feat: new —help documentation

help/commands-docs/_ENVIRONMENT.md

@@ -0,0 +1,15 @@
+## ENVIRONMENT
+
+You can set these environment variables to change CLI run settings. These keys will override settings in your `snyk config`:
+
+- `SNYK_TOKEN`:
+  Snyk authorization token. Setting this envvar will override the token that may be available in your `snyk config` settings.
+
+  [How to get your account token](https://snyk.co/ucT6J)<br />
+  [How to use Service Accounts](https://snyk.co/ucT6L)<br />
+
+- `SNYK_API`:
+  Sets API host to use for Snyk requests. Useful for on-premise instances and configuring proxies.
+
+- `SNYK_CFG_`<KEY>:
+  Allows you to override any key that's also available as `snyk config` option.

help/commands-docs/_EXAMPLES.md

@@ -0,0 +1,29 @@
+## EXAMPLES
+
+- `Authenticate in your CI without user interaction`:
+  \$ snyk auth MY_API_TOKEN
+- `Test a project in current folder for known vulnerabilities`:
+  \$ snyk test
+- `Test a specific dependency for vulnerabilities`:
+  \$ snyk test ionic@1.6.5
+
+More examples:
+
+    $ snyk test --show-vulnerable-paths=false
+    $ snyk monitor --org=my-team
+    $ snyk monitor --project-name=my-project
+
+### Container scanning
+
+See `snyk container --help` for more details and examples:
+
+    $ snyk container test ubuntu:18.04 --org=my-team
+    $ snyk container test app:latest --file=Dockerfile --policy-path=path/to/.snyk
+    $ snyk test --yarn-workspaces --detection-depth=4 --strict-out-of-sync=false
+
+### Infrastructure as Code (IAC) scanning
+
+See `snyk iac --help` for more details and examples:
+
+    $ snyk iac test /path/to/Kubernetes.yaml
+    $ snyk iac test /path/to/terraform_file.tf

help/commands-docs/_EXIT_CODES.md

@@ -0,0 +1,8 @@
+## EXIT CODES
+
+Possible exit codes and their meaning:
+
+**0**: success, no vulns found<br />
+**1**: action_needed, vulns found<br />
+**2**: failure, try to re-run command<br />
+**3**: failure, no supported projects detected<br />

help/commands-docs/_NOTICES.md

@@ -0,0 +1,5 @@
+## NOTICES
+
+### Snyk API usage policy
+
+The use of Snyk's API, whether through the use of the 'snyk' npm package or otherwise, is subject to the [terms & conditions](https://snyk.co/ucT6N)

help/commands-docs/_SNYK_COMMAND_HEADER.md

@@ -0,0 +1,51 @@
+# snyk(1) -- CLI and build-time tool to find & fix known vulnerabilities in open-source dependencies
+
+## SYNOPSIS
+
+`snyk` \[<COMMAND>] \[<SUBCOMMAND>] \[<OPTIONS>] \[<PACKAGE>] \[-- <COMPILER_OPTIONS>]
+
+## DESCRIPTION
+
+Snyk helps you find, fix and monitor known vulnerabilities in open-source dependencies.<br />
+For more information see https://snyk.io
+
+### Not sure where to start?
+
+1. authenticate with `$ snyk auth`
+2. test your local project with `$ snyk test`
+3. get alerted for new vulnerabilities with `$ snyk monitor`
+
+## COMMANDS
+
+To see command-specific flags and usage, see `help` command, e.g. `snyk container --help`.
+Available top-level CLI commands:
+
+- `auth` \[<API_TOKEN>\]:
+  Authenticate Snyk CLI with a Snyk account
+
+- `test`:
+  Test local project for vulnerabilities
+
+- `monitor`:
+  Snapshot and continuously monitor your project
+
+- `container`:
+  Test container images for vulnerabilities. See `snyk container --help` for full instructions.
+
+- `iac`:
+  Find security issues in your Infrastructure as Code files. See `snyk iac --help` for full instructions.
+
+- `config`:
+  Manage Snyk CLI configuration
+
+- `protect`:
+  Applies the patches specified in your .snyk file to the local file system
+
+- `policy`:
+  Display the .snyk policy for a package.
+
+- `ignore`:
+  Modifies the .snyk policy to ignore stated issues
+
+- `wizard`:
+  Configure your policy file to update, auto patch and ignore vulnerabilities. Snyk wizard updates your .snyk file.

