reference Flags

--force-exclude

Accepted by
opengrep scan, opengrep ci
See also
--exclude, --include, --scan-unknown-extensions

--exclude and --include filter the files found under directory targets. A file named on the command line is scanned regardless of these patterns. With --force-exclude, the patterns that match a file name, such as *.py or gen.py, apply to such files as well, for example in a pre-commit hook or a script that passes a list of changed files.

Examples

Excluding a file that was named explicitly

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan -q --config rule.yaml --exclude '*.py' app.py
app.py

  warn  find-eval
  found eval

     1: eval(1)
$ opengrep scan -q --config rule.yaml --exclude '*.py' --force-exclude app.py

The second command prints nothing: the pattern now applies to the named file, so there is nothing left to scan.