False-positives invalidation and static security scans without scanning based on regular scan history in pull requests

A computer program product (CPP) comprising:

• a machine-readable storage device;
• and
• computer code stored on the machine-readable storage device, with the computer code including instructions and data for causing a processor(s) set to perform operations including the following:
• receiving, from a target repository, a set of source code from a first operating environment,
• scanning, during a pull request of the target repository, the set of source code,
• determining, by a security determination module, that a first subset of the source code includes a security vulnerability,
• analyzing the first operating environment for the set of source code and the target repository, with the analysis including determining whether the first operating environment for the set of source code and the target repository have a set of storage device controllers that are structured and configured to support the set of source code and the target repository,
• responsive to the analysis of the first operating environment, determining that the security vulnerability of the first subset of the source code cannot be exploited,
• responsive to the determination, returning a false positive notification for the security vulnerability, and
• setting up a trigger for invalidating a false positive based, at least in part, on which group of false positives is invalidated, the trigger for invalidating the false positive being set up in order to reduce a time spent re-analyzing false positives, the trigger for invalidating the false positive, during a next scan, unmarking the false positive and forcing a scanner to check again for false positives.

A computer system (CS) comprising:

• one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
• receiving, from a target repository, a set of source code from a first operating environment,
• scanning, during a pull request of the target repository, the set of source code,
• determining, by a security determination module, that a first subset of the source code includes a security vulnerability,
• analyzing the first operating environment for the set of source code and the target repository, with the analysis including determining whether the first operating environment for the set of source code and the target repository have a set of storage device controllers that are structured and configured to support the set of source code and the target repository,
• responsive to the analysis of the first operating environment, determining that the security vulnerability of the first subset of the source code cannot be exploited, responsive to the determination, returning a false positive notification for the security vulnerability, and
• setting up a trigger for invalidating a false positive based, at least in part, on which group of false positives is invalidated, the trigger for invalidating the false positive being set up in order to reduce a time spent re-analyzing false positives, the trigger for invalidating the false positive, during a next scan, unmarking the false positive and forcing a scanner to check again for false positives.