Guides
How to run security scans without slowing CI
Vulnerability scanning adds minutes to every pull request.
5 min read
Vulnerability scanning adds minutes to every pull request.
Why it happens
Scanners re-download large vulnerability databases and often run on the critical path.
How to fix it
- Cache the vulnerability database keyed by day
- Run scans in parallel with tests rather than after them
- Fail only on severities you will act on today; report the rest
- Run the full deep scan nightly and a fast scan on pull requests
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.
Related
How to manage secrets in GitHub ActionsSecrets are sprawled across repository settings and nobody knows what is still used.How to run CI runners inside your VPCBuilds need to reach an internal service that is not exposed publicly.How to give runners a static IPA third-party service requires IP allowlisting and hosted runner IPs change constantly.How to secure your CI supply chainThird-party actions run with access to your repository and secrets.