Scans and results
A Supply Chain scan records what was inspected, which policy and ruleset made the decision, and whether the inspection completed. A technical failure never becomes a clean result.
Scan states
Section titled “Scan states”- Queued: the request is waiting for an isolated scanner.
- Running: the scanner has claimed the request and is inspecting bounded input.
- Completed: the scanner produced a result, including a result with zero findings.
- Failed: source acquisition, validation, scanning, persistence, or result publication did not complete safely.
The state describes execution. The conclusion describes the policy outcome.
Conclusions
Section titled “Conclusions”- Success: the scan completed and found no issue that changes the policy outcome.
- Neutral: the scan completed and found reportable evidence without an automated blocking decision.
- Failure: the scan completed with a blocking policy outcome.
- Action required: the service could not produce or publish an authoritative clean result and a person needs to investigate.
Source identity
Section titled “Source identity”GitHub scans record the exact 40-character commit SHA. On-demand scans record their input type and a content digest instead of presenting uploaded content as a Git commit.
Coverage and completeness
Section titled “Coverage and completeness”Every completed result records discovered, scanned, and skipped file counts plus a completeness flag. A result is not complete when a limit, unsupported input, or scanner condition prevented the required target set from being inspected.
Scanner version, ruleset digest, policy digest, duration, and source identity let reviewers reproduce the decision boundary without retaining complete repository files.