Scan scope: which paths the collectors analyse
Every collector asks your installation on each run which rules apply. Since this release it also asks which paths to look at. The scope lives in the panel, never in the repository: there is no configuration file to commit, and what the screen shows is exactly what the runner receives.
Two layers
Section titled “Two layers”- Workspace defaults (
Rules > Scan scope): apply to every project in the workspace. - Project override (
Scan scope > switch scope > project, or the project’s Settings page):- Include paths entered on the project replace the workspace includes.
- Exclude paths entered on the project are added to the workspace excludes. A project cannot remove a workspace exclude - a workspace that never wants
vendor/keeps that.
Empty includes mean the whole repository. Excludes always win over includes.
Pattern syntax
Section titled “Pattern syntax”One glob per line, repository-relative, forward slashes, case-sensitive.
| Pattern | Matches |
|---|---|
src/** | everything under src/ |
**/Migrations/** | a Migrations directory at any depth |
**/*.generated.* | files named *.generated.* anywhere |
*.cs | only at the repository root (use **/*.cs for any depth) |
app/ | typed with a trailing slash, saved as app/** |
What the scope applies to
Section titled “What the scope applies to”- Source files analysed for ArchScan, ArchSecurity and ArchPilot findings: includes and excludes.
- Manifest discovery for package and runtime scanning (
*.csproj,package.json,composer.json,pom.xml,go.modand friends): excludes only - a project scoped tosrc/**still has its root manifests checked. - The collectors’ built-in skips (
.git,bin,obj,node_modules,vendor) stay in place regardless.
The change takes effect on the next run; the collector logs how many files the scope skipped.