-
Notifications
You must be signed in to change notification settings - Fork 569
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: Add support for severity threshold [CFG-1991] #3451
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
notice that if your PR will get merged after this one, you'll also need to add the errors you've added to the relevant places.
@YairZ101 Could you elaborate on where the errors should be added to? |
src/cli/commands/test/iac/local-execution/types.ts - to add the error code (similar to what we did up until now) |
b78f1d4
to
94e99c0
Compare
@YairZ101 The user error was added 👍 |
94e99c0
to
fc48852
Compare
fc48852
to
6833389
Compare
What does this PR do?
--severity-threshold
flag, so that if the user specifies a value, the results returned by the Policy Engine filtered according to the specified severity.Where should the reviewer start?
Notes
How should this be manually tested?
SNYK_IAC_POLICY_ENGINE_PATH=<path-to-binary> snyk-dev iac test --experimental --severity-threshold=medium
medium
or above.SNYK_IAC_POLICY_ENGINE_PATH=<path-to-binary> snyk-dev iac test --experimental --severity-threshold=critical
critical
SNYK_IAC_POLICY_ENGINE_PATH=<path-to-binary> snyk-dev iac test --experimental --severity-threshold=wrong -d
Any background context you want to provide?
Once the new
iac test
command is able to produce output based on the results of the Policy Engine, the user might want to see only issues of a certain severity. Similarly to the current implementation, the Policy Engine defines four levels of severity. The iac test command should support the--severity-threshold
flag, read the value provided by the user (if any), and filter out the results generated by the Policy Engine to only include the vulnerabilities with the specified severity or higher.What are the relevant tickets?
Screenshots