6
Finally got my dependency scan under 10 minutes after 2 months of tuning
Our CI was crawling at 45 minutes every push because of the SAST job. I spent last weekend cutting false positives and moving to incremental scans. Now it finishes in 8 minutes flat. The devs actually stopped complaining about the pipeline. Has anyone else gotten a big speedup by tweaking their scan scope, or am I the only one stuck babysitting these tools?
1 comments
Log in to join the discussion
Log In1 Comment
aaronclark26d ago
Dude, did you just secretly steal my entire weekend?
I swear I'm in the exact same boat. My SAST job was a total pig too, sitting at 38 minutes and honestly making me question why we even had the thing turned on. I finally buckled down and white-listed a bunch of old alerts that were never gonna get fixed, and it dropped to like 11 minutes. The false positive hunt is the real time sink, not the actual scanning.
It's wild how much of these tools is just babysitting the config. I think once you get the baseline set, incremental scans are a lifesaver though. My devs still complain, but at least they've stopped threatening to push directly to prod every other day.
7