Skip to content

Commit 9eff24a

Browse files
authored
Update monorepo scanning with historical secrets note (#1945)
* "version" doesn't make much sense * Blurb about turning off historical secrets
1 parent 8f6113b commit 9eff24a

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

docs/kb/semgrep-ci/scan-monorepo-in-parts.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,10 @@ As such, it can be helpful to scan a monorepo in parts for multiple reasons:
1515
* To improve scan performance in CI and reduce CI run times
1616
* To logically split the monorepo to simplify managing findings
1717

18+
:::note
19+
Historical secrets scanning relies on examining the entire repo commit history and cannot be split up by path as other scan types like Code, Supply Chain, or Secrets. As such, it is recommended to turn off historical secrets when splitting up a monorepo by path.
20+
:::
21+
1822
## How to configure Semgrep in CI to split up a monorepo
1923

2024
When scanning a repo with Semgrep in CI, the base command is `semgrep ci`. To understand this default setup for your source code manager (SCM) and CI provider, see [Getting started with Semgrep in continuous integration (CI)](/deployment/add-semgrep-to-ci).
@@ -42,7 +46,7 @@ For example:
4246
SEMGREP_REPO_DISPLAY_NAME=monorepo/moduleA semgrep ci --subdir src/moduleA/
4347
```
4448

45-
It is important that scans of different versions never have the same `SEMGREP_REPO_DISPLAY_NAME`. This is necessary to ensure findings have a consistent status and is helpful for developers and security engineers to understand which findings pertain to the module that they are responsible for.
49+
It is important that scans of different modules never have the same `SEMGREP_REPO_DISPLAY_NAME`. This is necessary to ensure findings have a consistent status and is helpful for developers and security engineers to understand which findings pertain to the module that they are responsible for.
4650

4751
To scan the entire monorepo, trigger one scan for each module.
4852

0 commit comments

Comments
 (0)