Semgrep "invalid rule schema" for a secrets ruleset in CI

By Kaveh Alemi·Latchkey

semgrep validates every rule before running. A custom secrets rule with a bad field, a missing pattern, or an unknown key fails schema validation and the whole scan aborts.

What this error means

semgrep exits with "invalid rule schema" or "Invalid rule" and names the rule ID and the offending field, before any file is scanned.

[ERROR] Invalid rule schema
rules.0: rule 'detect-token' is missing required key 'message'
  in rules/secrets.yml

Common causes

A malformed custom rule

A required key such as id, message, severity, or pattern is missing or misspelled in the rule YAML.

An unknown or deprecated field

A key not recognized by the current semgrep version, or one removed in an upgrade, fails schema validation.

How to fix it

Fix the rule to match the schema

1. Read the rule ID and field named in the error.
2. Add the missing required key or correct the field name.
3. Validate the rules before scanning.

rules:
  - id: detect-token
    message: Hardcoded token detected
    severity: ERROR
    languages: [python]
    pattern: TOKEN = "..."

Validate rules in CI

Run the validator so a broken rule fails fast with a clear message instead of during the scan.

semgrep --validate --config rules/secrets.yml

How to prevent it

• Validate custom rules with --validate in CI.
• Pin the semgrep version so schema expectations are stable.
• Keep required keys (id, message, severity, pattern) on every rule.

Frequently asked questions

Related guides

References

• GitHub Actions documentation