OpenGrep Integration Guide

Integrate OpenGrep with Vulnetix. A community fork of Semgrep with the same SARIF output capabilities.

Install & scan

$ uv run --with semgrep opengrep --version
$ uv run --with semgrep opengrep scan --config auto --sarif --sarif-output=opengrep.sarif .

Run OpenGrep in CI

Scan on every push and upload the report as a workflow artifact:

- name: Run OpenGrep
  run: |
    pip install semgrep
    opengrep scan --config auto --sarif --sarif-output=opengrep.sarif .
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: opengrep
    path: opengrep.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under OpenGrep's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace OpenGrep. Keep running it. Vulnetix sits on top of OpenGrep (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

OpenGrep is strongest at its core category and also carries features in Secret Scanning, IaC & Cloud Configuration, Container & Image Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What OpenGrep does well

• Fully Semgrep-rule-compatible engine - existing Semgrep registry rules and rulesets run unchanged - under open LGPL-2.1 governance backed by a 10+ vendor coalition (Aikido, Endor, Orca, Jit and others)
• 30+ languages with fast self-contained binaries that need no Python runtime
• Taint analysis including intrafile tracking, constructor/field assignment, inter-method flow and higher-order functions across multiple languages
• JSON and SARIF output plus rule-embedded autofix, making CI/CD and GHAS integration straightforward

Where Vulnetix adds to it: Directly complementary: Vulnetix's own SAST uses the Semgrep engine, so OpenGrep rules and outputs slot in natively. Better together: Vulnetix consolidates OpenGrep findings with SCA/IaC/container/secrets/cloud results into one deduplicated queue and adds the layer OpenGrep does not have - exploit-intel prioritisation (EPSS/KEV/ESS/CWSS/LEV), reachability, immutable versioned VEX, EOL and SSVC policy, and Safe Harbour remediation.

No migration, no rip-and-replace. OpenGrep keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise OpenGrep results in Vulnetix

Upload OpenGrep SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

OpenGrep documentation ↗  ·  Source repository ↗

Wire OpenGrep into your CI/CD pipeline →