Semgrep is an open-source static analysis tool designed to scan code for security vulnerabilities and code quality issues.

​
Configuration

Semgrep uses a YAML style configuration file. By default, we will automatically use the following files if any are set in the root directory of your repository.
  • semgrep.yml or semgrep.yaml
  • semgrep.config.yml or semgrep.config.yaml
Semgrep supports the following config files:
  • User-defined config file set at reviews.tools.semgrep.config_file in your project’s .coderabbit.yaml file or setting the “Review → Tools → Semgrep → Config File” field in CodeRabbit’s settings page.
Due to licensing, CodeRabbit does not ship with the community-created Semgrep rules.
CodeRabbit will only run Semgrep if your repository contains a Semgrep config file. This config must use the default file names, or you must define the path to this file in the .coderabbit.yaml or config UI.

​
Files

Semgrep will run on the following files types:
  • C/C++
  • C#
  • Go
  • Java
  • JavaScript
  • Kotlin
  • Python
  • TypeScript
  • Ruby
  • Rust
  • JSX
  • PHP
  • Scala
  • Swift
  • Terraform
  • JSON