Snyk Collector
Detects Snyk security scanning via GitHub App or CLI integration. Automatically categorizes results (SCA, SAST, Container, IaC) based on scan type and writes to normalized Component JSON paths.
snyk to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/snyk@v1.0.5
What This Integration Collects
This integration includes 3 collectors that gather metadata from your systems.
github-app
Detects Snyk GitHub App scans on pull requests by querying GitHub commit status API. Waits for scan completion and captures results. Categorizes by scan type (Open Source, Code, Container, IaC).
running-in-prs
Proves Snyk is running on PRs by querying Lunar Hub for Snyk data from recent PRs. Used on the default branch to provide compliance proof that PR scanning is happening (since Snyk GitHub App only posts checks on PRs, not directly on the default branch).
cli
Detects Snyk CLI executions in CI pipelines. Captures the command and exit code, then categorizes by subcommand (test, code, container, iac).
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"sca": {
"running_in_prs": true,
"source": {
"tool": "snyk",
"version": "1.1200.0",
"integration": "ci"
},
"vulnerabilities": {
"critical": 1,
"high": 1,
"medium": 1,
"low": 0,
"total": 3
},
"findings": [
{
"severity": "critical",
"package": "minimist",
"version": "1.2.0",
"ecosystem": "npm",
"cve": "CVE-2021-44906",
"snyk_id": "SNYK-JS-MINIMIST-2",
"title": "Prototype Pollution",
"fix_version": "1.2.6",
"fixable": true
}
],
"summary": {
"has_critical": true,
"has_high": true,
"has_medium": true,
"has_low": false,
"all_fixable": false
},
"native": {
"snyk": {
"github_app": {
"state": "success",
"context": "security/snyk",
"target_url": "https://app.snyk.io/..."
},
"cicd": {
"cmds": [
{"cmd": "snyk test --all-projects --json-file-output=snyk-sca.json", "version": "1.1200.0"}
],
"raw": {
"vulnerabilities": ["...full Snyk JSON output..."],
"ok": false
}
}
}
}
}
}Configuration
Configure this collector in your lunar-config.yml.
Inputs
| Input | Required | Default | Description |
|---|---|---|---|
github_app
|
Required | — | GitHub App to mint API tokens from, by its name in `lunar github-app add` (e.g. `lunar-lib`). Unset, the plugin uses the GH_TOKEN secret without calling the Hub; set, the secret is the fallback when the App can't mint a token. |
github_app_only
|
Optional |
false
|
Fail instead of falling back to the GH_TOKEN secret, to check the `github_app` App works before the secret is removed. |
Secrets
This collector requires the following secrets to be configured in Lunar:
| Secret | Description |
|---|---|
GH_TOKEN
|
GitHub token for API access (required for github-app collector) |
Documentation
View on GitHubSnyk Collector
Detects Snyk security scans and collects vulnerability data from GitHub App or CLI integrations.
Overview
This collector detects Snyk security scanning across multiple integration methods (GitHub App, CLI) and automatically categorizes results based on scan type. It writes normalized data to the appropriate Component JSON category depending on which Snyk product was used:
- Snyk Open Source →
.sca(default, orsnyk testcommand) - Snyk Code →
.sast(context contains "code", orsnyk codecommand) - Snyk Container →
.container_scan(context contains "container", orsnyk containercommand) - Snyk IaC →
.iac_scan(context contains "iac" or "infrastructure", orsnyk iaccommand)
Collected Data
This collector writes to the following Component JSON paths based on scan type:
| Path | Type | Description |
|---|---|---|
.sca.source |
object | Source metadata when Snyk Open Source scan detected |
.sca.vulnerabilities |
object | Severity counts (critical/high/medium/low/total) — snyk test only |
.sca.findings |
array | Per-vulnerability detail (severity, package, version, CVE, fix version, fixable) |
.sca.summary |
object | has_critical/has_high/…/all_fixable booleans |
.sca.native.snyk.cicd.raw |
object | Raw snyk test --json output, verbatim |
.sca.native.snyk |
object | Raw Snyk results for SCA scans |
.sca.native.snyk.running_in_prs |
boolean | Proves Snyk is scanning PRs (set on default branch) |
.sast.source |
object | Source metadata when Snyk Code scan detected |
.sast.native.snyk |
object | Raw Snyk results for SAST scans |
.container_scan.source |
object | Source metadata when Snyk Container scan detected |
.container_scan.native.snyk |
object | Raw Snyk results for container scans |
.iac_scan.source |
object | Source metadata when Snyk IaC scan detected |
.iac_scan.native.snyk |
object | Raw Snyk results for IaC scans |
Collectors
This plugin provides the following collectors (use include to select a subset):
| Collector | Hook Type | Description |
|---|---|---|
github-app |
code (PRs only) | Detects Snyk GitHub App scans on pull requests |
running-in-prs |
code (default branch) | Proves Snyk is running on PRs (compliance proof for default branch) |
cli |
ci-after-command | Detects Snyk CLI executions in CI pipelines |
Capturing CLI vulnerability results
The cli collector hooks ci-after-command, which sees the command line and
exit code but not the scanner's stdout. To capture actual findings (the
.sca.vulnerabilities / .findings / .summary fields the SCA policy reads),
run snyk test with --json-file-output:
- run: snyk test --severity-threshold=critical --json-file-output=snyk-sca.json
The collector parses the --json-file-output path out of the traced command,
reads that file, and normalizes it. Without the flag it still records the
command and version, but no findings — there's nothing on disk to read.
Normalization uses jq; install.sh fetches it into $LUNAR_BIN_DIR when
absent. If jq can't be installed the raw JSON is still captured under
.sca.native.snyk.cicd.raw; only the normalized counts are skipped.
Installation
Add to your lunar-config.yml:
collectors:
- uses: github://earthly/lunar-lib/collectors/snyk@v1.0.0
on: ["domain:your-domain"] # Or use tags like [backend, go]
include:
- github-app # Snyk App scans on PRs
- running-in-prs # Proves Snyk runs on PRs
- cli # Snyk CLI runs in CI
Required secrets:
GH_TOKEN— GitHub token for API access (required for github-app collector)
GitHub App
To use a token from a GitHub App instead of GH_TOKEN, add the App with lunar github-app add and set github_app to its name. Grant it read access to Commit statuses (used by github-app); a token request for a permission the App lacks fails, and the collector falls back to the secret. It must be installed on every repository this collector runs on, since a repository outside the installation answers 404 like one that doesn't exist.
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Common Use Cases
Explore guardrails that use data from Snyk Collector.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 300+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements