Semgrep can create pull request (PR) comments in your Bitbucket repository. These comments provide a description of the issue detected by Semgrep and may offer possible solutions. These comments are a means for security teams, or any team responsible for creating standards to help their fellow developers write safe and standards-compliant code.Automated comments on Bitbucket pull requests are displayed as follows:
PR comments appear for the following types of scans under these conditions:
Type of scan
Product name
Trigger condition
How to set up
Static application security testing (SAST)
Semgrep Code
A comment appears when a finding is generated by a rule in Comment or Block mode. This means you can fully customize what comments your developers receive.
A comment appears when a finding is generated by a rule in Comment or Block mode. A comment also appears for invalid findings and validation errors if these conditions are set to Comment or Block mode.
Comments from Supply Chain scans include the following information:Risk
A description of the vulnerability, including the types of attack it is vulnerable to.Fix
Indicates what versions to upgrade to, if any, that resolves or eliminates the vulnerability.Reference
A link to additional information about the vulnerability from its source, such as the GitHub Advisory Database and the National Vulnerability Database (NVD), if available.
Any of the following Bitbucket plans are supported:
Cloud Free
Standard
Premium
There are two ways in which you can integrate Semgrep comments into Bitbucket depending on the Bitbucket plan you use:
Workspace access token: If you use the Bitbucket Cloud Premium plan, you can create a workspace access token. This option saves time because you can create one access token for all repositories in the workspace. With one workspace access token, you can bulk-onboard more repositories at once from a whole workspace. However, you can also use the option of a repository access token to onboard repositories one by one.
Repository access token: If you do not have the Bitbucket Cloud Premium plan, create a separate repository access token for each repository where you want to use Semgrep. This configuration option is also useful if you have the Bitbucket Cloud Premium plan, but prefer to onboard repositories one by one instead of bulk onboarding.
Bitbucket Cloud Premium plan. If you do not have a Bitbucket Cloud Premium plan, create a repository access token.
Create a workspace access token in Bitbucket (only available if you have a Bitbucket Cloud Premium plan):
1
Create a workspace access token in Bitbucket with Read and Write permissions for the Pull requests scope. Follow the instructions in Create a workspace Access Token in Bitbucket documentation.
2
Add the workspace access token as a workspace variable with the Secured option.
Continue setting up Bitbucket PR comments by finishing the rest of this guide.
INFOThis section helps you to configure PR comments if you do not have a Bitbucket Cloud Premium plan. You can create a separate repository access token for each repository where you want to use Semgrep. This configuration option is also useful if you have the Bitbucket Cloud Premium plan, but prefer to onboard repositories one by one instead of bulk onboarding.
Fulfill these general steps to create a repository access token:
1
Create a repository access token in Bitbucket with Read, and Write permissions for the Pull requests scope. Follow the instructions in Create a repository Access Token in Bitbucket documentation.
2
Add the repository access token as a repository variable with the Secured option.
Continue setting up Bitbucket PR comments by finishing the rest of this guide.
In addition to finishing the previous steps in your deployment journey, it is recommended to have completed a full scan on your default branch for the repository in which you want to receive comments.
You must have a Bitbucket Cloud workspace access token or a repository access token.
Developers can triage Semgrep findings without leaving Bitbucket by responding to the PR comments authored by Semgrep. To use this feature, you must have Bitbucket Cloud Premium and update your source code manager (SCM) connection to use a workspace access token. Workspace-level webhooks are not available on Bitbucket Cloud Free or Standard; Semgrep requires webhooks for the triage through PR comments feature.To update your connection between Semgrep and Bitbucket:
1
Log in to Bitbucket using an account assigned with the Product Admin role.
Go to Settings > Source code managers, and find your Bitbucket connection.
5
Click Update access token.
6
In the Update access token dialog that appears, provide the new token you created. Click Update to save and proceed.
7
Toggle the Incoming webhooks setting on.
Once you’ve successfully enabled webhooks and the Triage via code review comments toggle is on, developers can triage Semgrep findings from Bitbucket Cloud.
The logic to determine whether Semgrep runs a full scan or a diff-aware scan on a pull request is defined in the bitbucket-pipelines.yml file.For PR comments and accurate diff-aware scan analysis to work, you must set SEMGREP_BASELINE_REF, which defines the repository’s default branch used as the comparison baseline, such as main or master. Specifying the default branch helps Semgrep understand the differences between the current branch and the main line of development and to generate meaningful results and PR comments.
