scout_compare
Compare two image references to report CVE delta, highlighting security changes after a rebuild.
Instructions
Compare two image references and report the CVE delta.
Exactly one of to, to_env, or to_latest=True must be supplied to identify the comparison
target. Use it after a rebuild to check the new image against the old (scout_cves scans a
single image).
Does not raise on a non-zero CLI exit (a missing scout plugin still raises) — inspect
raw.stderr. Raises ValueError if to names a local directory/archive while the call has to run
on a remote ssh:// host (no local scout plugin): the file is not staged, so it would resolve
against that host's filesystem instead.
args:
image - The new / candidate image reference
to - Compare against this image reference, directory, or archive (a local directory/archive
only when the CLI runs on this host — see above)
to_env - Compare against an image associated with this Scout environment
to_latest - Compare against the latest scan of image
only_severity - Filter to these severities (omit for all)
ignore_unchanged - Exclude unchanged packages from the diff
format - Output format; only "json" (the default) is parsed into result
platform - Platform of the image to analyze
returns: dict - {"format": , "result": ,
"raw": }
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | ||
| image | Yes | ||
| format | No | json | |
| to_env | No | ||
| platform | No | ||
| to_latest | No | ||
| only_severity | No | ||
| ignore_unchanged | No |