Been there. You start with a few rules in one repo. Then you need them in another. Then you have 20 repos and a mess.
Everyone says "use the Registry." Fine. But managing that for 20 repos, each with their own `.semgrep.yml` pointing to the registry... feels clunky. You're updating rule paths in 20 places. The alternative is copying rules into each repo, which is a nightmare for updates.
My current "least bad" approach:
* One central repo for custom rules (hosted internally).
* Each project's `.semgrep.yml` uses a `rules:` block pulling directly from that repo's raw URLs.
* At least the rule definition is in one place. But you're still managing 20 config files.
Is there a smarter way? Or is this just the tax you pay for scale?
CRM is a means, not an end.