reference Flags

--audit-on

Accepted by
opengrep ci
Value
EVENT, repeatable
Environment
OPENGREP_AUDIT_ON
See also
opengrep ci, --suppress-errors

opengrep ci exits with status 1 when the scan reports a blocking finding. With --audit-on EVENT, it still reports the findings, but exits with status 0 when the event that triggered the run is named EVENT.

The event name is the one that opengrep ci prints at the end of the first line on standard error, such as push or pull_request on GitHub Actions. Outside a CI provider, it is unknown. The flag can be repeated to name several events; OPENGREP_AUDIT_ON sets a whitespace-separated list.

Examples

Findings without a failing job

Outside a CI provider, the event is unknown, so the example uses --audit-on unknown.

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ git init -q && git add . && git commit -qm init
$ opengrep ci --config rule.yaml --audit-on unknown 2>&1 >/dev/null | tail -3
CI scan completed successfully.
  Found 1 finding (1 blocking) from 1 rule.
  Audit mode is on for unknown, so exiting with code 0 even if matches found
$ opengrep ci --config rule.yaml --audit-on unknown > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
$ opengrep ci --config rule.yaml > /dev/null 2>&1; echo "exit status: $?"
exit status: 1