> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up and configure Supply Chain scans

> Learn about the setup needed to scan your project with Semgrep Supply Chain and its configuration and customization options.

## Enable Supply Chain

If you haven't already enabled Supply Chain:

<Steps>
  <Step>
    Sign in to [Semgrep AppSec Platform](https://semgrep.dev/login).
  </Step>

  <Step>
    Go to **[Settings > General > Supply Chain](https://semgrep.dev/orgs/-/settings/general/supplyChain)**.
  </Step>

  <Step>
    Click the **<Icon icon="toggle-large-on" iconType="solid" /> Supply Chain scans** toggle if it is not already enabled.
  </Step>
</Steps>

Once you enable Semgrep Supply Chain, it automatically scans any repositories that meet the scan requirements in Semgrep AppSec Platform.

## Project directory structure

To scan your project with Supply Chain, it must use a [supported package manager and supported file names](/semgrep-supply-chain/requirements-and-feature-support).

Supply Chain can correctly parse code files, <Tooltip tip="Describes dependencies used in a codebase. Package managers read manifest files to resolve and install specific dependency versions and generate lockfiles." cta="See full definition." href="/semgrep-supply-chain/glossary#manifest-file">manifest files</Tooltip>, and <Tooltip tip="Describes a dependency tree to ensure installs use the same dependencies and exact versions. Lockfiles include versions of dependencies and transitive dependencies and are generated by package managers like pip or npm." cta="See full definition." href="/semgrep-supply-chain/glossary#lockfile">lockfiles</Tooltip> in subfolders as well. Code files that use the <Tooltip tip="Publicly available code used as part of your application. Dependencies are listed in registries such as npm for JavaScript and PyPI for Python." cta="See full definition." href="/semgrep-supply-chain/glossary#dependency">dependencies</Tooltip> in the manifest file or lockfile must be nested in the same directory as the manifest file or lockfile. Manifest files and lockfiles must all use supported file names.

In the following example, Supply Chain assumes that all code files using the dependencies in `my-project/running/lockfile.json` are nested in `my-project/running/` or deeper directories.

```
/my-project
├───/running
│   ├───lockfile.json
│   ├───bar.js
│   └───/uphill
│       ├───lockfile.json
│       └────foo.js
├───/biking
```

If you have code files in `my-project/biking,` Supply Chain does not associate them with the dependencies in `my-project/running/lockfile.json`. If there is another manifest file or lockfile in `my-project/running`, such as `my-project/running/uphill/lockfile.json`, then this overrides the original `my-project/running/lockfile.json` for all code files in `my-project/running/uphill/` or deeper directories.

## Scan frequency

You can modify your CI configuration so that Supply Chain scans your code at a specified frequency or whenever a specific event occurs, such as opening a pull request or merge request.

### Rule updates

Semgrep Supply Chain [frequently receives rule updates](/semgrep-supply-chain/overview#new-cves-and-rule-updates). To take advantage of these updates, adjust the frequency with which Supply Chain scans your codebase.

If a rule is updated, findings generated against the revised rule are considered **new findings**, even if the previous version generated a finding. The new finding is not affected by any triage actions on findings related to the prior version of the rule. Because the finding is new, you'll also receive notifications through the channels you've set up, such as Slack.

### Schedule scans

The following list includes resources to set up schedules for different CI providers:

* [Azure Pipelines](https://docs.microsoft.com/en-us/azure/devops/pipelines/process/scheduled-triggers?view=azure-devops\&tabs=yaml)
* [Bitbucket Pipelines](https://support.atlassian.com/bitbucket-cloud/pipeline-triggers/)
* [Buildkite](https://buildkite.com/pipelines/scheduled-builds)
* [CircleCI](https://circleci.com/scheduled-pipelines#get-started-with-scheduled-pipelines-in-circleci)
* [GitHub Actions](/semgrep-ci/sample-ci-configs#sample-github-actions-configuration-file) (see the `schedule` section of the sample `semgrep.yml` configuration file)
* [GitLab CI/CD](https://docs.gitlab.com/ee/ci/pipelines/schedules.html)
* [Jenkins](https://www.jenkins.io/doc/book/pipeline/running-pipelines/#scheduling-jobs-in-jenkins)

### Event-triggered scans

You can configure your CI/CD system to trigger a Supply Chain scan whenever one of the following events occurs:

| Event                                       | Scope of scan                                                             | Dependency rule set  |
| ------------------------------------------- | ------------------------------------------------------------------------- | -------------------- |
| Pull request or merge request               | [Diff-aware scans](/deployment/customize-ci-jobs#set-up-diff-aware-scans) | All dependency rules |
| Push or scheduled event, such as a cron job | Full scan                                                                 | All dependency rules |

## Run a scan using the CLI

You can start a stand-alone Supply Chain scan by running the following command in the CLI:

```console theme={null}
semgrep ci --supply-chain
```

Semgrep prints a list of findings directly to the CLI, including the finding's reachability determination, severity level, a brief description, and suggested remediation.

You can also view your results in Semgrep AppSec Platform. It displays all of the information displayed in the CLI, but offers additional functionality such as:

* [Additional finding details](/semgrep-supply-chain/findings), such as whether the finding is always reachable, conditionally reachable, or transitive.
* [Dependency search](/semgrep-supply-chain/dependency-search) to view all of your project's dependencies and their associated vulnerabilities.
* [License compliance](/semgrep-supply-chain/license-compliance) to manage the dependencies used in your project based on their licenses.

## Scan a monorepo's dependencies

Supply Chain supports the scanning of monorepos. As outlined in [Project directory structure](#project-directory-structure), findings are grouped by directory based on the <Tooltip tip="Describes dependencies used in a codebase. Package managers read manifest files to resolve and install specific dependency versions and generate lockfiles." cta="See full definition." href="/semgrep-supply-chain/glossary#manifest-file">manifest file</Tooltip> or <Tooltip tip="Describes a dependency tree to ensure installs use the same dependencies and exact versions. Lockfiles include versions of dependencies and transitive dependencies and are generated by package managers like pip or npm." cta="See full definition." href="/semgrep-supply-chain/glossary#lockfile">lockfile</Tooltip> present in the monorepo.

## Dynamic Dependency Resolution (beta)

<Note>
  This feature is currently in beta. Please contact [Semgrep Support](/support) for more information.
</Note>

Supply Chain can use **Dynamic Dependency Resolution** to scan projects without lockfiles or with incomplete lockfiles.

### CLI Scans, including self-managed CI systems

1. Ensure that the environment where you run Semgrep scans has installed all of the dependencies required to build your project, such as Java and Maven or Python and pip.
2. Initiate a Semgrep scan, ensuring that you include the `--allow-local-builds` flag to enable Semgrep to invoke package managers on the system:
   ```console theme={null}
   semgrep ci --allow-local-builds
   ```
   For existing CI jobs, you might have to edit your configuration file to include this flag. The flag allows Semgrep to build the project, if needed, to dynamically resolve dependencies. Semgrep uses the build information included in the `pom.xml` or `build.gradle` file to determine the set of dependencies used by the project.

### Semgrep Managed Scans

<Steps>
  <Step>
    [Connect a private registry to Semgrep](/kb/semgrep-supply-chain/connect-a-private-registry) in **Settings > Integrations**. Note that only Maven registries are currently supported for Managed Scans.
  </Step>

  <Step>
    Contact [Semgrep Support](/support) to enable Dynamic Dependency resolution for the necessary repositories.
  </Step>
</Steps>