grep -f: Read Patterns From a File
grep -f FILE reads patterns from a file, one per line, and matches a line if any pattern hits.
When the list of things to match lives in a file (a denylist of secrets, a set of banned APIs), -f points grep at that file instead of inlining every pattern.
What it does
grep -f FILE (--file) reads newline-separated patterns from FILE and matches as if each were given with -e. Combined with -F it becomes a fast fixed-string denylist matcher. An empty patterns file matches nothing (and a file with a single blank line matches every line).
Common usage
# match any banned API listed in denylist.txt
grep -Ff denylist.txt src/**/*.go
# find lines containing any known-bad token
grep -nf patterns.txt build.log
# combine with -v to keep only allowed lines
grep -vf ignore-patterns.txt report.txtOptions
| Flag | What it does |
|---|---|
| -f FILE / --file=FILE | Read patterns from FILE, one per line |
| -F | Treat each line as a fixed string (fast denylist) |
| -w | Require whole-word matches of each pattern |
| -v | Invert: keep lines matching none of the patterns |
In CI
A patterns file keeps a secret-scanning or banned-API check in version control where it can be reviewed. Pair -f with -F for speed and to avoid one bad denylist line being misread as a regex. Validate the file is non-empty before relying on it.
Common errors in CI
A blank line in the patterns file matches every input line, so a check suddenly "matches everything" usually has an empty line in the file; strip blanks first (grep -v "^$"). An empty patterns file matches nothing and grep exits 1, which can fail set -e; guard with || true or verify the file has content. Trailing CRLF in the file turns each pattern into "pattern\r", which then fails to match Unix-line-ending input.