docs(connectors): correct Aqua Supply Chain branch guidance (pinning is not the fix) - #16022
Merged
Merged
Conversation
…is not the fix) PR #16005 said a non-default branch must be pinned in Aqua before it imports. Re-verifying against a live tenant with the connector's own credentials showed that is wrong: Aqua's scan-results feed (which the connector reads) returns a repository's default branch only for some sources such as Azure DevOps, regardless of pinning or token scope, so pinning does not make the branch appear in the feed. Rewrite the Branch handling section to describe the actual behavior: the connector imports whatever branches Aqua returns in its scan-results feed, some sources expose only the default branch, and an operator who expects a missing branch should contact support. Removes the pinning instruction. Reported via a customer support ticket. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Maffooch
enabled auto-merge
September 21, 2026 15:58
blakeaowens
approved these changes
Sep 21, 2026
devGregA
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[sc-15563]
What
Corrects the Aqua Supply Chain branch guidance added in #16005, which said a non-default branch must be pinned in Aqua before it will import.
Why
Re-verifying against a live tenant with the connector's own API key and secret showed pinning is not the mechanism:
/codesec/api/v1/scans/results). For the affected repository that feed returns the default branch only, and it returns the same result whether the connector's token is minted withallowed_endpoints: ["ANY"]or["ANY:*"]. Pinning does not change what that feed returns./supply_chain/v2/build/.../branches, which needs theANY:*scope), but that endpoint returns only per-branch severity summaries. We could not find an endpoint that returns per-finding detail for a non-default branch to the connector's identity. So pinning is the wrong advice, and the real gap is that Aqua does not expose a non-default branch's findings through the connector's API path.Change
Rewrite the Branch handling section to describe the actual behavior: the connector imports whatever branches Aqua returns in its scan-results feed; for some sources (for example Azure DevOps) that feed exposes only the default branch, so a configured non-default branch does not import; and an operator who expects a missing branch should contact support. Broader non-default-branch support is being worked on separately. Docs-only, on the
bugfixline.Follow-up
A connector change to request the correct Aqua token scope (
ANY:*) is in progress. Importing a non-default branch's findings additionally depends on Aqua exposing per-finding detail for non-default branches through the API, which the customer has escalated to Aqua. The docs will be updated once multi-branch import is supported.