reference Environment variables

GIT_SSH_COMMAND

Value
a shell command
See also
--config

The ssh command that git uses. A --config of the form git+ssh://… makes Opengrep clone the repository with git, which connects with this command. When the variable is set, Opengrep passes it on unchanged, so it can select a deploy key (ssh -i deploy_key) or set other ssh options.

When the variable is unset, Opengrep sets it to ssh -oBatchMode=yes for the clone. It also always sets GIT_TERMINAL_PROMPT=0. Neither ssh nor git can then prompt for a password, a passphrase or a host key: a clone that cannot authenticate fails immediately instead of waiting for input.

A clone that fails is reported as Could not clone git repo … (ensure it is accessible non-interactively: ssh-agent / credential helper). The variable has no OPENGREP_ form.

Examples

A custom ssh command

The command writes a file and fails; the file shows that git ran it.

app.py
eval(1)
Command and result
$ GIT_SSH_COMMAND="sh -c 'touch $PWD/ssh-ran; exit 1' --" opengrep scan --config git+ssh://git@example.invalid/rules.git app.py > /dev/null 2>&1
$ ls ssh-ran
ssh-ran
$ GIT_SSH_COMMAND="sh -c 'exit 1' --" opengrep scan --config git+ssh://git@example.invalid/rules.git app.py 2>&1 | grep 'Could not clone'
error    Could not clone git repo ssh://git@example.invalid/rules.git (ensure it is accessible non-interactively: ssh-agent / credential helper)