reference Flags

--strict

Accepted by
opengrep scan, opengrep test
Also spelled
--no-strict
Default
false
See also
--error, --skip-invalid-configs, opengrep validate, --timeout-threshold

By default, a file that cannot be parsed does not fail a scan: the error is reported, the other files are scanned, and the run exits with status 0. The summary reports it, as in 1 files only partially analyzed due to a parsing or internal Opengrep error, and the JSON output lists it in errors.

With --strict, such errors make the run exit with a non-zero status: 3 when a target cannot be parsed.

The flag does not apply to findings; see --error. When both flags are given and there are findings, the exit status is 1. A rule file skipped with --skip-invalid-configs remains a warning, and the run still exits with status 0.

Examples

A file that cannot be parsed

rule.yaml
rules:  - id: find-key    pattern: |      {"a": ...}    message: found key a    languages: [json]    severity: WARNING
good.json
{ "a": 1 }
bad.json
{ this is not json
Command and result
$ opengrep scan --config rule.yaml --json . 2>/dev/null | jq .
{
  "version": "X.Y.Z",
  "results": [
    {
      "check_id": "find-key",
      "path": "good.json",
      "start": {
        "line": 1,
        "col": 1,
        "offset": 0
      },
      "end": {
        "line": 1,
        "col": 11,
        "offset": 10
      },
      "extra": {
        "metavars": {},
        "message": "found key a",
        "metadata": {},
        "severity": "WARNING",
        "fingerprint": "dd28ba81312da62a48a705f3d6eb29b69c8884549abed7e279d380f6c700aeb124f7ff00aa6cd1dfb0bce2e23f75a9757e09498d12d42a17bfeffaf3e3ae280a_0",
        "lines": "{ \"a\": 1 }",
        "is_ignored": false,
        "validation_state": "NO_VALIDATOR",
        "engine_kind": "Opengrep"
      }
    }
  ],
  "errors": [
    {
      "code": 3,
      "level": "warn",
      "type": "Syntax error",
      "message": "Syntax error at line bad.json:1:\n `is` was unexpected",
      "path": "bad.json"
    }
  ],
  "paths": {
    "scanned": [
      "bad.json",
      "good.json"
    ]
  },
  "interfile_languages_used": [],
  "skipped_rules": []
}
$ opengrep scan --config rule.yaml . > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
$ opengrep scan --config rule.yaml --strict . > /dev/null 2>&1; echo "exit status: $?"
exit status: 3