Command line

Every command and flag, from proven --help.

proven --help prints this page's text. The page is written from the binary.

proven --help

proven — review a change

usage:
  proven scan [flags] [TARGET]
  proven ci [flags]
  proven verify [--public-key FILE] PACK
  proven --help
  proven --version

TARGET defaults to ".". proven ci reads GITHUB_EVENT_PATH, GITHUB_SHA and
GITHUB_BASE_REF. When no baseline flag or variable is set, the baseline is
the merge base of the pull request base and the head. With no baseline
commit, no event base SHA and no GITHUB_BASE_REF, ci exits 2.
With no head commit, ci exits 2: set GITHUB_SHA, or GITHUB_EVENT_PATH
with a head SHA. A base that cannot be resolved is exit 2: Proven could
not review.

flags:
  --text, --json, --sarif, --md
        format on standard output (PROVEN_OUTPUT_FORMAT, default text).
  --text-output, --json-output, --sarif-output, --md-output
        also write that format to a file
  -o, --output
        write the chosen format to a file instead of standard output (PROVEN_OUTPUT)
  --error, --no-error
        exit 1 when findings are reported (PROVEN_ERROR; scan default off, ci default on)
  --baseline-commit
        review only what changed since that commit (PROVEN_BASELINE_COMMIT, then SEMGREP_BASELINE_COMMIT, then SEMGREP_BASELINE_REF)
  --config
        a path to a Proven configuration file (PROVEN_CONFIG; proven.yaml in the target if present, else the defaults)
  --include, --exclude
        globs over changed paths (PROVEN_INCLUDE, PROVEN_EXCLUDE; comma-separated in the variable)
  --severity
        lowest severity reported: INFO, WARNING, ERROR (PROVEN_SEVERITY, default INFO)
  --timeout
        the whole review's time limit in seconds (PROVEN_TIMEOUT; default no deadline)
  --evidence-pack
        write one signed evidence pack (a tar) for this review; the private key is the file PROVEN_PACK_KEY names.
        proven verify checks it with the public key in PROVEN_PACK_PUBLIC_KEY, or --public-key
  PROVEN_LOG_DIR
        trace directory (default: the user cache, proven/logs, mode 0700).
        A directory that resolves inside the review target is refused.
  --sample
        sample reviewer, no network and no keys (SAMPLE_MODE=true)
  --quiet, --verbose
  --help, --version

environment only:
  PROVEN_POLICY
        a path to the organisation policy file, read before proven.yaml (docs/POLICY.md)

exit codes:
  0  review done; no findings, or findings without --error
  1  review done; findings, with --error (the default in ci)
  2  fatal error: proven could not review
  7  the configuration was refused when it loaded

proven scan --help

proven — review a change

usage:
  proven scan [flags] [TARGET]
  proven ci [flags]
  proven verify [--public-key FILE] PACK
  proven --help
  proven --version

TARGET defaults to ".". proven ci reads GITHUB_EVENT_PATH, GITHUB_SHA and
GITHUB_BASE_REF. When no baseline flag or variable is set, the baseline is
the merge base of the pull request base and the head. With no baseline
commit, no event base SHA and no GITHUB_BASE_REF, ci exits 2.
With no head commit, ci exits 2: set GITHUB_SHA, or GITHUB_EVENT_PATH
with a head SHA. A base that cannot be resolved is exit 2: Proven could
not review.

