reference Flags

--subdir

Accepted by
opengrep ci
Value
PATH, relative to the current directory
See also
opengrep ci, --exclude

opengrep ci scans the directory it runs in, which is expected to be the root of the repository. --subdir PATH restricts the scan to PATH, such as one project of a monorepo, while the repository, branch, commit and baseline still come from the whole repository.

PATH must be a directory inside the current directory. Otherwise, opengrep ci reports:

`opengrep ci --subdir` must be given a directory that is actually a subdirectory of the current directory

Since errors are suppressed by default, opengrep ci then exits with status

  1. With --no-suppress-errors, the error fails the job.

Examples

Scanning one directory of a repository

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
sub/other.py
eval(2)
Command and result
$ git init -q && git add . && git commit -qm init
$ opengrep ci -q --config rule.yaml --subdir sub
blocking · 1 finding

sub/other.py

  warn  find-eval
  found eval

     1: eval(2)

blocking rules fired
  find-eval