id       = "snyk-cli"
name     = "Snyk CLI"
homepage = "https://docs.snyk.io/developer-tools/snyk-cli"
description = "A command-line interface for finding and fixing vulnerabilities in code and dependencies."
executables   = ["snyk"]

[dotfiles]

# Snyk's official config command documentation specifies the JSON file below
# and lists the supported API/registry credential keys.
# https://docs.snyk.io/developer-tools/snyk-cli/commands/config
paths = ["[configHome]/configstore/snyk.json"]
secret = []

[[dotfiles.secret_paths]]
file = "[configHome]/configstore/snyk.json"
format = "json"
match = { key_path = ["api", "oci-registry-password"] }

[commands]
format = 1
label = "Snyk CLI"
description = "Test the current project for open-source vulnerabilities and license issues with snyk test. Other scan types (code, container, iac), monitor and ecosystem-specific options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]
path = ["test"]
label = "Test for vulnerabilities"
description = "Check the project in the working directory for open-source vulnerabilities and license issues."

[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/snyk/cli/blob/main/help/cli-commands/test.md"
evidence = """`snyk test [<OPTIONS>]`
### `--all-projects`
Auto-detect all projects in the working directory, including Yarn workspaces.
### `--detection-depth=<DEPTH>`
### `--exclude=<NAME>[,<NAME>]...>`
### `--dev`
### `--org=<ORG_ID>`
### `--file=<FILE>`
### `--json`
### `--severity-threshold=<low|medium|high|critical>`
### `--fail-on=<all|upgradable|patchable>`
### `--json-file-output=<OUTPUT_FILE_PATH>`"""

[[commands.subcommand.field]]
id = "all_projects"
label = "All projects"
description = "Auto-detect all projects in the working directory, including Yarn workspaces."
type = "boolean"
option = ["--all-projects"]
sources = ["help"]

[[commands.subcommand.field]]
id = "dev"
label = "Include dev dependencies"
type = "boolean"
option = ["--dev"]
sources = ["help"]

[[commands.subcommand.field]]
id = "org"
label = "Organization ID"
type = "string"
option = ["--org"]
sources = ["help"]

[[commands.subcommand.field]]
id = "file"
label = "Manifest file"
type = "path"
option = ["--file"]
path = { kind = "file", role = "input" }
sources = ["help"]

[[commands.subcommand.field]]
id = "detection_depth"
label = "Detection depth"
type = "integer"
option = ["--detection-depth"]
sources = ["help"]

[[commands.subcommand.field]]
id = "exclude"
label = "Exclude names"
description = "Comma-separated directory or file names to skip."
type = "string"
option = ["--exclude"]
sources = ["help"]

[[commands.subcommand.field]]
id = "severity_threshold"
label = "Severity threshold"
type = "enum"
option = ["--severity-threshold"]
choices = [{ value = "low", label = "Low" }, { value = "medium", label = "Medium" }, { value = "high", label = "High" }, { value = "critical", label = "Critical" }]
sources = ["help"]

[[commands.subcommand.field]]
id = "fail_on"
label = "Fail on"
type = "enum"
option = ["--fail-on"]
choices = [{ value = "all", label = "All" }, { value = "upgradable", label = "Upgradable" }, { value = "patchable", label = "Patchable" }]
sources = ["help"]

[[commands.subcommand.field]]
id = "json"
label = "JSON output"
type = "boolean"
option = ["--json"]
sources = ["help"]

[[commands.subcommand.field]]
id = "json_file_output"
label = "Save JSON to file"
type = "path"
option = ["--json-file-output"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]

[[commands.subcommand.task]]
id = "test"
label = "Test this project"
fields = ["dev", "severity_threshold", "org"]

[[commands.subcommand.task]]
id = "monorepo"
label = "Test a monorepo"
set = { all_projects = [true] }
lock = ["all_projects"]
fields = ["all_projects", "detection_depth", "exclude", "severity_threshold"]

[[commands.subcommand.task]]
id = "report"
label = "Write JSON report"
fields = ["json_file_output", "severity_threshold", "all_projects"]
required = ["json_file_output"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["all_projects", "dev", "severity_threshold", "org", "file"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["detection_depth", "exclude", "fail_on", "json", "json_file_output"]