Example threads. These questions and answers were written by the SDODS team to document real problems and how to fix them. The people named are illustrative, not real users. Questions asked on this site are marked new.
sdods analyze . on our monorepo finishes but the checklist has scan-truncated on it, and the report is nonsense: no CI provider, two modules, no test-id attribute. We have 48 workflow files and a test id on nearly every component.
The repo has .claude/worktrees/ in .gitignore, with four checkouts under it. That is where the file budget went, I assume, because .claude sorts before .github.
Is there a way to make the scan respect .gitignore?
Accepted answer
No, and you have diagnosed it exactly. The scan has a static list of directories it skips. It does not read .gitignore and it does not stop when it walks into a nested git root, so each worktree is traversed in full. The walk is alphabetical, so .claude really does eat the budget before .github is reached, and every absence-based finding after that (no-ci, no-test-ids, no-openapi) is a confident false negative rather than a fact.
Open issue, not fixed. Two workarounds, both with a cost:
sdods analyze apps/web --report-only. This completes.But at that depth there is no lockfile and no workspace root, so the package manager comes back unknown, and the base URLs get picked up from that package's own env files instead of the root ones — there is a separate open issue for each of those. You trade one wrong answer for two smaller ones.
is then honest, which matters because you are going to accept it into a project.
Whichever you pick, read the checklist first and treat scan-truncated as invalidating every "we did not find X" line in the report.
Third option that avoids both costs: analyze a shallow clone.
git clone --depth 1 <your-repo> /tmp/analyze-src
sdods analyze /tmp/analyze-src --report-onlyYou get the real root (so the lockfile and the root env files are there) with none of the untracked or ignored weight. It is what I do for any repo where I do not already know what is sitting in the ignored directories.
Wrap commands and output in triple backticks and they will render as a code block.
Checking whether you’re signed in…
Have a different question? Ask it.