reference Flags

--config

Accepted by
opengrep scan, opengrep ci, opengrep test
Also spelled
-c, -f
Value
SOURCE, repeatable
Environment
OPENGREP_RULES
See also
--pattern, --skip-invalid-configs, --rewrite-rule-ids, opengrep test, opengrep scan, opengrep validate, --exclude-rule, --severity, --validate, rules, GIT_SSH_COMMAND, OPENGREP_URL

Each --config names one source of rules. The flag can be repeated; the rules of all the sources run together.

SOURCERules loaded
path/rules.yamlThe rules in the file.
path/dir/Every .yaml and .yml file under the directory, at any depth, in path order. Test targets such as x.test.yaml are skipped.
https://…The rule file at the URL.
git+URL, git+URL#REFEvery rule file in the git repository, cloned at its default branch or at the branch or tag REF. Git uses its own credentials (ssh agent, credential helpers) and never prompts.
p/NAME, r/NAME, s/NAME, auto, r2cRules from the Semgrep registry, at OPENGREP_URL (default https://semgrep.dev). auto sends the project URL to the registry, which selects the rules.

An invalid rule file stops the scan with exit status 7. When the file comes from a directory or a git repository, --skip-invalid-configs skips it with a warning instead.

Rule ids

When the rules come from a file in a subdirectory, each rule id is prefixed with the path of the directory, with dots in place of the slashes. For example, with --config rules/ or --config rules/python/eval.yaml, the rule find-eval in rules/python/eval.yaml is reported as rules.python.find-eval. --no-rewrite-rule-ids keeps the ids as written.

Without --config

When no --config is given, scan, ci and test read the sources from OPENGREP_RULES. If that variable is not set either, scan runs the pattern given with -e/--pattern; without a pattern, it uses --config auto.

For opengrep test, --config also changes what is tested: the given rules run on the given targets, instead of each rule file being tested against the files named after it.

Examples

Two rule files

eval.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
exec.yaml
rules:  - id: find-exec    pattern: exec(...)    message: found exec    languages: [python]    severity: WARNING
app.py
eval(code)exec(code)
Command and result
$ opengrep scan -q --config eval.yaml --config exec.yaml app.py
app.py

  warn  find-eval
  found eval

     1: eval(code)

  warn  find-exec
  found exec

     2: exec(code)

A directory of rules

rules/python/eval.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(code)
Command and result
$ opengrep scan -q --config rules/ app.py
app.py

  warn  rules.python.find-eval
  found eval

     1: eval(code)
$ opengrep scan -q --config rules/ --no-rewrite-rule-ids app.py
app.py

  warn  find-eval
  found eval

     1: eval(code)