Azure DevSecOps中用Snyk跳过旧漏洞仅新漏洞失败，执行报错求助

问题场景 #

在Azure DevSecOps中使用Snyk扫描项目，目标是将当前扫描结果与特定快照对比，跳过已存在的旧漏洞，仅在出现新漏洞时触发构建失败。配置的流水线任务如下：

- task: SnykSecurityScan@1
  inputs:
    projectName: 'POcPipeline'
    serviceConnectionEndpoint: 'conectionSnykAzure'
    severityThreshold: 'low'
    testType: 'app'
    monitorWhen: 'always'
    failOnIssues: false
  displayName: 'Run Snyk Security Scan'

- script: |
    npm install -g snyk snyk-delta
  displayName: 'Install Snyk and Snyk-Delta Tools'

- script: |
    ls -la
  displayName: 'List Workspace Files'

- script: |
    snyk test --json --print-deps | snyk-delta --baselineOrg 93d6123-a3rf-ub0f-yc93-216ecc08a338 --baselineProject 015b7a6-26rw-4e23-br47-74544067c54744d
  displayName: 'Snyk Vulnerability Delta Analysis'

错误信息 #

执行Snyk Delta分析时触发以下错误：

Generating script.
Script contents:
snyk test --json --print-deps | snyk-delta --baselineOrg 93d6123-a3rf-ub0f-yc93-216ecc08a338 --baselineProject 015b7a6-26rw-4e23-br47-74544067c54744d
========================== Starting Command Output ===========================
/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/0547b0-79a1-41d9-b8a1-b452342ee0.sh
Hint: use debug mode -d for more information
BadInputError: Expected 'snyk test --json' output to contain .vulnerabilities[] property but none was found. Ensure 'snyk test --json' completed successfully.
Please review the available documentation via -h or the README

##[error]Bash exited with code '2'.
Finishing: Snyk Vulnerability Delta Analysis

解决步骤 #

1. 移除错误的--print-deps参数 #

--print-deps是Snyk用于输出项目依赖树的参数，会导致snyk test --json只返回依赖数据，不包含漏洞信息，这正是Snyk Delta找不到vulnerabilities字段的核心原因。修改后的基础命令如下：

snyk test --json | snyk-delta --baselineOrg 93d6123-a3rf-ub0f-yc93-216ecc08a338 --baselineProject 015b7a6-26rw-4e23-br47-74544067c54744d

2. 添加新漏洞触发失败的参数 #

要实现仅新漏洞出现时构建失败的需求，需在Snyk Delta命令后添加--fail-on-new参数。当检测到新漏洞时，命令会返回非0退出码，直接触发流水线失败：

snyk test --json | snyk-delta --baselineOrg 93d6123-a3rf-ub0f-yc93-216ecc08a338 --baselineProject 015b7a6-26rw-4e23-br47-74544067c54744d --fail-on-new

3. 确保Snyk CLI授权有效 #

单独执行snyk test时可能未继承SnykSecurityScan任务的授权，需在安装工具后添加授权步骤，将SNYK_TOKEN作为流水线秘密变量存储：

- script: |
    snyk auth $(SNYK_TOKEN)
  displayName: 'Authenticate Snyk CLI'

4. 优化流水线任务顺序 #

确保项目依赖先安装完成，再执行Snyk扫描，避免因依赖缺失导致扫描无有效结果：

- script: |
    npm install
  displayName: 'Install Project Dependencies'

- script: |
    npm install -g snyk snyk-delta
  displayName: 'Install Snyk and Snyk-Delta Tools'

- script: |
    snyk auth $(SNYK_TOKEN)
  displayName: 'Authenticate Snyk CLI'

- script: |
    snyk test --json | snyk-delta --baselineOrg 93d6123-a3rf-ub0f-yc93-216ecc08a338 --baselineProject 015b7a6-26rw-4e23-br47-74544067c54744d --fail-on-new
  displayName: 'Snyk Vulnerability Delta Analysis'

内容的提问来源于stack exchange，提问作者Diego Izquierdo Dussan