fix: load snyk.json only from configstore path

[octavian-snyk]

Description

Noted that if a snyk.json file is present in the working directory and absent from the user’s ~/.config/configstore/ , snyk will use the file from the working directory to authenticate requests.

This PR ensures we have a single source of truth for the snyk.json.

Relevant ticket: CLI-1124
CLI PR: snyk/cli#7008

Checklist

• Tests added and all succeed (make test)
• Regenerated mocks, etc. (make generate)
• Linted (make lint)
• Test your changes work for the CLI
  1. Clone / pull the latest CLI main.
  2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
     • Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
  3. Run go mod tidy in the cliv2 directory.
  4. Run the CLI tests and do any required manual testing.
  5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
  • Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

---

Note

Medium Risk
Changes where authentication and endpoint settings are sourced from disk; correct for security but may surprise users who relied on a project-local snyk.json.

Overview
Stops the CLI from treating a snyk.json in the current working directory as configuration when loading defaults. readConfigFilesIntoViper no longer adds "." as a Viper config path, so file-based settings (including api, org, endpoint) come only from ~/.config/configstore via determineBasePath().

This closes the case where a repo-local snyk.json could supply credentials when nothing was in the user configstore. New tests cover cwd-only (values stay empty) and configstore + cwd (home configstore wins).

^{Reviewed by Cursor Bugbot for commit 5d9e0f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 8 relevant code sections from 5 files (average relevance: 0.91) pkg/configuration/storage.go (lines 1-165) pkg/apiclients/ldx_sync_config/resolver.go (lines 1-205) pkg/app/app.go (2 segments, lines 197-379) pkg/envvars/environment.go (lines 1-146) pkg/configuration/configuration.go (3 segments, lines 1-269)

🤖 Repository instructions applied (from AGENTS.md)

[octavian-snyk]

I also added a regression test.

[danskmt]

what other implications this removal can have?

[octavian-snyk]

I am not noticing any other files besides snyk referenced for the config (

go-application-framework/pkg/configuration/configuration.go

Line 213 in d1936e1

WithFiles("snyk"),

)

Also, because of

go-application-framework/pkg/configuration/configuration.go

Line 275 in d1936e1

config.viper.SetConfigName(file)

this function always seems to load only the last file from the array. I believe we could also remove the for loop.

[danskmt]

does this affect .snyk files? Should the behavior consider the current directory, same behavior as happens for .gitignore?

[danskmt]

also need to think:

1. What if there are customers using the current approach? This will be a breaking change for them.

I also think should contain more tests, i.e. not only look for snyk.json, but for others (.snyk, .gitignore, ...)

[danskmt]

I see the ticket is a bit old, so I wonder if the understanding there remains the same

[octavian-snyk]

.snyk and .gitignore shouldn't be affected. 😀

The config is managed by Viper while .snyk and .gitignore seem to be loaded here:

go-application-framework/pkg/utils/file_filter.go

Line 158 in d1936e1

if filepath.Base(ignoreFile) == ".snyk" { // .snyk files are yaml files and should be parsed differently

Tests regarding their loading seems to be performed here: https://github.com/snyk/go-application-framework/blob/main/pkg/utils/file_filter_test.go

I am not sure if we should consider this a breaking change or simply a fix. 😔
TS CLI commands (e.g.: test, container, iac) never loaded the local directory snyk.json config file. The behavior of snyk commands regarding it is currently inconsistent.