reference > Environment variables

OPENGREP_AUDIT_ON

Also spelled

SEMGREP_AUDIT_ON

Value

whitespace-separated event names

Equivalent to

--audit-on

See also

OPENGREP_PR_ID

The event names for --audit-on, used when the flag is not given. When the event that triggered the run is one of them, opengrep ci reports its blocking findings and exits with status 0.

The value is split at whitespace: "push schedule" names two events. An --audit-on on the command line replaces the whole list, with a warning.

## Examples

### Audit mode set in the environment

Outside a CI provider, the event is unknown.

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(1)

$ git init -q && git add . && git commit -qm init
$ opengrep ci --config rule.yaml > /dev/null 2>&1; echo "exit status: $?"
exit status: 1
$ OPENGREP_AUDIT_ON="push unknown" opengrep ci --config rule.yaml > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
$ OPENGREP_AUDIT_ON=unknown opengrep ci --config rule.yaml --audit-on push 2>&1 >/dev/null | grep ignoring
[00.04][WARNING]: --audit-on is given; ignoring $OPENGREP_AUDIT_ON