diff --git a/src/cli/commands/test/iac/local-execution/types.ts b/src/cli/commands/test/iac/local-execution/types.ts index 43d1397e90..5d83eb85ef 100644 --- a/src/cli/commands/test/iac/local-execution/types.ts +++ b/src/cli/commands/test/iac/local-execution/types.ts @@ -365,6 +365,7 @@ export enum IaCErrorCodes { CwdTraversal = 2003, NoBundle = 2004, OpenBundle = 2005, + InvalidSeverityThreshold = 2006, Scan = 2100, UnableToRecognizeInputType = 2101, UnsupportedInputType = 2102, diff --git a/src/cli/commands/test/iac/v2/index.ts b/src/cli/commands/test/iac/v2/index.ts index 96089500cf..be13427a8a 100644 --- a/src/cli/commands/test/iac/v2/index.ts +++ b/src/cli/commands/test/iac/v2/index.ts @@ -58,5 +58,6 @@ async function prepareTestConfig( orgSettings, userRulesBundlePath: config.IAC_BUNDLE_PATH, userPolicyEnginePath: config.IAC_POLICY_ENGINE_PATH, + severityThreshold: options.severityThreshold, }; } diff --git a/src/lib/iac/test/v2/errors.ts b/src/lib/iac/test/v2/errors.ts index a62ff07920..b5abded85a 100644 --- a/src/lib/iac/test/v2/errors.ts +++ b/src/lib/iac/test/v2/errors.ts @@ -12,6 +12,8 @@ const snykIacTestErrorsUserMessages = { 'Running the scan from outside of the current working directory is not supported', NoBundle: 'A rules bundle were not provided', OpenBundle: "The Snyk CLI couldn't open the rules bundle", + InvalidSeverityThreshold: + 'The provided severity threshold is invalid. The following values are supported: "low", "medium", "high", "critical"', Scan: defaultUserMessage, UnableToRecognizeInputType: 'Input type was not recognized', UnsupportedInputType: 'Input type is not supported', diff --git a/src/lib/iac/test/v2/scan/index.ts b/src/lib/iac/test/v2/scan/index.ts index dfc28614bc..b84dfdcfb7 100644 --- a/src/lib/iac/test/v2/scan/index.ts +++ b/src/lib/iac/test/v2/scan/index.ts @@ -13,7 +13,13 @@ export function scan( policyEnginePath: string, rulesBundlePath: string, ): SnykIacTestOutput { - const args = ['-bundle', rulesBundlePath, ...options.paths]; + const args = ['-bundle', rulesBundlePath]; + + if (options.severityThreshold) { + args.push('-severity-threshold', options.severityThreshold); + } + + args.push(...options.paths); const process = childProcess.spawnSync(policyEnginePath, args, { encoding: 'utf-8', diff --git a/src/lib/iac/test/v2/types.ts b/src/lib/iac/test/v2/types.ts index 075ed18e01..7662bd1dd4 100644 --- a/src/lib/iac/test/v2/types.ts +++ b/src/lib/iac/test/v2/types.ts @@ -1,4 +1,5 @@ import { IacOrgSettings } from '../../../../cli/commands/test/iac/local-execution/types'; +import { SEVERITY } from '../../../snyk-test/legacy'; export interface TestConfig { paths: string[]; @@ -7,4 +8,5 @@ export interface TestConfig { userPolicyEnginePath?: string; projectName: string; orgSettings: IacOrgSettings; + severityThreshold?: SEVERITY; }