It should be possible to scan a project without updating its sbom or "risk" - just getting the exit code in the pipeline

[timbastin]

Running the scans on a different than the primary branch makes no sense. Imagine the following scenario:

main --> . --> . --> . -->
|
branch A --> . --> .

If branch A fixes a vulnerability, the next run on branch main will reopen it. The next run on branch A will then close it again. Thus Devguard should only scan the main branch to get the current security posture.

Nevertheless a developer needs feedback on the updated dependencies, if his branch has any impact on the security posture after getting merged to main. We just need the exit code - maybe we can even add a comment to the merge request about the potential impact after merging.