Prevent feature for CLI tests
npm install snyk-delta*
This repository is in maintenance mode, no new features are being developed. Bug & security fixes will continue to be delivered. Open source contributions are welcome for small features & fixes (no breaking changes)
Compares 2 Snyk project snapshots to provide details on:
- New vulnerabilities not found in the baseline snapshot
- New license issues not found in the baseline snapshot
- Dependencies delta between 2 snapshots:
- direct dependencies added and removed
- indirect dependencies added and removed
- issue path(s) introducing new vulnerabilities
SNYK_TOKEN enviroment variable. Create a service account in Snyk and use the provided token.| Product | Supported |
| ---- | --------- |
| Open Source | ✅ |
| Container | ✅ |
| IaC | ❌ |
| Code | ❌ |
npm i -g snyk-delta or grab a binary from the release page--baselineOrg optionalOrganization to use as baseline. Snyk organization ID can be located in the organization settings
Example: --orgID 0e9373a6-f858-11ec-b939-0242ac120002
- --baselineProject optional
Project to use as baseline. Public Snyk project ID can be located in project settings
Example: --baselineProject 0e9373a6-f858-11ec-b939-0242ac120002
- --targetReference optional
Target reference to compare. Target references can be used to delineate between branches, tags, or other custom references in the Snyk platform.
For more information on target references, see the Snyk documentation.
Example: --targetReference my-branch-name
- --currentProject optional
Project to compare. Public Snyk project ID can be located in project settings
Example: --currentProject 0e9373a6-f858-11ec-b939-0242ac120002
- --currentOrg optional
Organization to compare. Snyk organization ID can be located in the organization settings
Example: --orgID 0e9373a6-f858-11ec-b939-0242ac120002
- --fail-on optional
As in Snyk CLI with the --fail-on flag return non 0 error code when new issues are upgradable, patchable, or both (all)..
Example: --fail-on all
- --setPassIfNoBaseline optional
Do not fail with exit code 1 if the current project is not monitored in Snyk and could not be compared. When snyk-delta compares test results, it tries to find the same project monitored on the Snyk platform. If no monitored project is found, is will return all the issues found by the CLI scan, essentially acting as pass through if this is enabled.
Example: --setPassIfNoBaseline true
- --type optional
Specify Snyk issue type to compare. Defaults all, available options: vuln, license, all.
Example: --type vuln
snyk test --json --print-deps | snyk-delta snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx
- Use the --setPassIfNoBaseline if used with snyk-prevent-gh-commit-status and the project is not monitored. This will prevent snyk-prevent-gh-commit-status to fail. setPassIfNoBaseline defaults to false.
snyk test --json --print-deps | snyk-delta --baselineOrg xxx --baselineProject xxx --setPassIfNoBaseline true
snyk-delta --baselineOrg xxx --baselineProject xxx --currentOrg xxx --currentProject xxx --setPassIfNoBaseline false``
import { getDelta } from 'snyk-delta'
const jsonResultsFromSnykTest = Read from file or pipe snyk test command
const result = await getDelta(jsonResultsFromSnykTest);
`
Actual issue(s) details will be listed on stdout.
to see help documentation.Exit codes
- 0 - no new license/vulnerability issues introduced
- 1 - new license/vulnerability issues introduced
- 2 - error
$3
Usage as a module requires list of issues coming from Snyk CLI.
Currently not compatible with data coming straight from Snyk APIs.$3
Snyk-delta doesn't currently support the --all-projects` option, but you can try to use snyk_delta_all_projects.sh as an example of how to work around this.