`opengrep validate`

See also: opengrep test, opengrep scan, --config, --skip-invalid-configs, --strict, --validate, rules

opengrep validate [FLAGS] PATHS...

Reads the rules under PATHS and reports whether they are valid. PATHS are rule files, or directories that contain them, given as arguments: unlike scan and test, validate has no --config. Without a path, it stops with Nothing to validate, pass a directory or rule file and exit status 2.

Each rule is checked in three ways:

the file must be valid YAML;
each rule must conform to the rule schema. This is the same parsing that a scan performs, so the patterns are parsed as well;
the rule files are scanned with the metachecks: rules that look for mistakes in rules whose syntax is valid. A match of a metacheck is an error.

The metachecks run on rule files, so they apply only to rules from a local file or directory. Rules from the registry, a URL or a git repository are parsed but not checked by the metachecks, and validate logs a warning when no local rule file remains for them to check.

All the output of validate, the result included, goes to standard error. Before the result, it reports the scan of the metachecks: the number of rule files and of metachecks, such as 1 file · 6 rules.

Exit status

Status	Meaning
0	Every rule is valid.
2	A fatal error, such as a missing path.
3	A rule file could not be parsed as a target of the metachecks.
4	A rule does not conform to the schema, or a pattern could not be parsed.
5	A rule file is not valid YAML.
7	No rules could be loaded at all.
8	A rule names an unsupported language.
141	The program that reads the output closed the pipe.

Flags

Flag	Summary
`--debug`	Log the messages of --verbose and the diagnostics of the engine.
`--develop`	Listed in Internal and debugging interfaces.
`--force-color`	Style the output even when it does not go to a terminal.
`--profile`	Listed in Internal and debugging interfaces.
`--quiet`	Print only the findings, and nothing on standard error.
`--skin`	The layout of the text output.
`--verbose`	Log the progress of the run, at the info level.

Examples

A valid rule file

good.yaml

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

Command and result

$ opengrep validate good.yaml 2>&1 >/dev/null
1 file · 6 rules

Configuration is valid - found 0 fatal errors, 0 skippable error(s), and 1 rule(s).
$ opengrep validate good.yaml > /dev/null 2>&1; echo "exit status: $?"
exit status: 0

A rule that does not conform to the schema

bad.yaml

rules:  - id: broken    patterns:      - pattern-not: eval("...")    message: no positive term    languages: [python]    severity: WARNING

Command and result

$ opengrep validate bad.yaml 2>&1 >/dev/null
warning  bad.yaml:3:5: Invalid rule schema in rule broken
           --> bad.yaml:3
         2 |   - id: broken
         3 |     patterns:
           |     ^^^^^^^^
         4 |       - pattern-not: eval("...")
         you need at least one positive term (not just negations or conditions)
1 file · 6 rules

Configuration is invalid - found 0 fatal errors, 1 skippable error(s), and 0 rule(s).
error    Please fix the above errors and try again.
$ opengrep validate bad.yaml > /dev/null 2>&1; echo "exit status: $?"
exit status: 4

opengrep validate

## Exit status

## Flags

## Examples

### A valid rule file