Snyk Question For Anyone Using It In Their Pipeline

This is for anyone that has or is used Snyk in their pipeline and github.

My release automation team has a script that was created that when a dev wants to create a new repo this script will go into github and created Repo with a Master / Release and Development branch.

Also as part of the script it goes in and sets the branch protections and imports the default branch into Snyk.

What we're seeing is when a developer now creates a feature branch and goes to merg that PR into the Development branch the Snyk Scans just sit and hang waiting for Snyk to reply.

From talking with Snyk they say it's because the Development branch is empty so the PR can't do that delta check against an empty branch to compare if for example the pom.xml on feature branch 123 is introducing net new high or critical vulnerabilities that we would be failing the scan on.

Snyk's recommendation was to just at the time the repo is created and have an empty pom.xml file just thrown into the Development branch for it to do that comparison against. Our RA team is completely against doing this and that Snyk should just be able to notice that basically anything from that feature branch is net new and act accordingly.

I'm curious are there any of you out there that has had similar things with new repos and Snyk?