Documentation Index
Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
Use this file to discover all available pages before exploring further.
YOUR DEPLOYMENT JOURNEY
- You have gained the necessary resource access and permissions required for deployment.
- You have created a Semgrep account and organization.
- For GitHub and GitLab users: You have connected your source code manager.
- Optionally, you have set up SSO.
- You have successfully added a Semgrep job to your CI workflow.
- Run Semgrep on a schedule. Run full scans on main or trunk branches at the least intrusive time on developer teams.
- Run Semgrep when an event triggers. Run Semgrep when a pull request or merge request (PR or MR) is created.
- Set a timeout to increase or decrease Semgrep’s overall runtime. If scans are taking too long, or rules aren’t running, customize your per-rule timeout.
Set up diff-aware scans
INFOFollow the steps in this section only for the following CI providers:
- Jenkins
- CI providers without guidance from Semgrep AppSec Platform
- Create a separate CI job following the steps in Add Semgrep to CI through Semgrep AppSec Platform.
- Set the
SEMGREP_BASELINE_REFvariable in your CI configuration file. The value of this environment variable is typically your trunk branch, such asmainormaster.
Set a scan schedule
The following table is a summary of methods and resources to set up schedules for different CI providers.| CI provider | Where to set schedule |
|---|---|
| GitHub Actions | See Sample CI configs for information on how to modify your semgrep.yml file |
| GitLab CI/CD | Refer to GitLab documentation |
| Jenkins | Refer to Jenkins documentation |
| Bitbucket Pipelines | Refer to Bitbucket documentation |
| CircleCI | Refer to CircleCI documentation |
| Buildkite | Refer to Buildkite documentation |
| Azure Pipelines | Refer to Azure documentation |
| Semaphore | Refer to Semaphore documentation |
Set a custom timeout
By default, Semgrep spends a maximum of 5 seconds to scan with each rule on each %%targeted|scan_target%% file. To set a different timeout, set theSEMGREP_TIMEOUT environment variable (the value is in seconds). Decreasing this value speeds up your scans, but with the possibility of skipping some rules. Alternatively, increasing this value ensures that your most complex rules finish running. For example: