Semgrep Observability with OpenTelemetry

Semgrep is a great open source security and code validation tool. Semgrep revolves around rules like this: rules: - id: print-to-logger pattern: print($VAR) message: Use logging.info() instead of print() language: python severity: MEDIUM fix: logger.info($MSG) The rule above will raise a MEDIUM severity issue every time a use of print() is used in your Python code. It will also provide the recommended fix and even take the value inside the print statement and produce the fix content. Thus print("Hello world!") becomes logger.info("Hello world!") The rules.yaml file is then used to validate one or more (in this case) Python files: semgrep scan -f rules.yaml app.py Capturing Semgrep Output using the OpenTelemetry Collector Semgrep is capable of producing JSON output which means it's really easy to grab using the OpenTelemetry collector. Let's re-run the previous command with a few more flags to produce JSON: semgrep scan -f rules.yaml --json -o out.json app.py It produces single line JSO