reference > Flags

--suppress-errors

Accepted by

opengrep ci

Also spelled

--no-suppress-errors

Default

true

Environment

OPENGREP_SUPPRESS_ERRORS

See also

opengrep ci, --audit-on

On by default. Any exit status of opengrep ci other than 0 and 1 becomes 0, so an error during the run does not fail the build. The findings produced before the error are still reported, and standard error gives the reason:

There were errors during analysis but the scan will succeed because there
were no blocking findings, use --no-suppress-errors if you want it to fail
when there are errors.

--no-suppress-errors keeps the original exit status, the one that opengrep scan would return: 7 for a rule file that cannot be loaded, 2 for a fatal error, and so on. Blocking findings are not errors, so exit status 1 is not affected. OPENGREP_SUPPRESS_ERRORS sets the same value.

## Examples

### A rule file that cannot be loaded

rules:  - id: broken    patterns:      - pattern-not: eval("...")    message: a rule that cannot work    languages: [python]    severity: WARNING

eval(1)

$ git init -q && git add . && git commit -qm init
$ opengrep ci --config broken.yaml > /dev/null 2>&1; echo "exit status: $?"
exit status: 0
$ opengrep ci --config broken.yaml --no-suppress-errors > /dev/null 2>&1; echo "exit status: $?"
exit status: 7
$ opengrep scan --config broken.yaml . > /dev/null 2>&1; echo "exit status: $?"
exit status: 7