reference Flags

--include

Accepted by
opengrep scan, opengrep ci
Value
PATTERN, repeatable
See also
--exclude, --force-exclude, paths, --scan-unknown-extensions

Scans only the files whose path matches at least one PATTERN. The flag can be repeated; a file that matches any of the patterns is kept.

--include applies last, after --exclude, the git ignore rules and .semgrepignore. It narrows the files that those filters keep and cannot restore a file that they skip.

PATTERN is a glob, in the syntax of --exclude: --include='*.py' keeps the Python files at any depth, and --include=lib keeps the files under a directory named lib. A pattern that contains * must be quoted, or the shell expands it.

Examples

Scanning one directory of a tree

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
lib/other.py
eval(2)
Command and result
$ opengrep scan -q --config rule.yaml --include lib .
lib/other.py

  warn  find-eval
  found eval

     1: eval(2)