Feat/proposal selective scan all scope

[SoumyaRaikwar]

Summary

Add design proposal to enable selective scoping for scheduled "Scan All" executions in Harbor. This proposal introduces an optional X-Scan-All-Scope header that allows administrators to limit scheduled vulnerability scans to specific projects or repositories instead of scanning all artifacts.

Background

Addresses community issue https://github.com/goharbor/harbor/issues/22266 where users requested granular control over scan scope to reduce unnecessary scanning and optimize resource usage in large Harbor installations.

[SoumyaRaikwar]

@stonezdj , @Vad1mo @AllForNothing , could you please review my proposal

[Vad1mo]

I like the idea, but I don't think this is the right approach to implementing it. especially the X-Scan-All-Scope header

• scan all should be replaced with scan policies, as Harbor is policy driven system. This way the sysadm could create policies to scan image based on various criteria.

Following criteria come into my mind:

• cron for selected projects (similar to what you have)
• cron for selected project + pulled/pushed images x days ago
• scan all
• scan all + pulled/pushed images x days ago
• more policies possible. e.g. labels.

[SoumyaRaikwar]

@Vad1mo
I agree that Harbor is fundamentally a policy-driven system, and a unified scan policy model is the right long-term direction.

This proposal was intended as a small, incremental improvement to the existing scheduled “Scan All” feature with minimal surface-area change and full backward compatibility. I see scoped scheduling as a possible stepping stone, not an alternative to scan policies.

I’m happy to adjust the proposal based on the preferred direction. Also, I’ll make sure to update the documentation clearly describing the behavior, limitations, and intended scope of this feature.

Please let me know whether you’d prefer this to remain a short-term improvement or be reworked into a policy-based design.

[Vad1mo]

Let's do it right in policy fashion, with backwards compatibility.
For better clarification and allignement in the community and among the maintainers, can you add mockups e.g UI. and diagrams where applicable?

[SoumyaRaikwar]

@Vad1mo i have updated the pr goharbor/harbor#22392 could you please review

[SoumyaRaikwar]

Thanks @Vad1mo for the feedback!

Valid point regarding the policy-based approach. We can certainly iterate towards a more robust policy engine in the future. However, given the immediate need to resource optimization in large installations, this "selective scope" acts as a lightweight, backward-compatible interim solution that fits within the current scheduling architecture without a major refactor.

I've implemented the changes in the working PR including the backend logic and the UI coverage.

Here are the mockups/screenshots of the UI implementation as requested:

Selective Scan Configuration: