Semgrep "Invalid rule schema" / "Invalid YAML" in CI

By Daniel Zoghalchali·Latchkey

Semgrep validates rule files before scanning. A YAML syntax error, or a rule missing a required key (id, pattern, message, severity, languages), makes Semgrep reject the config and stop before analysis.

What this error means

Semgrep fails with "Invalid rule schema" or "Invalid YAML file" naming the rule file and the missing or wrong field.

Invalid rule schema at rules/custom.yaml:
  rules.0: 'message' is a required property
Invalid YAML file: rules/custom.yaml

Common causes

A required rule field is missing

Custom rules must include id, message, severity, languages, and a pattern; omitting one fails schema validation.

YAML syntax errors in the rule file

Bad indentation, tabs, or an unquoted special character make the file unparseable.

How to fix it

Validate the rule file

1. Run semgrep --validate against the rule directory.
2. Add the missing required field the error names.
3. Fix YAML indentation and quoting, then re-run.

semgrep --validate --config rules/

Use a complete rule template

Ensure each rule has all required keys before committing.

rules:
  - id: no-eval
    pattern: eval(...)
    message: Avoid eval on untrusted input
    severity: ERROR
    languages: [python]

How to prevent it

• Run semgrep --validate in CI or pre-commit for rule changes.
• Keep a rule template with all required fields.
• Lint YAML to catch indentation and quoting errors early.

Frequently asked questions

Related guides

References

• GitHub Actions documentation