: BOM_COMPARE # PRs might only be blocked by things they introduce, not by pre-existing issues that could have appeared in the main branch in the meantime | ||
| scan_mode: FULL |
There was a problem hiding this comment.
Best Practices: Switching from RAPID to FULL scan mode on every PR will significantly increase CI runtime and may block PRs for pre-existing issues that were already present on the main branch.
The removed rapid_compare_mode: BOM_COMPARE setting was deliberately chosen so that PRs are only blocked by vulnerabilities they actually introduce, not by pre-existing issues that could have appeared on main in the meantime. With FULL scan mode and no compare mode, every PR will fail if main itself has any open Black Duck findings — even ones the PR author has no control over. This can make it unnecessarily hard to merge otherwise-clean PRs and will increase scan time.
Consider reverting to RAPID + BOM_COMPARE, or if a FULL scan is intentionally required, at least document the rationale and be aware of the impact on PR velocity.
Please provide feedback on the review comment by checking the appropriate box:
- 🌟 Awesome comment, a human might have missed that.
- ✅ Helpful comment
- 🤷 Neutral
- ❌ This comment is not helpful
1 participant
Update Black Duck Scan Mode to FULL in PR Workflow
Chore
🔧 Updated the Black Duck security scan configuration in the PR workflow to use
FULLscan mode instead ofRAPIDwithBOM_COMPARE.Changes
.github/workflows/pr.yml: Replacedscan_mode: RAPIDandrapid_compare_mode: BOM_COMPAREwithscan_mode: FULLfor the Black Duck scan step, ensuring comprehensive scanning on pull requests rather than a rapid comparison scan.PR Bot Information
Version:
1.29.33pull_request.openedanthropic--claude-4.6-sonnetf9261600-9cc1-11f1-89a6-321298d15f4b