Scoping scans

Setup scan inclusion and exclusion patterns

Exclude and include filters help your team to focus their attention on the open source packages that matter most and to improve scan performance. Inclusion and exclusion patterns must not be used together so it is important to pick a strategy that works best for you. We recommend using inclusion patterns when you have many packages that you want to scan separately and exclusion patterns when you want to filter out packages that are not important to you.

You can include or exclude packages using the following standard patterns:

1. Include or exclude specific packages
2. Include or exclude specific directories
3. Include or exclude with a Golang style regex pattern.

To include or exclude a package based on its file name:

• Include
• Exclude

endorctl scan --include=path/to/your/manifest/file/package.json

endorctl scan --exclude=path/to/your/manifest/file/package.json

To include or exclude a package based on its directory

• Include Directory
• Exclude Directory

endorctl scan --include="directory/path/"

endorctl scan --exclude="path/to/your/manifest/"

To exclude or include using a Golang style regex:

• Include Regex
• Exclude Regex

endorctl scan --include=".*/build/.*"

endorctl scan --exclude=".*/build/.*"

Best practises

Here are a few best practises that you must take into consideration while using include and exclude patterns:

• Ensure that you enclose your exclude pattern in double quotes to avoid shell expansion issues. For example, do not use --exclude=.*/build/.*, instead, use --exclude=".*/build/.*".
• When performing excludes and includes in the Windows environment
  • Use double backslashes \\ which is more common in regular expressions when dealing with Windows file paths. For example, the exclusion pattern for Windows is --exclude=".*\\build\\.*"
  • Do not use single quotes. Use double quotes. For example, do not use --exclude='.*\\build\\.*' instead use --exclude=".*\\build\\.*".
• Inclusion patterns are not designed for documentation or example directories. You can not explicitly include documentation or example directories:
  • docs/
  • documentation/
  • groovydoc/
  • javadoc
  • man/
  • examples/
  • demos/
  • inst/doc/
  • samples/
• If you are using Javascript workspaces, take special consideration when including and excluding the root package:
  • When using include or exclude patterns, it’s crucial to make sure you never exclude and always include the parent workspace package. Otherwise, all child packages won’t build properly.
  • You can always exclude child packages in the workspace if the root is included.
  • There is only one lock file for the workspace that exists in the workspace root directory. Make sure to include the lock file to perform a successful scan.