> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Running Semgrep using templates in Azure Pipelines

## Motivation

Complex CI configurations housed in large YAML files take a lot of work to maintain and modify. Azure [templates](https://learn.microsoft.com/en-us/azure/devops/pipelines/process/templates?view=azure-devops) extract chunks of logic from larger configurations and encapsulate them in external template files. The template can then be referenced in multiple configurations, keeping pipelines more readable and maintainable.

This guide explains how to:

* Create template files to run various Semgrep commands.
* Include or call templates in your Azure Pipeline.

You can then reuse the template files in as many pipelines as you need.

## Defining Semgrep commands in a template file

To add Semgrep commands in a YAML template file:

<Steps>
  <Step>
    Create a `templates` folder in the repository you want to run Semgrep in.
  </Step>

  <Step>
    Commit the following templates:

    Example YAML template file for a Semgrep full scan:

    ```yaml theme={null}
    steps:
    - script: |
        echo "Semgrep full scan"
        python -m pip install --upgrade pipx
        pipx install semgrep
        semgrep ci
    ```

    Example YAML template file for a Semgrep pull request scan:

    ```yaml theme={null}
    steps:
    - checkout: self
      clean: true
      fetchDepth: 10000
      persistCredentials: true
    - script: |
        echo "Pull Request Scan from branch: $(Build.SourceBranchName)"
        git fetch origin master:origin/master
        python -m pip install --upgrade pipx
        pipx install semgrep
        semgrep ci
      env:
       SEMGREP_PR_ID: $(System.PullRequest.PullRequestNumber)
       SEMGREP_BASELINE_REF: 'origin/master'
    ```
  </Step>
</Steps>

<Info>
  **NOTE**

  You must define separate templates for full scans and [diff-aware scans](/deployment/customize-ci-jobs#set-up-diff-aware-scans). This is because there are different environment variables used in the template for diff-aware scans, such as `SEMGREP_PR_ID` and `SEMGREP_BASELINE_REF`.
</Info>

## Referencing templates in an Azure Pipeline

With the templates defined, reference them in other Azure Pipelines like this:

```yaml theme={null}
pool:
  vmImage: ubuntu-latest

variables:
- group: Semgrep_Variables

jobs:
- job: Semgrep_Full_Scan
  condition: eq(variables['Build.SourceBranchName'], 'master')
  steps:
  - template: templates/full_scan_semgrep.yml

- job: Semgrep_PR_Scan
  condition: ne(variables['Build.SourceBranchName'], 'master')
  steps:
  - template: templates/pr_scan_semgrep.yml
```

<Tip>
  **TIP**

  You can even define your templates in a centralized repository and [reference them in other repositories](https://learn.microsoft.com/en-us/azure/devops/pipelines/process/templates?view=azure-devops#use-other-repositories).
</Tip>

## Conclusion

Using templates in Azure Pipelines is a good practice to simplify pipeline configuration files, improving both readability and maintainability. Pipeline templates can also speed up the Semgrep onboarding process for repositories by allowing you to reuse the same template in each repository.