Skip to main content

​
Avoiding excessive inline comments

For rules with several findings in the same PR or MR, inline comments for every individual finding occupy a significant amount of space without providing much additional information. Therefore, if the same finding occurs more than five times in a PR or MR, the related comment is posted as a summary (overall) comment. Findings grouped together into a summary comment can only be triaged in Semgrep AppSec Platform.

​
Available lines in the displayed diff

​
GitHub PRs

GitHub only allows PR comments to be posted on lines of code that are shown in the default file-diff (Files changed) view on GitHub. If a finding appears outside those lines, Semgrep attempts to post the comment as close to the finding as feasible. If that fails, it posts the comment as a summary comment, visible in the Conversation view.

​
GitLab MRs

GitLab allows comments to be posted on lines of code outside the default file-diff view, but the comments don’t appear in the file-diff (Changes) view. However, they do appear as diff-related comments on the Overview.

​
GitLab Self-Managed version

For GitLab Self-Managed, Semgrep recommends GitLab 16.5 or later for integrations that use unified diffs, including inline merge request comments from Semgrep Agentic Workflows. On older versions, workflow issues may appear in merge request summary comments instead of inline comments. See Recommended GitLab version.

​
Additional references

Enabling GitHub pull request comments

Enabling GitLab merge request comments

Enabling Bitbucket pull request comments