Fail Snyk Code CLI scans only if there are new issues introduced (similar to Snyk Code PR checks). Gets the delta between two Snyk Code JSON files before failing the scan. Particularly useful when running Snyk CLI scans in your local environment, git hooks, CI/CD etc.
Compares two Snyk Code JSON files to provide details on:
- New vulnerabilities not found in the baseline scan
Prerequisites
- Must provide two Snyk Code JSON files: one baseline scan and one scan where code changes have occurred
Supported Snyk products
| Product | Supported |
|---|---|
| Code | ✅ |
| Open Source | ❌ |
| Container | ❌ |
| IaC | ❌ |
Usage
- Run a Snyk Code scan and output a JSON file as the baseline.
- Run another Snyk Code scan that has code changes and output a JSON file.
- Usage:
snyk-code-pr-diff<baseline_scan.json><pr_scan.json> - Example:
snyk-code-pr-diff-amd64-linux /home/runner/work/goof/goof/snyk_code_baseline.json /home/runner/work/goof/goof/snyk_code_pr.json
Examples
- GitHub Action example: https://github.com/hezro/snyk-code-pr-diff/blob/main/examples/github-action-baseline-scan-and-pr-scan.yml
GitHub Action Screenshot
