rharp / snyk-pr-diff

Snyk PR Diff

Fail Snyk CLI scans only if there are new issues introduced (similar to automated Snyk PR checks). Gets the delta between two Snyk Code or IaC JSON files before failing the scan. Particularly useful when running Snyk CLI scans in your local environment, git hooks, CI/CD etc.

Compares two JSON files for both Snyk Code and IaC to provide details on:

• New vulnerabilities not found in the baseline scan

Prerequisites

• Must provide two Snyk Code or IaC JSON files: one baseline scan and one scan where code changes have occurred

Supported Snyk products

Product	Supported
Code	✅
Open Source	❌
Container	❌
IaC	✅

Usage

• Run a Snyk scan and output a JSON file as the baseline.
• Run another Snyk scan that has code changes and output a JSON file.
• Usage: snyk-pr-diff <code/iac> <baseline_scan.json> <pr_scan.json>
• Example: snyk-diff-amd64-linux code /home/runner/work/goof/goof/snyk_code_baseline.json /home/runner/work/goof/goof/snyk_code_pr.json

Examples

• GitHub Action example: https://github.com/hezro/snyk-code-pr-diff/blob/main/examples/github-action-baseline-scan-and-pr-scan.yml

GitHub Action Screenshot