reference > Flags

--project-root

Accepted by

opengrep scan

Value

PATH

See also

--semgrepignore-filename, --use-git-ignore

By default, Opengrep determines the project root itself: the git repository that contains the scanning root, or, without version control, the scanned directory. The project root is where Opengrep reads .gitignore and .semgrepignore.

When a scan covers a subdirectory of a project whose ignore file is higher up, that file is not read, and the paths it lists are scanned. --project-root PATH sets the root explicitly, and treats the project as one without version control.

## Examples

### Scanning a subdirectory of a project

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(1)

eval(2)

skipme/

$ opengrep scan -q --config proj/rule.yaml --files-with-matches proj/skipme
proj/skipme/s.py
$ opengrep scan -q --config proj/rule.yaml --files-with-matches --project-root proj proj/skipme

The first command scans a directory that proj/.semgrepignore lists, because the scanning root is proj/skipme and the ignore file above it is never read. The second prints nothing: with the project root named, the file applies.