`scan`

On this page

What it does
How patterns match
When a tool leaves the scan
Type and values
Organisation and repository
Problems you may see
Examples
Only the infrastructure folders
Everything except examples and a legacy folder
Terraform only, organisation-wide

Narrows what Stackat reads. By default it reads every YAML, Terraform and HCL file in the repository; with scan you choose folders, leave some out, or pick file types.

What it does#

Key	Meaning
`scan.paths`	Only these files or folders.
`scan.exclude`	Never these, even inside `paths`.
`scan.file_types`	Only these types: `yaml` (`.yaml`, `.yml`) and/or `terraform` (`.tf`, `.hcl`).

On GitHub, what scan leaves out is not even downloaded. (A repository too large to fetch file by file is downloaded whole and the left-out files are deleted before anything reads them.) The repository's own .stackat.yml is always read.

A file that a chosen one points to, such as a values file in JSON, is fetched when paths and exclude allow it, whatever its type.

How patterns match#

A pattern without a slash (examples, *.tf) matches at any depth. A trailing slash does not count: infra/ matches a folder named infra anywhere; write /infra for the top one only.
A pattern with a slash (infra/legacy) is matched from the repository's top folder.
A leading slash (/infra) matches only at the top.
A folder covers everything below it: infra/, infra and infra/** are the same.
* and ? stay within one folder; ** crosses folders: clusters/*/apps, **/helmfile.yaml.
A leading ./ is ignored.

When a tool leaves the scan#

When every file a tool is pinned in is left out by scan, its open issue is closed as not planned, with a comment. It never counts as an upgrade: the audit evidence lists it as "No longer scanned (left out by .stackat.yml scan)". When those files are scanned again, the tool gets a new issue. See When issues close.

Type and values#

Key	Type	Allowed	Default
`scan.paths`	List of files, folders or globs (a single string works too)	Up to 50 entries, each up to 200 characters, inside the repository	The whole repository
`scan.exclude`	List of files, folders or globs (a single string works too)	As `paths`	Nothing excluded
`scan.file_types`	List (a single string works too)	`yaml`, `terraform`; also accepted: `yml`, `tf`, `hcl`, with or without a dot	Both

scan.types is accepted as another name for scan.file_types.

Organisation and repository#

Set in the organisation's file, scan applies to every repository.
A repository's own paths and file_types replace the organisation's.
A repository's exclude adds to the organisation's: a repository cannot drop an exclusion the organisation set.

The dashboard's Settings tab shows what each repository scans, for example only infra/, deploy/; not **/examples/**.

Problems you may see#

.stackat.yml: scan must be a mapping (paths, exclude, file_types)
.stackat.yml: scan.paths must be a list of files, folders or globs
.stackat.yml: scan.exclude: '../shared' is not a file, folder or glob in the repository
.stackat.yml: scan.paths: only the first 50 entries are used
.stackat.yml: scan.file_types: 'json' is not yaml or terraform
.stackat.yml: scan.file_types: none of the types is known, so every type is scanned

An entry that is empty, longer than 200 characters, contains .. or a backslash is left out with a problem; the other entries apply.

Warning: a scan: key with nothing under it (every line commented out) is a problem: "scan must be a mapping". Comment out the scan: line too.

Examples#

Only the infrastructure folders#

.stackat.ymlyaml

scan:
  paths: [infra/, deploy/, clusters/*/apps]

Everything except examples and a legacy folder#

.stackat.ymlyaml

scan:
  exclude:
    - "**/examples/**"
    - infra/legacy/
    - /vendor

Terraform only, organisation-wide#

.github/.stackat.yml (organisation)yaml

scan:
  file_types: [terraform]
  exclude: ["**/test/**"]     # every repository keeps this exclusion