scascand

Purpose

scascand is the daemon counterpart to sca: it polls ClickHouse for repositories flagged as pending a scan (connected through the dashboard via GitHub/GitLab OAuth, or added directly for public/SSH-accessible Git repos), authenticates using the stored, encrypted OAuth token or the local SSH agent, runs the same Maven/npm/Go/ Cargo dependency scan as sca, and writes findings back to ClickHouse.

Usage

scascand -c <config.yaml> [-debug] [-once]

Flag	Description
`-c`	Path to config file (required)
`-debug`	Enable debug logging
`-once`	Run one polling pass and exit, instead of looping

Configuration

name: scascand

clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: insights
  password: secret

redis:
  host: localhost
  port: 6379

poll_interval: 30s   # how often to check for pending scans, default 30s
debug: true

For OAuth-connected repositories (GitHub, GitLab), the encrypted access token is decrypted using a key stored in the ClickHouse config table (sca_encryption_key, a 32-byte hex string — the same key insights’s sca.oauth.encryption_key setting uses). For repositories with provider git (generic, not OAuth-linked), scascand uses SSH-agent authentication for SSH URLs, or a plain unauthenticated clone for public HTTPS URLs.

Example

# Run as a daemon, polling every poll_interval
scascand -c configs/scascand.yaml

# Run a single poll pass and exit (useful for testing/cron)
scascand -c configs/scascand.yaml -once

sca devctl