reference Flags

--error

Accepted by
opengrep scan
Also spelled
--no-error
Default
false
See also
--severity, opengrep ci, --strict

By default, a scan that completes exits with status 0, whether or not it reports findings. With --error, a scan that reports a finding exits with status 1.

opengrep ci exits with status 1 on blocking findings without the flag. To fail on some findings only, restrict the scan with --severity or --exclude-rule.

The flag applies to findings only, not to errors during the scan, such as a file that cannot be parsed; see --strict. Findings suppressed by a nosemgrep comment do not count, including those that --sarif-output records in its file.

Examples

Failing on a finding

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan --config rule.yaml app.py > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
$ opengrep scan --config rule.yaml --error app.py > /dev/null 2>&1; echo "exit status: $?"
exit status: 1

A suppressed finding

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
quiet.py
eval(1)  # nosemgrep
Command and result
$ opengrep scan --config rule.yaml --error --sarif-output findings.sarif quiet.py > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
$ jq . findings.sarif
{
  "version": "2.1.0",
  "runs": [
    {
      "invocations": [
        {
          "executionSuccessful": true,
          "toolExecutionNotifications": []
        }
      ],
      "results": [
        {
          "fingerprints": {
            "matchBasedId/v1": "3ac126e0ba6a8506917fc31d10d52dea19c7f0f2f2db7491b641a88226e282df010772ba42b9349cd5fd080302c9a51ea357ac8786faf9b66044b83e75f6aaf3_0"
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "quiet.py",
                  "uriBaseId": "%SRCROOT%"
                },
                "region": {
                  "endColumn": 8,
                  "endLine": 1,
                  "snippet": {
                    "text": "eval(1)  # nosemgrep"
                  },
                  "startColumn": 1,
                  "startLine": 1
                }
              }
            }
          ],
          "message": {
            "text": "found eval"
          },
          "properties": {},
          "ruleId": "find-eval",
          "suppressions": [
            {
              "kind": "inSource"
            }
          ]
        }
      ],
      "tool": {
        "driver": {
          "name": "Opengrep",
          "rules": [
            {
              "defaultConfiguration": {
                "level": "warning"
              },
              "fullDescription": {
                "text": "found eval"
              },
              "help": {
                "markdown": "found eval",
                "text": "found eval"
              },
              "id": "find-eval",
              "name": "find-eval",
              "properties": {
                "precision": "very-high",
                "tags": []
              },
              "shortDescription": {
                "text": "Opengrep Finding: find-eval"
              }
            }
          ],
          "semanticVersion": "X.Y.Z"
        }
      }
    }
  ],
  "$schema": "https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/schemas/sarif-schema-2.1.0.json"
}

The SARIF file reports the suppressed finding, but the scan still exits with status 0.