Views:
If the same artifact is scanned more than once within approximately one minute with matching scan types of vulnerability, malware, or secret, only one of those scans is retained. Both the scan results and the policy evaluation from the retained scan appear in Code Security.
This is based on each scan's own timestamp, so the behavior is predictable from your pipeline.
What counts as the same artifact
Two scans are treated as the same artifact only when all of the following match:
  • Artifact content (digest or file hash)
  • Artifact name, tag, and architecture
  • The source repository and branch
Which artifact types this applies to
Rate limits apply only to artifacts that are identifiable by their content:
  • docker-archive
  • oci-archive
  • singularity
  • registry
  • file
What is not affected
The pass or fail result your pipeline receives from the scan is unchanged. This limit affects only what is recorded in Code Security.