flags:
  --text, --json, --sarif, --md
        format on standard output (PROVEN_OUTPUT_FORMAT, default text).
  --text-output, --json-output, --sarif-output, --md-output
        also write that format to a file
  -o, --output
        write the chosen format to a file instead of standard output (PROVEN_OUTPUT)
  --error, --no-error
        exit 1 when findings are reported (PROVEN_ERROR; scan default off, ci default on)
  --baseline-commit
        review only what changed since that commit (PROVEN_BASELINE_COMMIT, then SEMGREP_BASELINE_COMMIT, then SEMGREP_BASELINE_REF)
  --config
        a path to a Proven configuration file (PROVEN_CONFIG; proven.yaml in the target if present, else the defaults)
  --include, --exclude
        globs over changed paths (PROVEN_INCLUDE, PROVEN_EXCLUDE; comma-separated in the variable)
  --severity
        lowest severity reported: INFO, WARNING, ERROR (PROVEN_SEVERITY, default INFO)
  --timeout
        the whole review's time limit in seconds (PROVEN_TIMEOUT; default no deadline)
  --evidence-pack
        write one signed evidence pack (a tar) for this review; the private key is the file PROVEN_PACK_KEY names.
        proven verify checks it with the public key in PROVEN_PACK_PUBLIC_KEY, or --public-key
  PROVEN_LOG_DIR
        trace directory (default: the user cache, proven/logs, mode 0700).
        A directory that resolves inside the review target is refused.
  --sample
        sample reviewer, no network and no keys (SAMPLE_MODE=true)
  --quiet, --verbose
  --help, --version

environment only:
  PROVEN_POLICY
        a path to the organisation policy file, read before proven.yaml (docs/POLICY.md)

exit codes:
  0  review done; no findings, or findings without --error
  1  review done; findings, with --error (the default in ci)
  2  fatal error: proven could not review
  7  the configuration was refused when it loaded

proven ci --help

proven — review a change

usage:
  proven scan [flags] [TARGET]
  proven ci [flags]
  proven verify [--public-key FILE] PACK
  proven --help
  proven --version

TARGET defaults to ".". proven ci reads GITHUB_EVENT_PATH, GITHUB_SHA and
GITHUB_BASE_REF. When no baseline flag or variable is set, the baseline is
the merge base of the pull request base and the head. With no baseline
commit, no event base SHA and no GITHUB_BASE_REF, ci exits 2.
With no head commit, ci exits 2: set GITHUB_SHA, or GITHUB_EVENT_PATH
with a head SHA. A base that cannot be resolved is exit 2: Proven could
not review.

flags:
  --text, --json, --sarif, --md
        format on standard output (PROVEN_OUTPUT_FORMAT, default text).
  --text-output, --json-output, --sarif-output, --md-output
        also write that format to a file
  -o, --output
        write the chosen format to a file instead of standard output (PROVEN_OUTPUT)
  --error, --no-error
        exit 1 when findings are reported (PROVEN_ERROR; scan default off, ci default on)
  --baseline-commit
        review only what changed since that commit (PROVEN_BASELINE_COMMIT, then SEMGREP_BASELINE_COMMIT, then SEMGREP_BASELINE_REF)
  --config
        a path to a Proven configuration file (PROVEN_CONFIG; proven.yaml in the target if present, else the defaults)
  --include, --exclude
        globs over changed paths (PROVEN_INCLUDE, PROVEN_EXCLUDE; comma-separated in the variable)
  --severity
        lowest severity reported: INFO, WARNING, ERROR (PROVEN_SEVERITY, default INFO)
  --timeout
        the whole review's time limit in seconds (PROVEN_TIMEOUT; default no deadline)
  --evidence-pack
        write one signed evidence pack (a tar) for this review; the private key is the file PROVEN_PACK_KEY names.
        proven verify checks it with the public key in PROVEN_PACK_PUBLIC_KEY, or --public-key
  PROVEN_LOG_DIR
        trace directory (default: the user cache, proven/logs, mode 0700).
        A directory that resolves inside the review target is refused.
  --sample
        sample reviewer, no network and no keys (SAMPLE_MODE=true)
  --quiet, --verbose
  --help, --version

environment only:
  PROVEN_POLICY
        a path to the organisation policy file, read before proven.yaml (docs/POLICY.md)

exit codes:
  0  review done; no findings, or findings without --error
  1  review done; findings, with --error (the default in ci)
  2  fatal error: proven could not review
  7  the configuration was refused when it loaded

proven --help

proven scan --help

proven ci --help

On this page