reference

Environment variables

OPENGREP_ and SEMGREP_ names

For compatibility, most variables whose names start with OPENGREP_ can also be set with the prefix SEMGREP_: SEMGREP_TIMEOUT is read as OPENGREP_TIMEOUT. When both are set, the OPENGREP_ variable takes precedence. Some variables, such as OPENGREP_SKIN, are read only under their OPENGREP_ name, and variables such as NO_COLOR have neither prefix.

A variable set to the empty string is treated as unset.

Variables and flags

Some variables set the same value as a command-line flag. When both are given, the flag takes precedence, and Opengrep logs a warning:

[00.04][WARNING]: --timeout is given; ignoring $OPENGREP_TIMEOUT

An invalid value of a variable is reported in the same way as an invalid flag value, and Opengrep exits with status 2.

Index

VariableEquivalent flagSummary
ALL_PROXYThe proxy for downloads over http and https.
CISet by CI services; turns off the status line of a scan.
COLUMNSThe width of the text output, between 40 and 120 characters.
GIT_SSH_COMMANDThe ssh command that git uses to clone a git+ssh rule repository.
HOMEThe home directory, where the language server keeps its cache.
HTTP_PROXYThe proxy for downloads over http.
HTTPS_PROXYThe proxy for downloads over https, such as rules from a URL or the registry.
NO_COLORTurns off color and other styling in all output.
NO_PROXYThe hosts that downloads reach without a proxy.
OPENGREP_APP_URLAn alternative name for OPENGREP_URL.
OPENGREP_AUDIT_ON--audit-onThe event names of --audit-on, when the flag is not given.
OPENGREP_BASELINE_COMMIT--baseline-commitThe baseline of scan and ci, when --baseline-commit is not given.
OPENGREP_BASELINE_REF--baseline-commitAn alternative name for OPENGREP_BASELINE_COMMIT.
OPENGREP_FORCE_COLOR--force-colorWhether to style output that does not go to a terminal, when --force-color is not given.
OPENGREP_LOG_FILEA file that receives a copy of the logs.
OPENGREP_LOG_LEVELThe level of the logs, taking precedence over --quiet, --verbose and --debug.
OPENGREP_LOG_SRCSThe log sources whose messages are shown in addition to those of Opengrep.
OPENGREP_LOG_TAGSThe tags of the debug messages that are shown.
OPENGREP_PR_IDThe pull request of an opengrep ci run; sets the event of the run to pull_request.
OPENGREP_REPO_NAMEOn GitHub Actions, the repository for which opengrep ci requests the merge base of a pull request.
OPENGREP_RULES--configThe rule sources, when --config is not given.
OPENGREP_SKIN--skinThe layout of the text output, when --skin is not given.
OPENGREP_SUPPRESS_ERRORS--suppress-errorsWhether opengrep ci suppresses errors, when --suppress-errors is not given.
OPENGREP_TIMEOUT--timeoutThe value of --timeout, when the flag is not given.
OPENGREP_URLThe base URL of the rule registry.
TERMThe terminal type; the values dumb and unknown, or no value, turn off the status line.

Examples

An empty value is treated as unset

OPENGREP_RULES is empty, so Opengrep takes the rules from --config and logs no warning about the variable.

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ OPENGREP_RULES="" opengrep scan --config rule.yaml app.py 2>&1 | grep -c WARNING
0