help/commands-docs/_SNYK_COMMAND_OPTIONS.md

@@ -0,0 +1,176 @@
+## OPTIONS
+
+To see command-specific flags and usage, see `help` command, e.g. `snyk container --help`.
+For advanced usage, we offer language and context specific flags, listed further down this document.
+
+- `--all-projects`:
+  (only in `test` and `monitor` commands)
+  Auto-detect all projects in working directory
+
+- `--detection-depth`=<DEPTH>:
+  (only in `test` and `monitor` commands)
+  Use with --all-projects or --yarn-workspaces to indicate how many sub-directories to search. `DEPTH` must be a number.
+
+  Default: 4 (the current working directory and 3 sub-directories)
+
+- `--exclude`=<DIRECTORY>[,<DIRECTORY>]...>:
+  (only in `test` and `monitor` commands)
+  Can be used with --all-projects and --yarn-workspaces to indicate sub-directories to exclude. Directories must be comma separated.
+
+  If using with `--detection-depth` exclude ignores directories at any level deep.
+
+- `--prune-repeated-subdependencies`, `-p`:
+  (only in `test` and `monitor` commands)
+  Prune dependency trees, removing duplicate sub-dependencies.
+  Will still find all vulnerabilities, but potentially not all of the vulnerable paths.
+
+- `--print-deps`:
+  (only in `test` and `monitor` commands)
+  Print the dependency tree before sending it for analysis.
+
+- `--remote-repo-url`=<URL>:
+  Set or override the remote URL for the repository that you would like to monitor.
+
+- `--dev`:
+  Include devDependencies.
+
+  Default: scan only production dependencies
+
+- `--org`=<ORG_NAME>:
+  Specify the <ORG_NAME> to run Snyk commands tied to a specific organization. This will influence where will new projects be created after running `monitor` command, some features availability and private tests limits.
+  If you have multiple organizations, you can set a default from the CLI using:
+
+  `$ snyk config set org`=<ORG_NAME>
+
+  Setting a default will ensure all newly monitored projects will be created
+  under your default organization. If you need to override the default, you can use the `--org`=<ORG_NAME> argument.
+
+  Default: uses <ORG_NAME> that sets as default in your [Account settings](https://app.snyk.io/account)
+
+- `--file`=<FILE>:
+  Sets a package file.
+
+  When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information. When ommitted Snyk will try to detect the appropriate file for your project.
+
+- `--ignore-policy`:
+  Ignores all set policies. The current policy in `.snyk` file, Org level ignores and the project policy on snyk.io.
+
+- `--trust-policies`:
+  Applies and uses ignore rules from your dependencies' Snyk policies, otherwise ignore policies are only shown as a suggestion.
+
+- `--show-vulnerable-paths`=none|some|all:
+  Display the dependency paths from the top level dependencies, down to the vulnerable packages. Doesn't affect output when using JSON `--json` output.
+
+  Default: <some> (a few example paths shown)
+  <false> is an alias for <none>.
+
+- `--project-name`=<PROJECT_NAME>:
+  Specify a custom Snyk project name.
+
+- `--policy-path`=<PATH_TO_POLICY_FILE>`:
+  Manually pass a path to a snyk policy file.
+
+- `--json`:
+  Prints results in JSON format.
+
+- `--json-file-output`=<OUTPUT_FILE_PATH>:
+  (only in `test` command)
+  Save test output in JSON format directly to the specified file, regardless of whether or not you use the `--json` option.
+  This is especially useful if you want to display the human-readable test output via stdout and at the same time save the JSON format output to a file.
+
+- `--severity-threshold`=low|medium|high:
+  Only report vulnerabilities of provided level or higher.
+
+- `--fail-on`=all|upgradable|patchable:
+  Only fail when there are vulnerabilities that can be fixed.
+
+  <all> fails when there is at least one vulnerability that can be either upgraded or patched.
+  <upgradable> fails when there is at least one vulnerability that can be upgraded.
+  <patchable> fails when there is at least one vulnerability that can be patched.
+
+  If vulnerabilities do not have a fix and this option is being used, tests will pass.
+
+- `--dry-run`:
+  (only in `protect` command)
+  Don't apply updates or patches during `protect` command run.
+
+- `--` \[<COMPILER_OPTIONS>\]:
+  Pass extra arguments directly to Gradle or Maven.
+  E.g. `snyk test -- --build-cache`
+
+Below are flags that are influencing CLI behavior for specific projects, languages and contexts:
+
+### Maven options
+
+- `--scan-all-unmanaged`:
+  Auto detects maven jars and wars in given directory. Individual testing can be done with `--file`=<JAR_FILE_NAME>
+
+- `--reachable`:
+  (only in `test` and `monitor` commands)
+  Analyze your source code to find which vulnerable
+  functions and packages are called.
+
+- `--reachable-timeout`=<TIMEOUT>:
+  The amount of time (in seconds) to wait for Snyk to gather reachability data. If it takes longer than <TIMEOUT>, Reachable Vulnerabilities are not reported. This does not affect regular test or monitor output.
+
+  Default: 300 (5 minutes).
+
+### Gradle options
+
+[More information about Gradle CLI options](https://snyk.co/ucT6P)
+
+- `--sub-project`=<NAME>, `--gradle-sub-project`=<NAME>:
+  For Gradle "multi project" configurations, test a specific sub-project.
+
+- `--all-sub-projects`:
+  For "multi project" configurations, test all sub-projects.
+
+- `--configuration-matching`=<CONFIGURATION_REGEX>:
+  Resolve dependencies using only configuration(s) that match the provided Java regular expression, e.g. `^releaseRuntimeClasspath$`.
+
+- `--configuration-attributes`=<ATTRIBUTE>[,<ATTRIBUTE>]...:
+  Select certain values of configuration attributes to resolve the dependencies. E.g. `buildtype:release,usage:java-runtime`
+
+### .Net & NuGet options
+
+- `--assets-project-name`:
+  When monitoring a .NET project using NuGet `PackageReference` use the project name in project.assets.json, if found.
+
+- `--packages-folder`:
+  Custom path to packages folder
+
+### npm options
+
+- `--strict-out-of-sync`=true|false:
+  Control testing out of sync lockfiles.
+
+  Default: true
+
+### Yarn options
+
+- `--strict-out-of-sync`=true|false:
+  Control testing out of sync lockfiles.
+
+  Default: true
+
+- `--yarn-workspaces`:
+  (only in `test` and `monitor` commands)
+  Detect and scan yarn workspaces. You can specify how many sub-directories to search using `--detection-depth` and exclude directories using `--exclude`.
+
+### CocoaPods options
+
+- `--strict-out-of-sync`=true|false:
+  Control testing out of sync lockfiles.
+
+  Default: false
+
+### Python options
+
+- `--command`=<COMMAND>:
+  Indicate which specific Python commands to use based on Python version. The default is `python` which executes your systems default python version. Run 'python -V' to find out what version is it. If you are using multiple Python versions, use this parameter to specify the correct Python command for execution.
+
+  Default: `python`
+  Example: `--command=python3`
+
+- `--skip-unresolved`=true|false:
+  Allow skipping packages that are not found in the environment.

