Skip to main content

​
Overview

Repository tags group repositories for shared scanner settings, access, and reporting. Open them from Settings, in the Security group, under Repository tags. The page lists your tags, lets you search them with Search tags… and add one with Create Tag. It is shown to organization admins and to members with the Manage Teams permission. Tags and teams also drive the repository filter in the top bar, described in Navigating ZeroPath. Open the page at zeropath.com/app/settings/tags.

​
Who can manage tags

The Repository tags page and every tag change require the Manage Teams or the Edit SAST Configuration permission. Edit SAST Configuration can’t be granted through a team, so a member who is not an admin needs a team that grants Manage Teams. Without either permission, the page says “You do not have permission to view repository tags. Ask an organization admin for the Team Manage or SAST Configuration permission.” A tag that grants a team access to repositories can be edited or deleted only with Manage Teams, because changing it changes who can see those repositories. Members without these permissions can still pick existing tags wherever a page offers a tag selector, for example in the top-bar repository filter or a report’s scope.

​
The tag list

Each tag in the list shows:
  • Its name, description and number of repositories.
  • All repositories when it is a Default tag.
  • Its custom property filters and its dynamic trigger, when it has them, or Manually assigned when it has neither and is not a Default tag.
Each row has three actions: Scanner settings opens the tag’s overrides in the Scanner workspace (shown when you can open Scanner settings), Edit tag opens the editor, and Delete tag removes the tag after you confirm. Deleting a tag removes it from all repositories, removes its scanner overrides, and revokes any team access granted through it. Sync GitHub properties in the page header reads the custom properties of your GitHub repositories again and updates tag membership to match.

​
Creating and editing a tag

Create Tag opens Create New Tag, and Edit tag opens Edit Tag. Both have the same fields: Save with Create Tag or Update Tag.

​
How membership works

A repository belongs to a tag for one of these reasons:
  • You added it. A repository you pick in Repositories stays in the tag until you remove it, whatever its custom properties are.
  • Its custom properties match. When a tag has custom property filters, every repository that has all of the selected properties joins it. A tag with no filters adds nothing on its own. Custom properties come from GitHub, so only GitHub repositories match filters.
  • The tag is a Default tag. Every repository joins it.
A repository you exclude stays out, even when its properties match or the tag is a Default tag. Exclusions come first, then repositories you added or pinned and Default tags, then property filters.

​
Member chips in the editor

Repositories in the editor’s Repositories section that the tag’s filters select carry a label:
  • via custom property: the filters alone keep it in the tag. Click Pin to keep it in the tag even if its properties change later.
  • Pinned: it is in the tag for another reason too, such as being added by hand or through a Default tag, so it stays whatever its properties are. Click Unpin to let the filters decide again.
A repository the filters don’t select shows no label.

​
Removing a repository

When you remove a repository that the tag’s filters or its Default setting would add back, the editor moves it to the Excluded list with the label Excluded manually (overrides custom property). It stays out until you click Undo next to it, and Undo lets the filters decide again. When you remove a repository that nothing else would keep, or change the filters so that they stop selecting a member, the repository appears under Not selected by this tag’s filters with Removed when you save. Click Keep to add it to the tag by hand instead. Some tags show repositories under Excluded with Pre-existing exclusion (overrides custom property). ZeroPath recorded these when it started tracking membership this way: the repository matched the tag’s filters but was not a member at the time, so it was kept out. Click Undo to let the filters add it.

​
Keeping membership in line with custom properties

ZeroPath applies the same membership rules whenever something could change a tag:
  • when you save a tag,
  • when a repository’s custom properties change in GitHub,
  • when repositories are added to ZeroPath, from any source, and
  • on a regular schedule.
Repositories you added, pinned or excluded keep that choice through all of these. A custom property change in GitHub usually reaches ZeroPath within about a minute; large batches take longer. A property you clear in GitHub takes your GitHub organization’s default value, if one is set, and the repository’s tags follow that value. New repositories join their Default tags and matching property tags as soon as they are added. When you split a repository into directory partitions, each new partition starts with the exclusions of its base repository and then follows Default tags and property filters.

​
Default tags

Check Default tag to apply a tag to all existing repositories and to every repository added later. When you turn it on for an existing tag, ZeroPath asks you to confirm: “Marking this tag as default will add it to all existing repositories in this organization and to repositories added later.” Repositories you excluded from the tag stay excluded after you turn Default tag on.

​
Confirm access change

When a team gets access to repositories through a tag, changing the tag’s members changes what that team can see. For a tag that grants team access, any save that can change its membership opens a Confirm access change step first: “This tag grants team access. Review which repositories will join or leave before saving.” The step shows how many repositories join and how many leave, and names up to 10 of each. Click Apply changes to save, or Cancel to go back to the editor. Changes to the name, description or trigger save without this step. While the preview is loading or the save is running, the dialog can’t be closed.

​
What tags drive

Tags are used across ZeroPath wherever you scope something to a group of repositories:

​
Internet exposure trigger

The Internet exposure trigger works with the Wiz integration. The editor describes it as “Apply this tag when the repository is reachable from the public internet.” What it does is narrower than that description. The trigger does not add repositories to the tag. When a tag has it, the custom rules, context, and custom sources and sinks scoped to the tag apply during scans only to the applications in the tag’s repositories that Wiz reports as reachable from the public internet. To use it, add the repositories to the tag by hand, by filters or as a Default tag, then select Internet exposure.