reference Environment variables

OPENGREP_RULES

Also spelled
SEMGREP_RULES
Value
whitespace-separated list of rule sources
Equivalent to
--config

The rule sources of opengrep scan, opengrep ci and opengrep test, used when no --config is given. The value is split at spaces, tabs and newlines, and each word is a source, as for --config. The value has no quoting, so it cannot name a path that contains a space.

A --config on the command line replaces the whole variable, with a warning.

Examples

Rules from the environment

eval.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
exec.yaml
rules:  - id: find-exec    pattern: exec(...)    message: found exec    languages: [python]    severity: WARNING
app.py
eval(code)exec(code)
Command and result
$ OPENGREP_RULES="eval.yaml exec.yaml" opengrep scan app.py
app.py

  warn  find-eval
  found eval

     1: eval(code)

  warn  find-exec
  found exec

     2: exec(code)

$ OPENGREP_RULES="eval.yaml exec.yaml" opengrep scan --config eval.yaml app.py 2>&1 | grep WARNING
[00.05][WARNING]: -c/-f/--config is given; ignoring $OPENGREP_RULES