在Checkmarx中处理Git多分支代码扫描及实现扫描分支溯源的技术问询

Hey there, let's tackle your two Checkmarx + Git branch questions one by one—this is a common scenario when managing multi-branch projects, so I’ve got some practical steps for you:

1. Managing Multi-Branch Scan Tasks #

Here are proven ways to keep your branch scans organized and efficient:

• Set up Branch Mapping in Checkmarx Projects
  Head to your project settings in the Checkmarx web UI and find the branch mapping section. Link your Git branches (like main, develop, or feature-specific branches) to either separate Checkmarx projects or versioned branches within the same project. This keeps scan results isolated per branch and makes it easy to trigger scans for specific branches on demand.
• Automate Scans via CI/CD Pipelines
  Integrate Checkmarx directly into your CI/CD workflow (e.g., GitHub Actions, GitLab CI, Jenkins). Configure the pipeline to trigger a scan every time there’s a push to a branch or a pull request is opened. For example, in GitHub Actions, use the Checkmarx action and pass the current branch name using ${{ github.ref_name }} as a parameter. This ensures consistent, automated scans tied directly to your branch activity.
• Tag Scans with Branch Context
  When triggering manual scans, add a custom tag (like branch:feature/payment-flow) to the scan. This helps you quickly filter and identify which scan corresponds to which branch in the Checkmarx dashboard later on.

2. Displaying the Triggering Branch in Scan Results #

To make sure Checkmarx shows exactly which branch a scan was run against, try these methods:

• Inject Branch Metadata During Scan Trigger
  If using the Checkmarx CLI, include the branch name as a custom parameter in your scan command. For example:

  cx scan --project "MyProject" --branch $(git rev-parse --abbrev-ref HEAD) --additional-params "-branchName $(git rev-parse --abbrev-ref HEAD)"
  

  This adds the branch name to the scan’s metadata, which will show up in the Checkmarx UI.
• View Branch Info in the Checkmarx Web UI
  After a scan completes, navigate to the scan results page. Open the scan details and look for the Scan Information tab—here you’ll find the branch name if you passed the metadata correctly. You can also customize the scan list view by adding the "Branch" column: click the column selector icon, toggle "Branch" on, and you’ll see the branch name directly in the results list.
• Leverage CI/CD Environment Variables
  If you’re triggering scans via CI/CD, use the platform’s built-in environment variable for the current branch (e.g., $CI_COMMIT_BRANCH in GitLab, BRANCH_NAME in Azure DevOps). Pass this variable into your Checkmarx scan command, and the branch information will automatically be attached to the scan result without extra manual work.

内容的提问来源于stack exchange，提问作者Deepak Garg