Semgrep "SEMGREP_APP_TOKEN not set" in CI

By Daniel Zoghalchali·Latchkey

The semgrep ci command connects to Semgrep Cloud (AppSec Platform) to pull your configured rules and upload results. Without SEMGREP_APP_TOKEN in the environment, it cannot authenticate and stops.

What this error means

The Semgrep step fails with "SEMGREP_APP_TOKEN is not set" or "You are not logged in", typically when using semgrep ci rather than a local --config.

You are not logged in! Run `semgrep login` before using `semgrep ci`,
or set SEMGREP_APP_TOKEN in your environment.

Common causes

The token secret is not exposed to the step

The workflow never sets SEMGREP_APP_TOKEN from a secret, so semgrep ci has no credentials.

Using semgrep ci without a Cloud account

semgrep ci expects a Cloud policy; without a token you must use semgrep scan --config instead.

How to fix it

Set SEMGREP_APP_TOKEN from a secret

1. Add the Semgrep app token as a repository or org secret.
2. Expose it as SEMGREP_APP_TOKEN in the step env.
3. Re-run so semgrep ci authenticates.

- run: semgrep ci
  env:
    SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

Run without Cloud using a local config

If you do not use Semgrep Cloud, switch to semgrep scan with an explicit config so no token is needed.

- run: semgrep scan --config auto --error

How to prevent it

• Store the Semgrep token as a secret and inject it in the step env.
• Choose semgrep ci (Cloud) or semgrep scan --config (local) consistently.
• Fail fast if the token is unexpectedly empty.

Frequently asked questions

Related guides

References

• GitHub Actions documentation