Skip to main content

Add a GitLab repository to Semgrep Managed Scans

Add GitLab repositories to your Semgrep organization in bulk without adding or changing your existing CI workflows through Managed Scans.

Prerequisites and permissions​

Semgrep Managed Scanning requires one of the following plans:

  • GitLab Premium
  • GitLab Ultimate
  • GitLab Self Managed

You must provide a GitLab group access token or personal access token to Semgrep. The token must have the api scope assigned to it. During SMS onboarding, the group or user to which the token is assigned must have one of the following roles: Maintainer, Owner, or Admin. Afterwards, you can downgrade the role assigned to the token to Developer.

See Pre-deployment checklist > Permissions for more information about the permissions used by Semgrep.

Enable Managed Scanning and scan your first repository​

  1. In Semgrep AppSec Platform, click Projects.
  2. Click Scan new project > Semgrep Managed Scan.
  3. In the Enable Managed Scans for repos page, select the repositories you want to add to Semgrep Managed Scans.
    1. Optional: If you don't see the repository you want to add, click Can't find your project? and follow the troubleshooting steps provided.
  4. Click + Connect more.
  5. Select GitLab.
  6. In the Set up Managed Scans page that appears, provide the information needed by Semgrep to connect to your GitLab project:
    1. Select GitLab Cloud or GitLab Self-Managed.
    2. Provide your Access token.
    3. Provide your GitLab group.
    4. For GitLab Self-Managed users only: provide the GitLab URL.
    5. Click Connect.
  7. Repeat the steps above for each additional GitHub group you'd like added to Semgrep.

You have finished setting up a Semgrep managed scan.

  • After enabling Managed Scans, Semgrep performs a full scan in batches on all the repositories.
  • Once a repository has been added to Semgrep AppSec Platform, it becomes a project. A project in Semgrep AppSec Platform includes all the findings, history, and scan metadata of that repository.
  • Projects scanned through Managed Scans are tagged with managed-scan.

Add additional GitLab projects​

You can enabled managed scanning for additional repositories after onboarding using the following steps:

  1. In Semgrep AppSec Platform, click Projects.
  2. Click Scan new project > Semgrep Managed Scan.
  3. In the Enable Managed Scans for repos page, select the repositories you want to add to Semgrep Managed Scans.
    1. Optional: If you don't see the repository you want to add, click Can't find your project? and follow the troubleshooting steps provided.
  4. Select the repositories you want to scan from the list.
  5. Click Enable Managed Scans. The Enable Managed Scans dialog appears. By default, Semgrep runs both full and diff-aware scans.
  6. Optional: Disable PR or MR diff-aware scans by turning off the Enable PR/MR scans toggle. Enable Managed Scans dialog
  7. Click Enable.

If the page doesn't display any repositories​

  1. Ensure that you've connected your GitLab account by following the steps in Connect a source code manager and confirm the PAT is created with the required API scope and a role of, at minimum, Reporter.
  2. In Semgrep AppSec Platform, click Projects.
  3. If the page doesn't display the repository you want to add, click Can't find your project? > Sync projects.
  4. If the page doesn't display any repositories, click Sync projects.
  5. Optional: Perform a hard refresh (Ctrl+F5 or Cmd+Shift+R).

Convert or migrate an existing Semgrep CI job​

You can immediately add any existing project to Managed Scans.

  1. Follow the steps in Add a repository.
  2. Delete the .gitlab-ci.yml file in your GitLab repository if appropriate.

If you plan to continue running some scans in GitLab CI/CD Pipelines (for example, using Managed Scans to run weekly full scans but GitLab CI/CD Pipelines for diff-aware scans) you can leave the workflow file in place, and edit it to reflect your desired configuration.

tip

Semgrep preserves your findings, scans, and triage history.

Scan management and configuration​

Manually run a full scan​

  1. In Semgrep AppSec Platform, click Projects.
  2. Search for your repository's name.
  3. Click the gear icon to access the settings page for that repository.
  4. Click Run a new scan.

Disable diff-aware scans on PRs​

  1. In Semgrep AppSec Platform, click Projects.
  2. Search for your repository's name.
  3. Click the gear icon to access the settings page for that repository.
  4. Click the toggle for diff-aware scans.

Delete a project​

  1. In Semgrep AppSec Platform, click Projects.
  2. Search for your repository's name.
  3. Click the gear icon to access the settings page for that repository.
  4. Click the dropdown at the header and click Delete project.

Disable webhooks​

Managed scanning of GitLab projects require webhooks. The webhooks are enabled by default when you add GitLab as a source code manager when setting up Managed Scanning. You can disable webhooks at any time by following these steps:

  1. In Semgrep AppSec Platform, go to Settings > Source code managers.
  2. Find your GitLab connection, and click the toggle to disable Incoming webhooks.

Revoke Semgrep's access to your repositories​

The following steps revoke the code access you previously granted Semgrep for all repositories you selected.

  1. In Semgrep AppSec Platform, click Settings > Source Code Managers.
  2. On the entry of the SCM you want to remove, click Remove app.
  3. Click Remove to confirm.

Appendices​

Scan logs​

Most recent scan​

You can view logs for your most recent scan by clicking Projects > the project's latest scan time under Scan status.

Click the project's latest scan to view the log Figure. The Projects page. Click the project's latest scan (underlined) to view the log.

info

It can take a few minutes for your latest scan's logs to appear. However, if the logs do not update 15 minutes after the scan, there may be issues with the scan itself.

All scans​

  1. Click the project's Details page > Scans tab.
  2. Click the scroll icon under Logs to view the log for the particular entry.

Scan statistics​

Scan statistics, such as how many of your repositories are being scanned, the scan success rate, and so on, can be provided once a week upon request. Contact your Semgrep account manager to request scan statistics.

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.