Skip to main content

vulkro scan --diff-only <ref>

Scan only the files that changed since a git ref. On a pull request that touches 6 of 1000 files, the scan reads 6 files.

vulkro scan . --diff-only origin/main
vulkro scan . --diff-only origin/main --gate-vs origin/main

--diff-only is a vulkro scan flag, not a separate command. It filters the input before any rule runs. If no files differ (or git is not available), Vulkro prints a warning and runs a full scan.

With --gate-vs​

FlagWhat it filters
--diff-only <REF>The input: only changed files are scanned. Use it for speed.
--gate-vs <REF>The result: the exit code and table count only findings on changed lines.

Use both for the fastest pull request check that reports only what the change added.

GitHub Actions​

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- run: |
    vulkro scan . \
      --diff-only origin/${{ github.base_ref }} \
      --gate-vs origin/${{ github.base_ref }} \
      --format gh-pr-inline-comments

Exit codes are those of vulkro scan.

See also: vulkro gate, CI/CD integration.

Last updated on