Skip to main content

Enable Azure pull request comments

Your deployment journey

Semgrep can create pull request (PR) comments in your Azure DevOps repository. These comments provide a description of the issue detected by Semgrep and may offer possible solutions. These comments are a means for security teams, or any team responsible for creating standards, to help their fellow developers write safe and standards-compliant code.

Automated comments on Azure DevOps pull requests are displayed as follows:

Semgrep Azure DevOps PR comment Figure. An inline Azure DevOps pull request comment.

Conditions for PR comment creation​

PR comments appear for the following types of scans under these conditions:

Type of scanProduct nameTrigger conditionHow to set up
Static application security testing (SAST)Semgrep CodeA comment appears when a finding is generated by a rule in Comment or Block mode. This means you can fully customize what comments your developers receive.Complete the steps in the following sections:
  1. Confirm your Semgrep account's connection and access to your source code manager.
  2. Configure comments for Semgrep Code.
Software composition analysis (SCA)Semgrep Supply Chain (SSC)A comment appears based on the conditions you explicitly set in a Supply Chain policy or when Semgrep detects a license violation.To receive Supply Chain comments, complete the steps in Confirm account connection and access and set up a policy.

To receive license violation comments, enable dependency search.
SecretsSemgrep SecretsA comment appears when a finding is generated by a rule in Comment or Block mode. A comment also appears for invalid findings and validation errors if these conditions are set to Comment or Block mode.Complete the steps in the following sections:
  1. Confirm your Semgrep account's connection and access to your source code manager.
  2. Configure comments for Semgrep Secrets.

Comments from Supply Chain scans include the following information:

Risk
A description of the vulnerability, including the types of attack it is vulnerable to.
Fix
Indicates what versions to upgrade to, if any, that resolves or eliminates the vulnerability.
Reference
A link to additional information about the vulnerability from its source, such as the GitHub Advisory Database and the National Vulnerability Database (NVD), if available.

Steps to set up PR comments​

Prerequisites​

Semgrep currently supports repositories hosted by Azure DevOps Cloud.

In addition to finishing the previous steps in your deployment journey, it is recommended to have completed a full scan on your default branch for the repository in which you want to receive comments.

Confirm your Semgrep account's connection​

PR comments are enabled by default for users who have connected their Azure DevOps project to Semgrep AppSec Platform. Confirm that you have the correct connection and access:

  1. In your Semgrep AppSec Platform account, click Settings > Source code managers.
  2. Check that an entry for your Azure DevOps project exists and is correct.

Set up the configuration file​

In the Azure Pipelines configuration file, export the SEMGREP_REPO_URL and SEMGREP_REPO_NAME variables to enable PR comments and ensure that findings and related data are accurately labeled with your project's information. Note that the namespace that's a part of the variable's value follows the format organization/project:

# example
export SEMGREP_REPO_URL="https://dev.azure.com/{organization}/{project}/_git/{project}"
Click to see a sample workflow file
pool:
  vmImage: ubuntu-latest
variables:
  - group: Semgrep_Variables
steps:
  - checkout: self
    clean: true
    fetchDepth: 100000
    persistCredentials: true
  - script: >
      python -m pip install --upgrade pip

      pip install semgrep

      if [ $(Build.SourceBranchName) = "main" ]; then
          echo "Semgrep full scan"
          semgrep ci
      elif [ $(System.PullRequest.PullRequestId) -ge 0 ]; then
          echo "Semgrep diff scan"
          export SEMGREP_PR_ID=$(System.PullRequest.PullRequestId)
          export SEMGREP_REPO_URL="https://dev.azure.com/{organization}/${SYSTEM_TEAMPROJECT}/_git/${BUILD_REPOSITORY_NAME}"
          export SEMGREP_REPO_NAME="{organization}/${SYSTEM_TEAMPROJECT}/${BUILD_REPOSITORY_NAME}"
          export SEMGREP_BASELINE_REF='origin/main'
          export AZURE_TOKEN=$(System.AccessToken)
          git fetch origin main:origin/main
          semgrep ci 
      fi
  - task: Bash@3
    inputs:
      targetType: inline
      script: |
        # this is inline code
        env | sort

Configure comments for Semgrep Secrets​

In addition to setting up the connection between Semgrep and Azure, you must assign rules to Comment or Block mode. This customization enables you to:
  • Manage the amount of PR comments your developers receive.
  • Ensure that only rules that meet your criteria, such as high severity or high confidence rules, and result in findings involving valid secrets produce comments visible to developers, reducing noise.

Set rules to Comment or Block mode​

The following instructions let you customize what findings or security issues your developers see as comments in their PRs:

  1. In Semgrep AppSec Platform, go to Rules > Policies > Secrets.
  2. Under Modes , you can see if you have existing rules in either Comment or Block mode. You can also use the filters to find rules you want to set to Comment or Block.
  3. Click the checkbox of the rules you want to set. You can use Ctrl + Click to select rules in bulk.
  4. Click Change modes.
  5. Click either Block or Comment.

You have successfully configured PR comments for Semgrep Secrets.

Validation state policies​

Validation state policies allow you to define how Semgrep handles the following issues:

  • Invalid findings: the secret has been revoked, was never functional, or used for a custom or private endpoint that Semgrep can't communicate with. For example, a Semgrep rule that tests GitHub credentials may return an invalid finding if Semgrep can't communicate with an on-premise deployment.
  • Validation errors: Semgrep was unable to reach the secrets provider to test the validity of the credential, or Semgrep received an unexpected response from the API

To edit the policy for invalid secrets and errors:

  1. In Semgrep AppSec Platform, go to Rules > Policies > Secrets.
  2. Click Validation State Policies.
  3. Choose the mode, either Comment or Block, that you want Semgrep to set for Invalid findings.
  4. Choose the mode, either Comment or Block, that you want Semgrep to set for Validation errors.
tip

Rules in Block mode fail the CI job that runs on the PR. Depending on your workflow, this may prevent your PR from merging.

Configure comments for Semgrep Code​

In addition to setting up the connection between Semgrep and Azure, you must assign rules to Comment or Block mode. This customization enables you to:
  • Manage the amount of PR comments your developers receive.
  • Ensure that only rules that meet your criteria, such as high severity or high confidence rules, produce comments visible to developers, reducing noise.

Set rules to Comment or Block mode​

The following instructions let you customize what findings or security issues your developers see as comments in their PRs:

  1. In your Semgrep AppSec Platform account, click Rules > Policies to enter the Policies page. Under Modes , you can quickly see if you have existing rules in either Comment or Block mode.
  2. Optional: To configure Semgrep Secrets rules, click the Secrets tab.
  3. Optional: Use the filters to quickly find rules to set to Comment or Block.
  4. Click the checkbox of the rules you want to set. You can use Ctrl + Click to select rules in bulk.
  5. Click Change modes.
  6. Click either Block or Comment.

You have successfully configured PR comments for Semgrep Code.
tip

Rules in Block mode fail the CI job that runs on the PR. Depending on your workflow, this may prevent your PR from merging.

Configure comments for Semgrep Supply Chain​

To configure comments for Supply Chain, you must define a Supply Chain policy. This policy lets you set the specific conditions, such as transitivity and reachability, that trigger a comment. These conditions are unique to Supply Chain findings.

See the Policies documentation for more information.

Next steps​

You've finished setting up a core deployment of Semgrep 🎉.

Additional references​

Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.