Quick Start

About 332 wordsAbout 1 min

Configure common ignore rules

Add .scanignore to the repository root. Its gitignore-style path rules apply to all scan capabilities by default:

.scanignore
# Repository root path
/go.mod

# Third-party code
vendor/
node_modules/

# Test fixtures
**/testdata/**

# Build artifacts
dist/
build/

If you only need common ignore rules, you do not need to create code_scan_config.yml.

Configure scan scope per capability

When one capability needs different ignore rules, specify a file through scan.ignoreFrom:

.cnb/security/code_scan_config.yml
secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/secrets

.cnb/security/scanignore/secrets
fixtures/
**/testdata/**

secrets uses the specified file, while other capabilities continue to use root .scanignore. The two ignore files are not merged. The specified file must exist and contain all rules required by that capability.

Disable a scan capability

Point the capability's ignoreFrom to a file whose content is **. For example, to disable only secrets:

.cnb/security/code_scan_config.yml
secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/disabled # points to a ** file, so secrets skips all paths

.cnb/security/scanignore/disabled

Split configuration

When the configuration becomes long, you can split it into separate subfiles. All include paths are resolved relative to the repository root:

.cnb/security/code_scan_config.yml
include:
  - .cnb/security/checks/secrets.yml
  - .cnb/security/checks/sca.yml

.cnb/security/checks/secrets.yml
secrets:
  scan:
    ignoreFrom: .cnb/security/scanignore/secrets

.cnb/security/checks/sca.yml
software-composition-analysis:
  scan:
    paths:
      # Re-include a path on top of the common rules from root .scanignore
      - "!third_party/our-fork/**"

Warning

include paths must be relative to the repository root. URLs and cross-repository references are not supported. Include files are parsed recursively, with at most 50 files parsed in a single run. For details, see Configuration file.

Configuration result

Scan capability	Effective ignore file
Capability with `ignoreFrom`	The file specified by `ignoreFrom`
Capability without `ignoreFrom`	Root `.scanignore`, if present

Next steps

Configuration file — ignore files, include details, and merge rules
Syntax reference — complete field reference