Click to see a sample workflow file
image: semgrep/semgrep:latestpipelines: branches: # Change to your default branch if different from main main: - step: name: Semgrep scan on push script: - export SEMGREP_APP_TOKEN=$SEMGREP_APP_TOKEN - semgrep ci pull-requests: '**': # This applies to pull requests for all branches - step: name: Semgrep scan on PR script: - export SEMGREP_APP_TOKEN=$SEMGREP_APP_TOKEN # Change to your default branch if different from main - export SEMGREP_BASELINE_REF="origin/main" - git fetch origin "+refs/heads/*:refs/remotes/origin/*" - semgrep ci custom: # Trigger job manually. For cron in Bitbucket, see: https://support.atlassian.com/bitbucket-cloud/pipeline-triggers/#On-schedule semgrep-manual: - step: name: Semgrep manual scan script: - export SEMGREP_APP_TOKEN=$SEMGREP_APP_TOKEN - semgrep ci
In addition to setting up the connection between Semgrep and Bitbucket, you must assign rules to Comment or Block mode. This customization enables you to:
Manage the amount of PR comments your developers receive.
Ensure that only rules that meet your criteria, such as high severity or high confidence rules, produce comments visible to developers, reducing noise.
The following instructions let you customize what findings or security issues your developers see as comments in their PRs:
1
In your Semgrep AppSec Platform account, click Rules > Policies to enter the Policies page. Under Modes , you can quickly see if you have existing rules in either Comment or Block mode.
2
Optional: To configure Semgrep Secrets rules, click the Secrets tab.
3
Optional: Use the filters to quickly find rules to set to Comment or Block.
4
Click the checkbox of the rules you want to set. You can use Ctrl + Click to select rules in bulk.
5
Click Change modes.
6
Click either Block or Comment.
You have successfully configured PR comments for Semgrep Code.
TIPRules in Block mode fail the CI job that runs on the PR. Depending on your workflow, this may prevent your PR from merging.
In addition to setting up the connection between Semgrep and Bitbucket, you must assign rules to Comment or Block mode. This customization enables you to:
Manage the amount of PR comments your developers receive.
Ensure that only rules that meet your criteria, such as high severity or high confidence rules, and result in findings involving valid secrets produce comments visible to developers, reducing noise.
The following instructions let you customize what findings or security issues your developers see as comments in their PRs:
1
In Semgrep AppSec Platform, go to Rules > Policies > Secrets.
2
Under Modes , you can see if you have existing rules in either Comment or Block mode. You can also use the filters to find rules you want to set to Comment or Block.
3
Click the checkbox of the rules you want to set. You can use Ctrl + Click to select rules in bulk.
4
Click Change modes.
5
Click either Block or Comment.
You have successfully configured PR comments for Semgrep Secrets.
Validation state policies allow you to define how Semgrep handles the following issues:
Invalid findings: the secret has been revoked, was never functional, or used for a custom or private endpoint that Semgrep can’t communicate with. For example, a Semgrep rule that tests GitHub credentials may return an invalid finding if Semgrep can’t communicate with an on-premise deployment.
Validation errors: Semgrep was unable to reach the secrets provider to test the validity of the credential, or Semgrep received an unexpected response from the API
To edit the policy for invalid secrets and errors:
1
In Semgrep AppSec Platform, go to Rules > Policies > Secrets.
2
Click Validation State Policies.
3
Choose the mode, either Comment or Block, that you want Semgrep to set for Invalid findings.
4
Choose the mode, either Comment or Block, that you want Semgrep to set for Validation errors.
TIPRules in Block mode fail the CI job that runs on the PR. Depending on your workflow, this may prevent your PR from merging.
To configure comments for Supply Chain, you must define a Supply Chain policy. This policy lets you set the specific conditions, such as transitivity and reachability, that trigger a comment. These conditions are unique to Supply Chain findings.See the Policies documentation for more information.
Receive comments in an access-controlled Bitbucket account
Bitbucket Premium provides access control features for content that your individual account owns. If you use this feature, you need to add several IP addresses into your allowlist.If you are behind a firewall, are using a virtual private network (VPN), or have network restrictions regarding access, you may need to add the following IP addresses to the ingress allowlist and egress allowlist:
# Ingress IP addresses (from Semgrep to your infrastructure)# and egress IP addresses (from your infrastructure to Semgrep)35.166.231.23552.35.248.24652.34.137.11044.225.64.41
Test that you are able to receive findings by manually triggering a scan through your CI provider.Receiving PR or MR comments may require additional steps depending on the custom configuration of your VPN or SCM (for example, if you use a static IP without a hostname). Reach out to Semgrep Support with any concerns.
INFOOnly rules set to the Comment and Block rule modes in the Policies page create PR comments.
You can customize the comments Semgrep leaves on your PR. Custom comments allow you to direct your teams to the resources they need to handle the vulnerabilities Semgrep identifies in their code.
A custom comment with instructions on how to obtain more information about a finding.
Custom comment configuration in Semgrep AppSec Platform.
4
Provide a custom comment for each Semgrep product whose findings you want to generate a PR comment. Semgrep supports Markdown and plaintext links in your message.
Enable Rule-defined fix in Bitbucket Cloud repositories
Autofix is a Semgrep feature in which rules contain suggested fixes to resolve findings.To enable Rule-defined fix for all projects in your Semgrep AppSec Platform organization, follow these steps:
1
In Semgrep AppSec Platform, go to Settings > General > Code.
2
Use the Rule-defined fix toggle to enable this feature.
