reference > Environment variables

OPENGREP_PR_ID

Also spelled

SEMGREP_PR_ID

Value

a pull or merge request id

See also

opengrep ci, OPENGREP_AUDIT_ON

The id of the pull or merge request that an opengrep ci run belongs to. It also sets the event name of the run: pull_request when the variable is set, unknown otherwise.

This applies when no CI provider is detected, and on Azure Pipelines, Bitbucket, Buildkite, CircleCI, Jenkins and Travis, where the variable is read before the provider's own pull-request variable. GitHub Actions and GitLab CI take the event from their own variables, GITHUB_EVENT_NAME and CI_PIPELINE_SOURCE, and the variable does not change it.

The event name is what --audit-on is matched against. The id itself does not appear in the output.

## Examples

### A run treated as a pull request

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(1)

$ git init -q && git add . && git commit -qm init
$ OPENGREP_PR_ID=17 opengrep ci --config rule.yaml 2>&1 >/dev/null | awk -F ' · ' 'NR == 1 { print $2 " · " $3 }'
git · pull_request
$ opengrep ci --config rule.yaml --audit-on pull_request > /dev/null 2>&1; echo "exit status: $?"
exit status: 1
$ OPENGREP_PR_ID=17 opengrep ci --config rule.yaml --audit-on pull_request > /dev/null 2>&1; echo "exit status: $?"
exit status: 0

### Providers that read it, and one that does not

The CI provider is detected from its own variables, which the example sets.

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(1)

$ git init -q && git add . && git commit -qm init
$ CIRCLECI=true OPENGREP_PR_ID=17 opengrep ci --config rule.yaml 2>&1 >/dev/null | awk -F ' · ' 'NR == 1 { print $2 " · " $3 }'
circleci · pull_request
$ GITLAB_CI=true CI_PIPELINE_SOURCE=push OPENGREP_PR_ID=17 opengrep ci --config rule.yaml 2>&1 >/dev/null | awk -F ' · ' 'NR == 1 { print $2 " · " $3 }'
gitlab-ci · push