awarelyScan: Awarely Scan: inventory, check or synchronize

• collector : String
  npm reads package-lock.json (v2/v3), npm-shrinkwrap.json or package.json in the selected directory. Python requirements.txt produces a partial inventory; use Python installed environment after creating a virtual environment inside the workspace to include installed dependencies. Java requires built JAR/WAR/EAR files and dependencies. For NuGet/.NET libraries or Go modules, choose NuGet / Go and other application ecosystems. Restore/build dependencies in an earlier stage, then scan the directory containing the dependency files or compiled application. NuGet and Go support API CVE checks; Composer, RubyGems and Cargo remain unevaluated. Go checks cover module dependencies, not the Go toolchain or standard library. Syft reads existing files; it never builds your application. Existing Awarely SBOM reuses an earlier inventory; Import normalizes an external CycloneDX application SBOM.
• allPackages : boolean (optional)
  Linux host only. Disabled selects common server packages and installed dependencies. Enabled includes all installed packages, potentially reaching your account's component limit. Both describe this agent host, not the deployed application. Changing this scope starts a new comparison baseline.
• applicationLabel : String (optional)
  A human-readable name such as shop, reports or shipping-production. It labels the local inventory; the credential controls the Monitor application/source. Keep it stable across builds for comparison and use different labels for different scans in the same job.
• credentialsId : String (optional)
  Choose a Jenkins Secret file containing the downloaded Monitor credential JSON. Use Check only for checks and Sync only for deployment synchronization. The job, agent and HTTPS API origin must be approved in Manage Jenkins → System → Awarely Scan. Local scans do not read this credential. Preflight can validate format and access, but cannot verify server-side scope, expiry or revocation without a real API operation.
• detailedLogging : boolean (optional)
  Enable extra cache verification, selected input and tool-isolation messages. Normal logging already shows progress, coverage, policy and actionable errors. Detailed logging never forwards raw CLI/Syft output, API bodies or credentials. JSON artifacts and exit/build policies are unchanged. Pipeline: detailedLogging: true.
• failOnIncomplete : boolean (optional)
  Enabled by default. Apply the selected build outcome when the inventory is partial or an API check leaves any component unevaluated. REPORT_ONLY does not disable this policy. A local SBOM does not assess CVEs; this option then concerns inventory coverage only. Invalid input, API failures and verification errors fail the step regardless of this setting.
• mode : String (optional)
  Local saves an SBOM as a build artifact and needs no credential. Check sends inventory to Monitor and returns findings without saving inventory or changing alerts. Sync immediately replaces only the credential's source; use it after a successful deployment with a separate Sync credential and administrator approval. Partial/empty inventories cannot sync. Use Validate configuration only to inspect setup without sending anything.
• path : String (optional)
  Enter a path relative to this build's workspace: . for its root, services/shop for an application, or reports/inventory.cdx.json for Import/Existing SBOM. Do not paste a shell command, absolute path, ~/, or ../. Check out and build the application before this step. Symlinks escaping the workspace are refused. Linux scans the agent host; it does not scan a container or production server.
• policyResult : String (optional)
  UNSTABLE is the backward-compatible default. The step completes; add skipStagesAfterUnstable() to a Declarative Pipeline when later stages must be skipped. FAILURE preserves the report and throws a step failure, stopping normal subsequent Pipeline execution. catchError, try/catch or custom orchestration may deliberately catch that failure; review deployment logic. A build result is never improved from an earlier worse result.
• preflightOnly : boolean (optional)
  Run this job after checkout/build to check the actual agent, selected path, private output permissions, CLI cache/download policy and (for check/sync) the accessible Secret file format and approved destination. No scanner, project code, download or Monitor API request runs. Temporary private directories are created and removed. Read PASS, INFO, PENDING and NOT TESTED lines in the console, then turn this option off and run again. SUCCESS here means configuration checks passed, not that vulnerabilities were assessed. Network access, token validity/scope and managed Syft preparation are verified only by a real scan/API operation.
• severityThreshold : String (optional)
  Only Check evaluates severity. HIGH includes HIGH and CRITICAL version-confirmed matches. Product-only matches are reported without triggering this threshold. REPORT_ONLY disables only the severity gate; the incomplete-coverage policy is independent. Select the outcome below: UNSTABLE or FAILURE.