Baselines explained

A baseline records the findings you already have, so later scans can show only what is new. Vulkro has two kinds, and they do not share storage.

vulkro baseline                # write .vulkro-baseline.json
vulkro scan . --ratchet        # CI: fail only on findings not in the baseline

	CLI baseline	Console baseline scan
Purpose	Fail CI only on new findings	Compare later scans against one scan
Where it lives	.vulkro-baseline.json, committed to the repository	A mark on a saved scan in the local console
Create it	vulkro baseline, or Download CI Baseline in the console	Set as Baseline on a saved scan
Use it	vulkro scan --baseline <file> or --ratchet	Compare Scans
Affects exit codes	Yes	No

CI gating with the CLI baseline

1. On a known-good commit (for example main after a release), run vulkro baseline. Use --out <path> for a different file.
2. Commit .vulkro-baseline.json.
3. In CI, run vulkro scan . --ratchet. The scan still prints every finding, but exits 1 only when a finding is missing from the baseline.

Flag	Behaviour
--baseline <file>	Compare against that file.
--ratchet	Find .vulkro-baseline.json at the repository root. Without it, warn and use the normal exit policy.
--ratchet-strict	Like --ratchet, but exit 2 when the file is missing.

When findings grow on purpose (a refactor, a new framework), run vulkro baseline again and review the change in a pull request. A line removed is a regression you will now catch; a line added is a finding the team agreed to accept.

The baseline accepts a set of findings as they are. To hide one finding for good, with a reason, use suppressions instead.

Console baseline scan

In the local console (vulkro serve), open a saved scan and choose Set as Baseline. Compare Scans then starts from that scan and shows added, fixed and unchanged findings. Only one scan per project can be the baseline, and clearing it keeps the scan. Scans from vulkro scan . --save appear in the console too.

To turn a console scan into a CI baseline, open the scan's exports, choose Download CI Baseline, and commit the file at the repository root.

See also: vulkro baseline, CI/CD integration