reference > Flags

--exclude

Accepted by

opengrep scan, opengrep ci

Value

PATTERN, repeatable

See also

--include, --force-exclude, --semgrepignore-filename, paths, --exclude-minified-files, --exclude-rule, --max-target-bytes, --subdir, --use-git-ignore

Skips the files and directories whose path matches PATTERN. PATTERN uses the gitignore syntax:

• A pattern without a slash, or with only a trailing slash, matches at any depth. --exclude=tests skips tests/foo.py and a/b/tests/c/foo.py, and --exclude='*.py' skips every Python file.
• A slash anywhere else anchors the pattern at the project root. --exclude=/tests and --exclude=tests/foo.py skip tests/foo.py but not a/b/tests/c/foo.py.
• **/ at the start matches at any depth.

Patterns that contain * must be quoted, or the shell expands them. The flag can be repeated; a path that matches any of the patterns is skipped.

--exclude adds to the other filters on the files found under directory targets: .gitignore, .semgrepignore, and the default ignore list (see opengrep scan). --include then keeps only the files matching one of its patterns. A rule's own paths narrow the files further for that rule.

Files named on the command line are scanned even when they match. With --force-exclude, the patterns that match the file name, such as *.py or gen.py, apply to them too.

## Examples

### Skip a directory

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(code)

eval(code)

$ opengrep scan -q --config rule.yaml --exclude generated .
app.py

  warn  find-eval
  found eval

     1: eval(code)

### Files named on the command line

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(code)

$ opengrep scan -q --config rule.yaml --exclude generated generated/gen.py
generated/gen.py

  warn  find-eval
  found eval

     1: eval(code)
$ opengrep scan -q --config rule.yaml --exclude 'gen.py' --force-exclude generated/gen.py

The second command prints nothing: --force-exclude applies the pattern to the file named on the command line, so nothing is scanned and there are no findings.