stella drift (Reachability) - Command Guide

Audience: engineers and security reviewers who gate releases on changes in how vulnerable code can be reached between builds.

Overview

The stella drift commands detect and analyze reachability drift between scan results. Reachability drift occurs when the call paths to vulnerable code change between builds, potentially altering an application’s risk profile even when its dependency list is unchanged.

Two kinds of drift. This guide covers reachability drift (drift compare, drift show). For facet drift — file-level changes within categorized image layers against a sealed baseline — see stella drift (Facet Analysis).

Commands

stella drift

Parent command for reachability drift operations.

stella drift <SUBCOMMAND> [OPTIONS]

stella drift compare

Compare reachability between two scans or graph snapshots.

stella drift compare [OPTIONS]

Required Options

OptionAliasDescription
--base <ID>-bBase scan/graph ID or commit SHA for comparison

Optional Options

OptionAliasDescriptionDefault
--head <ID>-hHead scan/graph ID or commit SHAlatest
--image <REF>-iContainer image reference (digest or tag)-
--repo <REPO>-rRepository reference (owner/repo)-
--output <FMT>-oOutput format: table, json, sariftable
--min-severity <SEV>Minimum severity: critical, high, medium, low, infomedium
--only-increasesOnly show sinks with increased reachabilityfalse
--verboseEnable verbose outputfalse

Examples

Compare by scan IDs
stella drift compare --base abc123 --head def456
Compare by commit SHAs
stella drift compare --base HEAD~1 --head HEAD --repo myorg/myapp
Filter to risk increases only
stella drift compare --base abc123 --only-increases --min-severity high
Output as JSON
stella drift compare --base abc123 --output json > drift.json
Output as SARIF for CI integration
stella drift compare --base abc123 --output sarif > drift.sarif

stella drift show

Display details of a previously computed drift result.

stella drift show [OPTIONS]

Required Options

OptionDescription
--id <ID>Drift result ID to display

Optional Options

OptionAliasDescriptionDefault
--output <FMT>-oOutput format: table, json, sariftable
--expand-pathsShow full call paths instead of compressed viewfalse
--verboseEnable verbose outputfalse

Examples

Show drift result
stella drift show --id drift-abc123
Show with expanded paths
stella drift show --id drift-abc123 --expand-paths

Output Formats

Table Format (Default)

Human-readable table output using Spectre.Console:

┌─────────────────────────────────────────────────────────────┐
│ Reachability Drift (abc123)                                 │
├───────────────────────────────┬─────────────────────────────┤
│ Metric                        │ Value                       │
├───────────────────────────────┼─────────────────────────────┤
│ Trend                         │ ↑ Increasing                │
│ Net Risk Delta                │ +3                          │
│ Increased                     │ 4                           │
│ Decreased                     │ 1                           │
│ New Sinks                     │ 2                           │
│ Removed Sinks                 │ 0                           │
└───────────────────────────────┴─────────────────────────────┘

┌──────────────┬──────────────────────┬───────────────┬─────────────────────────┬───────┐
│ Severity     │ Sink                 │ CVE           │ Bucket Change           │ Delta │
├──────────────┼──────────────────────┼───────────────┼─────────────────────────┼───────┤
│ CRITICAL     │ SqlConnection.Open   │ CVE-2024-1234 │ Runtime → Entrypoint    │ +2    │
│ HIGH         │ XmlParser.Parse      │ CVE-2024-5678 │ Unknown → Direct        │ +1    │
└──────────────┴──────────────────────┴───────────────┴─────────────────────────┴───────┘

JSON Format

Structured JSON for programmatic processing:

{
  "id": "abc123",
  "comparedAt": "2025-12-18T10:30:00Z",
  "baseGraphId": "base-graph-id",
  "headGraphId": "head-graph-id",
  "summary": {
    "totalSinks": 42,
    "increasedReachability": 4,
    "decreasedReachability": 1,
    "unchangedReachability": 35,
    "newSinks": 2,
    "removedSinks": 0,
    "riskTrend": "increasing",
    "netRiskDelta": 3
  },
  "driftedSinks": [
    {
      "sinkSymbol": "SqlConnection.Open",
      "cveId": "CVE-2024-1234",
      "severity": "critical",
      "previousBucket": "runtime",
      "currentBucket": "entrypoint",
      "isRiskIncrease": true,
      "riskDelta": 2
    }
  ]
}

SARIF Format

SARIF 2.1.0 output for CI/CD integration:

{
  "version": "2.1.0",
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "StellaOps Drift",
          "version": "1.0.0",
          "informationUri": "https://stellaops.io/docs/drift"
        }
      },
      "results": [
        {
          "ruleId": "CVE-2024-1234",
          "level": "error",
          "message": {
            "text": "Reachability changed: runtime → entrypoint"
          }
        }
      ]
    }
  ]
}

Exit Codes

CodeDescription
0Success (no risk increases or within threshold)
1Error during execution
2Risk increases detected
3Critical risk increases detected

CI/CD Integration

GitHub Actions

- name: Check Reachability Drift
  run: |
    stella drift compare \
      --base ${{ github.event.pull_request.base.sha }} \
      --head ${{ github.sha }} \
      --repo ${{ github.repository }} \
      --output sarif > drift.sarif
  continue-on-error: true

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: drift.sarif

GitLab CI

drift-check:
  script:
    - stella drift compare --base $CI_MERGE_REQUEST_DIFF_BASE_SHA --head $CI_COMMIT_SHA --output sarif > drift.sarif
  artifacts:
    reports:
      sast: drift.sarif