Self-detecting Snyk Scan Type

[maira-samtek]

No description provided.

[yonassrobi]

Thanks @maira-samtek.

I see that you have added auto-detection for Snyk scan type. How does the auto-detect work? Is it based on the setting on the Snyk org?

I guess where I’m getting at is …what if an ADO wants to specify only one type of Snyk test (i.e. open-source)? Would they be able to do that only for the JIRA integration?

[maira-samtek]

Thanks @maira-samtek.

I see that you have added auto-detection for Snyk scan type. How does the auto-detect work? Is it based on the setting on the Snyk org?

I guess where I’m getting at is …what if an ADO wants to specify only one type of Snyk test (i.e. open-source)? Would they be able to do that only for the JIRA integration?

The current workflow for our Snyk integrations runs a command that checks for vulnerabilities in all the project files in a repository and saves the results in a JSON format. The format of this output changes based on the type of files found.
For example:
If the repository has Infrastructure as Code (like Terraform files), the output will include a section called "infrastructureAsCodeIssues."
If it finds open-source project files (like package.json or nested manifest files), it will list those projects along with their vulnerabilities.
If the output shows vulnerabilities at the first level in the JSON, it’s considered a container scan.
In the mac-fc-embedded here, the package.json is identified as a container scan, while the TMSIS repo here lists multiple projects with vulnerabilities, making it an open-source scan (I've attached screenshots for both cases on slack embedded team channel).
Regarding your question, if a ADO wants specific repo wants to focus only on Infrastructure as Code, they can change the command to run only the IAC test. For instance, you would replace line 22 (snyk test --all-projects --json > snyk_output.txt || true) in the mac-fc-embedded file with: snyk iac test --json > snyk_output.txt || true

[yonassrobi]

LGTM. Thanks for adding the additional error messages to make debugging easier for the next time.