Enable source code manager code access

Some Semgrep features require additional levels of code access. You can grant these permissions to Semgrep by assigning additional scopes to the access token that facilitates communication between Semgrep and the source code manager (SCM). The following table shows the minimum scope needed to enable the required code access level.

Required SCM code access scopes

SCM	Read access scope	Write access scope
Azure DevOps	code:read	code:write
Bitbucket Cloud	repository:read pullrequest:read	repository:write pullrequest:write
Bitbucket Data Center	repository:read	repository:write
GitHub.com and Github Enterprise	contents:read	contents:write
GitLab and Gitlab Self-Managed	read_repository	write_repository

Grant code access to Semgrep with a private GitHub app

If you already have a private Semgrep GitHub app set up and configured for your deployment that doesn’t have code access enabled, follow these steps to update the app and grant code access to Semgrep.

APP SLUG

To find the name of your app slug:

1. Go to Settings > Source code managers.
2. Find the panel for your source code manager. The app slug is listed immediately following the name of the source code manager.

1. Navigate to the GitHub Application permissions and events page. GitHub Enterprise users must replace the https://github.com base URL with the base URL of the GitHub Enterprise instance.
   i. For organization accounts, go to https://github.com/organizations/ORGANIZATION_NAME/settings/apps/APP_SLUG/permissions.
   ii. For user accounts, go to https://github.com/settings/apps/APP_SLUG/permissions

2. Expand Repository Permissions.

3. Under Contents, change the access level to Read and write. If you don’t want to grant write permissions, change the access level to Read.

4. Click Save Changes.

5. At this point, GitHub sends you or your GitHub admin an email to approve the permissions changes. Once approved, Semgrep has code access to your GitHub instance.

Grant code access to Semgrep with an access token

If you onboarded your repositories using an access token, then you can follow these steps to grant code access to Semgrep.

Azure DevOps Cloud

1. Navigate to the Azure DevDps access token settings page: https://dev.azure.com/ORGANIZATION_NAME/_usersSettings/tokens.

2. Click New token to launch the Create a new personal access token dialog. Ensure that you assign the Code: Read and Code: Write scopes to the token, in addition to any other scopes you may need for other features you’ve enabled for your Semgrep deployment. Create the token, and copy its value.

3. Return to Semgrep AppSec Platform, and go to Settings > Source code managers.

4. Find the connection associated with your organization, and click Update access token.

5. Paste in your new access token.

6. Click Save.

Bitbucket Cloud

1. Navigate to the Bitbucket Cloud access token settings page: https://bitbucket.org/WORKSPACE/workspace/settings/access-keys.

2. Create a new access token and ensure that you assign the repository:read, pullrequest:read, repository:write, and pullrequest:write scopes to the token, in addition to any other scopes you may need for other features you’ve enabled for your Semgrep deployment. Create the token, and copy the token’s value.

3. Return to Semgrep AppSec Platform, and go to Settings > Source code managers.

4. Find the Bitbucket connection associated with your workspace, and click Update access token.

5. Paste in your new access token.

6. Click Save.

Bitbucket Data Center

1. Navigate to the Bitbucket Data Center access token settings page: BITBUCKET_BASE_URL/plugins/servlet/access-tokens/projects/PROJECT.

2. Create a new HTTP access token, ensuring that you assign the repository:read and repository:write scopes to the token, along with any other scopes or permissions you may need for other features you’ve enabled for your Semgrep deployment. Copy the token’s value.

3. Return to Semgrep AppSec Platform, and go to Settings > Source code managers.

4. Find the Bitbucket connection associated with your workspace, and click Update access token.

5. Paste in your new access token.

6. Click Save.

GitHub

1. Navigate to the GitHub personal access token settings page: https://github.com/settings/personal-access-tokens. GitHub Enterprise users must replace the https://github.com base URL with the base URL of the GitHub Enterprise instance.

2. Click Generate new token.

3. Under Repository access, select either All repositories or Only select repositories. If you choose Only select repositories, select the repositories that this token is used with.

4. Under Contents, set the access level to Read and write.

5. Click Generate token and copy its value.

6. Return to Semgrep AppSec Platform, and go to Settings > Source code managers.

7. Find the GitHub connection associated with your org, and click Update access token.

8. Paste in your new access token.

9. Click Save.

GitLab

1. Navigate to the GitLab access token settings page: https://gitlab.com/groups/GROUP/-/settings/access_tokens.

2. Create a new access token, ensuring that you add the read_repository and write_repository scopes, along with any other scopes or permissions you may need for other features you’ve enabled for your Semgrep deployment. Copy the token’s value. Copy the token’s value.

3. Return to Semgrep AppSec Platform, and go to Settings > Source code managers.

4. Find the GitLab connection associated with your group, and click Update access token.

5. Paste in your new access token.

6. Click Save.