vulkro baseline
Run a scan and write a baseline JSON file (default .vulkro-baseline.json)
that scan --baseline and scan --ratchet can compare against. The
baseline is an array of finding records; it captures the current state so
future scans can gate on new findings only.
Usage
vulkro baseline [PATH] -o .vulkro-baseline.json
| Argument | Description | Default |
|---|---|---|
PATH | Path to the project root. | . |
Flags
| Flag | Description |
|---|---|
--out, -o <PATH> | Output file. Defaults to .vulkro-baseline.json in the repo root. |
--no-cache | Bypass the per-file extraction cache (same as scan --no-cache). |
Examples
# Write the baseline once, then commit it.
vulkro baseline . -o .vulkro-baseline.json
git add .vulkro-baseline.json
# Later scans exit 1 only on findings new vs the baseline.
vulkro scan . --ratchet
Related
vulkro scan --ratchet- gate on new findings vs the baseline.vulkro gate- two-tree gate against a git ref (no baseline file).- Baselines explained - when to use each.