help/commands-docs/_SNYK_GLOBAL_OPTIONS.md

@@ -0,0 +1,16 @@
+### Flags available accross all commands
+
+- `--insecure`:
+  Ignore unknown certificate authorities.
+
+- `-d`:
+  Output debug logs.
+
+- `--quiet`, `-q`:
+  Silence all output.
+
+- `--version`, `-v`:
+  Prints versions.
+
+- \[<COMMAND>\] `--help`, `--help` \[<COMMAND>\], `-h`:
+  Prints a help text. You may specify a <COMMAND> to get more details.

help/commands-docs/auth.md

@@ -0,0 +1,18 @@
+# snyk-auth(1) -- Authenticate Snyk CLI with a Snyk account
+
+## SYNOPSIS
+
+`snyk` `auth` \[<API_TOKEN>\] \[<OPTIONS>\]
+
+## DESCRIPTION
+
+Authenticate Snyk CLI with a Snyk account. Running `$ snyk auth` without an <API_TOKEN> will open a browser window and asks you to login with Snyk account and authorize. When inputting an <API_TOKEN>, it will be validated with Snyk API.
+
+When running in a CI environment <API_TOKEN> is required.
+
+## OPTIONS
+
+- \[<API_TOKEN>\]:
+  Your Snyk token. May be an user token or a service account.<br />
+  [How to get your account token](https://snyk.co/ucT6J)<br />
+  [How to use Service Accounts](https://snyk.co/ucT6L)<br />

help/commands-docs/config.md

@@ -0,0 +1,38 @@
+# snyk-config(1) -- Manage Snyk CLI configuration
+
+## SYNOPSIS
+
+`snyk` `config` `get|set|clear` \[<KEY>\[=<VALUE>\]\] \[<OPTIONS>\]
+
+## DESCRIPTION
+
+Manage your local Snyk CLI config file.
+
+This command does not manage the `.snyk` file that's part of your project. See `snyk policy`, `snyk ignore` or `snyk wizard`.
+
+## COMMANDS
+
+- `get` <KEY>:
+  Print a config value.
+
+- `set` <KEY>=<VALUE>:
+  Create a new config value.
+
+- `unset` <KEY>:
+  Remove a config value.
+
+- `clear`:
+  Remove all config values.
+
+## OPTIONS
+
+### Supported <KEY> values
+
+- `api`:
+  API token to use when calling Snyk API.
+
+- `endpoint`:
+  Defines the API endpoint to use.
+
+- `disable-analytics`:
+  Turns off analytics reporting.