Fail Snyk CLI scans only if there are new issues introduced (similar to automated Snyk PR checks). Gets the delta between two Snyk Code or IaC JSON files before failing the scan. Particularly useful when running Snyk CLI scans in your local environment, git hooks, CI/CD etc.
Compares two JSON files for both Snyk Code and IaC to provide details on:
- New vulnerabilities not found in the baseline scan
- Must provide two Snyk Code or IaC JSON files: one baseline scan and one scan where code changes have occurred
Product | Supported |
---|---|
Code | ✅ |
Open Source | ❌ |
Container | ❌ |
IaC | ✅ |
- Run a Snyk scan and output a JSON file as the baseline.
- Run another Snyk scan that has code changes and output a JSON file.
- Usage:
snyk-pr-diff
<code/iac>
<baseline_scan.json>
<pr_scan.json>
- Example:
snyk-diff-amd64-linux code /home/runner/work/goof/goof/snyk_code_baseline.json /home/runner/work/goof/goof/snyk_code_pr.json