Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Align style and be clearer about versions & defaults #2062

Merged
merged 2 commits into from
Mar 28, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 17 additions & 31 deletions docs/kb/semgrep-code/semgrepignore-ignored.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,37 +7,23 @@ description: Why am I getting findings in files that should be ignored?

# Why am I getting findings in files that should be ignored?

If you don't have already a `.semgrepignore` file, refer to our
[guide on how to exclude files from Semgrep
scans](/docs/ignoring-files-folders-code). Otherwise, if
you already have a `.semgrepignore` file, read on.

Starting with Semgrep CE 1.112.0, the Semgrepignore specification has
changed slightly to better align with Git and Gitignore and to offer
more flexibility.
The new specification is referred to as
[Semgrepignore v2](/docs/semgrepignore-v2-reference).
If you're getting findings in files that should have been
ignored according to your `.semgrepignore` file, check the
following:

1. If you're using Git, check that the `.semgrepignore` file is at the
root of the Git project or at least is within the project.
`.semgrepignore` files can be placed in any folder in the project
and follow the same specification as `.gitignore` files,
which they extend.
2. If you're not using Git, check that the `.semgrepignore` file
is in the folder passed on the `semgrep scan` command line.
For example, if the command is `semgrep scan foo/`, you must move
the `.semgrepignore` file from the current folder
to `foo/.semgrepignore`.

To ensure you're using Semgrepignore v2, pass the flag
`--semgrepignore-v2` to `semgrep scan` or to `semgrep
ci`. To use the legacy Semgrepignore v1 implementation, use
`--no-semgrepignore-v2`. These options are for troubleshooting the
migration from v1 to v2. These flags will be removed when v2 becomes
only implementation available.
If you don't have already a `.semgrepignore` file, refer to our [guide on how to exclude files from Semgrep scans](/docs/ignoring-files-folders-code).

If you already have a `.semgrepignore` file and are not seeing the results you expect, you may be seeing the effect of changes in Semgrep 1.117.0 and above. Starting with Semgrep 1.117.0, the Semgrepignore specification has changed slightly to better align with Git and Gitignore and to offer more flexibility. The new specification is referred to as [Semgrepignore v2](/docs/semgrepignore-v2-reference).

## Requirements for Semgrepignore v2

### If you're using Git

Place the the `.semgrepignore` file in root of the Git project (preferred) or in any folder in the project where you want to consistently ignore some files. `.semgrepignore files follow the same specification as `.gitignore` files, which they extend.

### If you're not using Git

Place the `.semgrepignore` file in the folder passed on the `semgrep scan` command line. For example, if the command is `semgrep scan foo/`, and the `.semgrepignore` file is in the current directory, move the `.semgrepignore` file from the current directory to `foo/.semgrepignore`.

## Troubleshooting Semgrepignore v2 issues

To ensure you're using Semgrepignore v2, pass the flag `--semgrepignore-v2` to `semgrep scan` or to `semgrep ci`. To use the legacy Semgrepignore v1 implementation, use `--no-semgrepignore-v2`. These options are for troubleshooting the migration from v1 to v2. These flags will be removed when v2 becomes the only implementation available.

## Best practices

Expand Down