snyk-delta v1.12.3
This repository is in maintenance mode, no new features are being developed. Bug & security fixes will continue to be delivered. Open source contributions are welcome for small features & fixes (no breaking changes)
Snyk snyk-delta
Fail the Snyk CLI scans during CI/CD only if there are new issues introduced (similar to Snyk PR checks). Gets the delta between 2 Snyk project snapshots before failing the scan. Particularly useful when running Snyk CLI scans in your local environment, git hooks, CI/CD etc.
Compares 2 Snyk project snapshots to provide details on:
- New vulnerabilities not found in the baseline snapshot
- New license issues not found in the baseline snapshot
- Dependencies delta between 2 snapshots:
- direct dependencies added and removed
- indirect dependencies added and removed
- issue path(s) introducing new vulnerabilities
Prerequisites
- Snyk Business or Enterprise Account (requires API access)
- Project must be monitored in Snyk to provide a baseline to compare against
- set the API token in the
SNYK_TOKEN
enviroment variable. Create a service account in Snyk and use the provided token.
Supported Snyk products
Product | Supported |
---|---|
Open Source | ✅ |
Container | ✅ |
IaC | ❌ |
Code | ❌ |
Installation
npm i -g snyk-delta
or grab a binary from the release page
Usage
--baselineOrg
optionalOrganization to use as baseline. Snyk organization ID can be located in the organization settings
Example:
--orgID 0e9373a6-f858-11ec-b939-0242ac120002
--baselineProject
optionalProject to use as baseline. Public Snyk project ID can be located in project settings
Example:
--baselineProject 0e9373a6-f858-11ec-b939-0242ac120002
--targetReference
optionalTarget reference to compare. Target references can be used to delineate between branches, tags, or other custom references in the Snyk platform. For more information on target references, see the Snyk documentation.
Example:
--targetReference my-branch-name
--currentProject
optionalProject to compare. Public Snyk project ID can be located in project settings
Example: --currentProject 0e9373a6-f858-11ec-b939-0242ac120002
--currentOrg
optionalOrganization to compare. Snyk organization ID can be located in the organization settings
Example:
--orgID 0e9373a6-f858-11ec-b939-0242ac120002
--fail-on
optionalAs in Snyk CLI with the
--fail-on
flag return non 0 error code when new issues are upgradable, patchable, or both (all)..Example:
--fail-on all
--setPassIfNoBaseline
optionalDo not fail with exit code
1
if the current project is not monitored in Snyk and could not be compared. Whensnyk-delta
compares test results, it tries to find the same project monitored on the Snyk platform. If no monitored project is found, is will return all the issues found by the CLI scan, essentially acting as pass through if this is enabled.Example:
--setPassIfNoBaseline true
--type
optionalSpecify Snyk issue type to compare. Defaults
all
, available options:vuln
,license
,all
.Example:
--type vuln
Mode: Inline
snyk test --json --print-deps | snyk-delta
Point to a specific Snyk project snapshot by specifying org+project coordinates
snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx
Use the
--setPassIfNoBaseline
if used with snyk-prevent-gh-commit-status and the project is not monitored. This will prevent snyk-prevent-gh-commit-status to fail.setPassIfNoBaseline
defaults tofalse
.snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx --setPassIfNoBaseline true
Mode: Standalone
snyk-delta --baselineOrg xxx --baselineProject xxx --currentOrg xxx --currentProject xxx --setPassIfNoBaseline false
Usage as module
import { getDelta } from 'snyk-delta'
const jsonResultsFromSnykTest = Read from file or pipe snyk test command
const result = await getDelta(jsonResultsFromSnykTest);
Actual issue(s) details will be listed on stdout.
Help
snyk-delta -h
to see help documentation.
Exit codes
0
- no new license/vulnerability issues introduced1
- new license/vulnerability issues introduced2
- error
Caution
Usage as a module requires list of issues coming from Snyk CLI. Currently not compatible with data coming straight from Snyk APIs.
snyk test --all-projects
support
Snyk-delta doesn't currently support the --all-projects
option, but you can try to use snyk_delta_all_projects.sh as an example of how to work around this.
Technical notes
Check out the docs folder.
2 months ago
2 months ago
2 months ago
1 year ago
1 year ago
1 year ago
1 year ago
1 year ago
2 years ago
2 years ago
2 years ago
3 years ago
2 years ago
2 years ago
2 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
3 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
4 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago
5 years ago