reference Flags

--skip-invalid-configs

Accepted by
opengrep scan
See also
--config, opengrep validate, --strict

A directory of rules can contain YAML files that are not rule files, such as a CI workflow. By default, loading such a directory stops the scan with exit status 7, since one of its files is not a valid rule file.

With this flag, Opengrep logs a warning for each such file and scans with the rules it could load. The flag applies to rules loaded from a directory or from a git+<url> repository. A rule file named directly in --config must still be valid.

opengrep validate lists the invalid files of a directory.

Examples

A workflow file among the rules

rules/good.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
rules/workflow.yml
name: CIon: push
app.py
eval(1)
Command and result
$ opengrep scan --config rules/ app.py > /dev/null 2>&1; echo "exit status: $?"
exit status: 7
$ opengrep validate rules/ 2>&1 >/dev/null
warning  rules/workflow.yml:2:1: Invalid YAML
           --> rules/workflow.yml:2
         1 | name: CI
         2 | on: push
           | ^
         Not a valid key value pair
1 file · 6 rules

Configuration is invalid - found 1 fatal errors, 0 skippable error(s), and 1 rule(s).
error    Please fix the above errors and try again.
$ opengrep scan -q --config rules/ --skip-invalid-configs app.py
app.py

  warn  rules.find-eval
  found eval

     1: eval(1)