Non-Default Branch Scan

You can scan branches other than the main or master, such as a feature branch or sprint branch, to obtain a comprehensive overview of the security issues in those branches before merging them into the main branch.

This feature is supported only for customers with developer-based billing. Customers on resource-based billing must switch to a developer-based plan to access it.

Support for Non-Default Branch Scans

• All version control systems (VCS) are supported
• Enforcement rules remain unimpacted, as they are enforced at the repository level, regardless of the branches scanned
• Tagging rules are applicable exclusively to the main branch
• Path exclusions are implemented at the repository level, and therefore are not impacted
• Drift detection is executed on the branch being scanned and is displayed in the results for each selected branch
• The Dashboard displays the results of the scanned non-default branch

Configure Non-Default Branch Scans

1. Before you begin, ensure that you have Administrator or Owner permissions to the repository.
2. On the Prisma Cloud console, select Application Security > Home > Settings > click on the Code & Repositories tab.

   An inventory of Repositories is displayed.
3. Select the menu under the Actions column of a repository in which you want to scan a non-default branch > Set scanned branch.

   Limitation: Branch selection or switching branches is unavailable until either the initial integration process is completed or an integration update has been completed.

   
4. In the modal that opens, select a branch from the menu > Save > Approve.

   

   A scan on the non-default branch is immediately triggered after switching branches. Under the Code & Build Providers tab you can see the name of non-default branch of the repository displayed under the Scanned Branch column, while the last scan date column indicates the latest scan date of the selected branch.

Usage

Usage of a non-default branch is similar to that of a default branch. The following provides a quick reference to get you up and running.

• Monitor code build issues: Prisma Cloud performs periodic scans on non-default branches of integrated repositories of Version Control Systems (VCS) and event driven scans for CI/CD pipelines. For more on monitoring scan results see Monitor Code Build Issues

  The branch name is displayed in the summary line in the Projects page
• Fix code issues: You can remediate scan results by adding issues to a fix cart to create a PR with a suggested fix. For more on fixing code issues see Fix Code Issues.

  When fixing an issue that has been opened on a non-default branch scan, the fix only applies to the specific branch.
• Suppress code issues: Eliminate false positives and more by suppressing code issues. For more on suppressing code issues see Suppress Code Issues.
• When suppressing an issue by policy or account, all issues are suppressed regardless of the selected branch
• When suppressing an issue in a Pull Request (PR) scan, the suppression will apply to the branch that the PR is about to be merged into. For example, if the periodic scan is on a non default branch, but the PR is to the default branch, then the suppression will not be applied in the periodic scans of the non-default branch.