A scan schedule keeps Detect AI results and Bills of Materials (BOMs) current for a VCS integration without running Discovery and Detect AI by hand. You choose a frequency, Weekly or Monthly, and each scheduled run finds new and changed repositories, checks them for AI and creates or rescans a BOM for each repository that contains AI.

Read what a run does before you turn a schedule on. The first run can create many new BOMs at once, and those BOMs are not linked to an AI System.

What a Scheduled Run Does

Each run works through the integration in this order:

1. Runs Discovery on the integration to find its repositories.
2. Runs Detect AI on each repository with activity in the last 365 days. Archived repositories are skipped.
3. Creates a BOM for each repository with AI that does not already have one. These BOMs have the description "Automatically created from Detect AI results."
4. Rescans an existing BOM for a repository only when one of these is true:
5. • The repository changed since the last scan.
   • The last scan of the BOM failed or was aborted.
   • The scanner version changed.

BOMs that a run creates are not linked to any AI System. If you track BOMs by AI System, link each new BOM yourself after the run, as described in Linking New BOMs to an AI System below.

Before You Schedule

Permissions

Scheduling, editing and stopping scans needs the VCS Scan Schedules Update permission. In the role editor it appears as Edit on the VCS Scan Schedules row. Every role that has VCS Integrations Update receives it automatically.

Scheduling scans or changing the frequency also needs the Detect AI scan permission and Bill of Materials Create. Without them, the buttons are disabled and show the tooltip "Scheduling scans also needs the Detect AI scan and BOM creation permissions."

Schedule Limit

Your organization can have up to 50 schedules. Stopped schedules count toward this limit. When the limit is reached, scheduling shows the message "Your organization has reached the maximum number of schedules. Contact Cranium support for help."

First Run Volume

The first run creates a BOM for every repository with AI that does not have one. On a large integration, expect many new BOMs from that first run.

Scheduling Scans

1. Go to Integrations and open the VCS Integrations tab.
2. Select the integration name to open its details panel.
3. In the details panel, select Schedule Scans.
4. In the Schedule scans dialog, under Choose scan frequency, select Weekly or Monthly. Weekly is selected by default.
5. Select Schedule.

The Scan Schedule section of the details panel now shows the schedule.

When Scans Run

The timing of a schedule comes from the moment you turn scheduling on. There is no day or time picker, so schedule scans on the day and at the time you want runs to take place.

• Weekly: Runs every week on the same weekday and at the same UTC time as when scheduling was turned on.
• Monthly: Runs every month on the same day of the month as when scheduling was turned on. If that day is after the 28th, runs take place on the 28th.

Changing the frequency moves the schedule to the time of the change. Scan times are shown in your local time.

Checking a Schedule

The VCS Integrations tab has two columns for scheduled scans:

• Last Scheduled Scan: When the most recent scheduled run took place. Discovery that you run by hand is not included.
• Next Scheduled Scan: When the next scheduled run will take place.

The Scan Schedule section of an integration's details panel shows one of these:

• Scheduled, with these fields:
• • Frequency: Weekly or Monthly.
  • Next scan: When the next scheduled run will take place.
  • Last scan: When the most recent scheduled run took place.
• Not scheduled: The integration has no active schedule.

Changing or Stopping a Schedule

1. Go to Integrations and open the VCS Integrations tab.
2. Select the integration name to open its details panel.
3. Select one of these:
4. • Edit Scheduled Scans to change the frequency. Choose Weekly or Monthly and save the change.
   • Stop Scheduled Scans to stop future runs.

Who Owns New BOMs

BOMs that a scheduled run creates belong to the person who last scheduled, edited or stopped the schedule. If someone stops a schedule while a run is in progress, that person becomes the owner of the BOMs from that run.

Linking New BOMs to an AI System

BOMs from a scheduled run are not linked to an AI System. To link one, start from the AI System:

1. Open the AI System.
2. On the Overview tab, select Add Artifacts.
3. Select the Bill of Materials.

To find the BOMs a run created, look for the description "Automatically created from Detect AI results." For more about the AI System page, see the AI System Details Overview article.