Skip to main content

Add Semgrep to CI

Your deployment journey

Semgrep is integrated into CI environments by creating a job that is run by the CI provider. After a scan, findings are sent to Semgrep Cloud Platform (SCP) for triage and remediation.

By integrating Semgrep into your CI environment, your development cycle benefits from the automated scanning of repositories at various events, such as:

  • Push events
  • Pull or merge requests (PRs or MRs)
  • User-initiated events (such as GitHub Action's workflow_dispatch)

Guided setup for CI providers in SCP

This guide walks you through creating a Semgrep job in the following CI providers, which are explicitly supported in SCP:

  • GitHub Actions
  • GitLab CI/CD
  • Jenkins
  • Bitbucket
  • CircleCI
  • Buildkite
  • Azure Pipelines

CI providers explicitly supported in SCP. Figure. Semgrep Cloud Platform provides steps and configuration files to easily set up a Semgrep job for popular CI providers.

If your provider is not on this list, you can still integrate Semgrep into your CI workflows by following the steps in Add Semgrep to other CI providers.

Projects

Adding a Semgrep job to your CI provider also adds the repository's records, including findings, as a project in Semgrep Cloud Platform. Each Project can be individually configured to send notifications or tickets.

Semgrep Cloud Platform Projects page Figure. Semgrep Cloud Platform Projects page. This displays all the repositories you have successfully added a Semgrep job to.

Add Semgrep to CI through Semgrep Cloud Platform

To add a Semgrep job to your CI provider:

  1. Ensure you are signed in to Semgrep Cloud Platform.
  2. Click Projects on the left sidebar.
  3. Click Scan new project > CI/CD.
  4. Click the name of the CI provider you use. You are taken to the Add job page.
  5. Follow the steps provided on the page. The process varies depending on your CI provider, but generally includes the following steps:
    1. Click Create new token to create a SEMGREP_APP_TOKEN, which is used to when sending results to Semgrep Cloud Platform.
    2. Copy and paste the SEMGREP_APP_TOKEN and its value. Store it as an environment variable or secret in your CI provider.
    3. Optional: Click Review CI config to see Semgrep's default YAML configuration file for your CI provider.
    4. Click Copy snippet and paste it into your CI provider's configuration file (the filename is typically indicated in the page). Depending on your CI provider, you may have to create a custom configuration file or use an existing one.
    5. Commit the configuration file to your repository.
    6. Return to Semgrep Cloud Platform and click Check connection.

You have now added a Semgrep job to your CI provider; this starts your first full Semgrep scan. Its findings are sent to Semgrep Cloud Platform for triage and remediation.

tip

You can edit your configuration files to send findings to GitHub Advanced Security Dashboard (GHAS) and GitLab SAST Dashboard. Refer to the following samples:

Sample CI configuration snippets

Refer to the following table for links to sample CI configuration snippets:

In-app CI providerSample CI configuration snippet
GitHub Actionssemgrep.yml
GitLab CI/CD.gitlab-ci.yml
JenkinsJenkinsfile
Bitbucket Pipelinesbitbucket-pipelines.yml
CircleCIconfig.yml
Buildkitepipelines.yml
Azure Pipelinesazure-pipelines.yml

Data collected by Semgrep Cloud Platform

When running in CI, Semgrep runs fully in the CI build environment. Unless you have explicitly granted code access to Semgrep, your code is not sent anywhere.

  • Semgrep Cloud Platform collects findings data, which includes the line number of the code match, but not the code. It is hashed using a one-way hashing function.
  • Findings data is used to generate line-specific hyperlinks to your source code management system and support other Semgrep functions.

Next steps

You've set up Semgrep to scan in your repository and send findings after each scan. Your core deployment is almost complete.

Remaining steps include:

  • Optional: Customize your CI job.
  • For software composition analysis (SCA) scans using Jenkins or Maven: Set up SCA scans for your infrastructure.
  • For Jenkins users: Set up a separate CI job for diff-aware scans for feature branches (non-trunk branches) when a pull or merge request is open. This is a prerequisite to receiving PR or MR comments. See Set up diff-aware scans.
  • Set up PR or MR comments, which post findings to developers in your SCM. This involves developers in the security process as active participants. See PR or MR comments for next steps.