Skip to main content

​
Enable Supply Chain

If you haven’t already enabled Supply Chain:
1
Sign in to Semgrep AppSec Platform.
2
Go to Settings > General > Supply Chain.
3
Click the Supply Chain scans toggle if it is not already enabled.
Once you enable Semgrep Supply Chain, it automatically scans any repositories that meet the scan requirements in Semgrep AppSec Platform.

​
Project directory structure

To scan your project with Supply Chain, it must use a supported package manager and supported file names. Supply Chain can correctly parse code files, , and in subfolders as well. Code files that use the in the manifest file or lockfile must be nested in the same directory as the manifest file or lockfile. Manifest files and lockfiles must all use supported file names. In the following example, Supply Chain assumes that all code files using the dependencies in my-project/running/lockfile.json are nested in my-project/running/ or deeper directories.
If you have code files in my-project/biking, Supply Chain does not associate them with the dependencies in my-project/running/lockfile.json. If there is another manifest file or lockfile in my-project/running, such as my-project/running/uphill/lockfile.json, then this overrides the original my-project/running/lockfile.json for all code files in my-project/running/uphill/ or deeper directories.

​
Scan frequency

You can modify your CI configuration so that Supply Chain scans your code at a specified frequency or whenever a specific event occurs, such as opening a pull request or merge request.

​
Rule updates

Semgrep Supply Chain frequently receives rule updates. To take advantage of these updates, adjust the frequency with which Supply Chain scans your codebase. If a rule is updated, findings generated against the revised rule are considered new findings, even if the previous version generated a finding. The new finding is not affected by any triage actions on findings related to the prior version of the rule. Because the finding is new, you’ll also receive notifications through the channels you’ve set up, such as Slack.

​
Schedule scans

The following list includes resources to set up schedules for different CI providers:

​
Event-triggered scans

You can configure your CI/CD system to trigger a Supply Chain scan whenever one of the following events occurs:

​
Run a scan using the CLI

You can start a stand-alone Supply Chain scan by running the following command in the CLI:
Semgrep prints a list of findings directly to the CLI, including the finding’s reachability determination, severity level, a brief description, and suggested remediation. You can also view your results in Semgrep AppSec Platform. It displays all of the information displayed in the CLI, but offers additional functionality such as:
  • Additional finding details, such as whether the finding is always reachable, conditionally reachable, or transitive.
  • Dependency search to view all of your project’s dependencies and their associated vulnerabilities.
  • License compliance to manage the dependencies used in your project based on their licenses.

​
Scan a monorepo’s dependencies

Supply Chain supports the scanning of monorepos. As outlined in Project directory structure, findings are grouped by directory based on the or present in the monorepo.

​
Dynamic Dependency Resolution (beta)

This feature is currently in beta. Please contact Semgrep Support for more information.
Supply Chain can use Dynamic Dependency Resolution to scan projects without lockfiles or with incomplete lockfiles. Dynamic Dependency Resolution supports these package managers:
  • Maven and Gradle in CI, in the CLI, and on Managed Scans
  • pip setup.py projects only in CI and the CLI
  • NuGet for C#: .csproj in your own CI or on a local machine when packages.lock.json isn’t present. If both files exist, Semgrep uses the lockfile. Managed Scans requires packages.lock.json and doesn’t support Dynamic Dependency Resolution for NuGet.

​
CLI scans, including self-managed CI systems

  1. Install the build tools for your package manager in the environment where you run Semgrep:
    • For Maven or Gradle, install a compatible Java Development Kit (JDK) and Maven or Gradle. You choose the JDK in this environment, so you can use Dynamic Dependency Resolution for Java versions below 11.
    • For pip, install Python and pip.
    • For NuGet, install the .NET SDK. Use this resolution for C# only in CI and the CLI.
  2. Initiate a Semgrep scan, ensuring that you include the --allow-local-builds flag to enable Semgrep to invoke package managers on the system:
    For existing CI jobs, you might have to edit your configuration file to include this flag. The flag allows Semgrep to build the project, if needed, to dynamically resolve dependencies. Semgrep uses the pom.xml, build.gradle, or .csproj manifest to determine which dependencies the project uses. Run this command in your own CI system or on a local machine.

​
Semgrep Managed Scans

For C# (NuGet), Semgrep resolves dependencies from packages.lock.json on Managed Scans, in your own CI, and on a local machine. If the project doesn’t contain packages.lock.json, Dynamic Dependency Resolution uses a .csproj file in your own CI or on a local machine. If both files exist, Semgrep uses the lockfile. Managed Scans doesn’t support Dynamic Dependency Resolution for NuGet. Managed Scans supports Dynamic Dependency Resolution only for Maven and Gradle.
1
Connect a private registry to Semgrep in Settings > Integrations. Note that only Maven registries are currently supported for Managed Scans.
2
Contact Semgrep Support to enable Dynamic Dependency Resolution for the necessary repositories.

​
Java version support

Dynamic Dependency Resolution on Managed Scans includes the following JDKs: 11, 17, and 21. Semgrep starts resolution with JDK 21 and falls back to JDK 11 or 17 when a repository indicates an older Gradle version. This requirement applies only to Dynamic Dependency Resolution without lockfiles in the Managed Scans environment. It does not change Semgrep Code (SAST) Java coverage. If your repository includes a supported lockfile or a Maven-generated maven_dep_tree.txt, Semgrep parses that file and does not need to invoke a JDK for dependency resolution. The JDK version of the project then does not affect Supply Chain scanning. For Java projects that require a JDK below 11 and do not have a lockfile or dependency tree:
  • Run Supply Chain scans from your own CI after generating a lockfile or maven_dep_tree.txt, or
  • Run Dynamic Dependency Resolution in your own CI or CLI environment with --allow-local-builds, where you control the installed JDK.