Skip to main content

Semgrep

This producer component analyses source code with Semgrep to look for security issues.

Read more about what it does on the Semgrep homepage and GitHub repo.

How to use with Smithy​

Open-Source​

  1. Add the Helm package to the pipeline settings:
---
# file: ./my-pipeline/kustomization.yaml
components:
  - pkg:helm/smithy-security-oss-components/producer-semgrep
  1. Configure the run parameters of the component in the pipeline run file. All parameters are optional:
# file: ./my-pipeline/pipelinerun.yaml
---
...
spec:
...
  params:
  - name: producer-semgrep-rules-yaml
    value: |
      rules: []
  - name: producer-semgrep-config-value
    value: auto

SaaS​

  1. In the Smithy UI, open the page to create a new workflow.
  2. Find Semgrep in the Producers dropdown.
  3. Configure the parameters in the form on the right

Options​

You can configure this component with the following options. The values are optional:

Option NameDescriptionDefaultType
producer-semgrep-rules-yamlAdditional rules passed to Semgrep https://semgrep.dev/docs/writing-rules/rule-syntax."rules: []"YAML string
producer-semgrep-config-valueThe config for the Semgrep producer. Passed directly to the CLI via --config"auto"String