/use/tools/gitlab/secure/Recent content in Secure on Software FactoryHugoen/use/tools/gitlab/secure/report/Mon, 01 Jan 0001 00:00:00 +0000/use/tools/gitlab/secure/report/<p>GitLab does not pull security findings from external scanners directly. The only ingestion mechanism is the <strong>security report artifact</strong>: a CI/CD job produces a JSON file and declares it under <code>artifacts: reports: &lt;type&gt;</code> in <code>.gitlab-ci.yml</code>. GitLab validates the file against its <a href="https://gitlab.com/gitlab-org/security-products/security-report-schemas" class="external-link" target="_blank" rel="noopener noreferrer">JSON schemas</a> , then surfaces findings in the Security Dashboard, Vulnerability Report, MR security widget, and Dependency List, depending on the report type.</p> <div class="admonition note"> <div class="admonition-header"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 576 512"><path d="M0 64C0 28.7 28.7 0 64 0L224 0l0 128c0 17.7 14.3 32 32 32l128 0 0 125.7-86.8 86.8c-10.3 10.3-17.5 23.1-21 37.2l-18.7 74.9c-2.3 9.2-1.8 18.8 1.3 27.5L64 512c-35.3 0-64-28.7-64-64L0 64zm384 64l-128 0L256 0 384 128zM549.8 235.7l14.4 14.4c15.6 15.6 15.6 40.9 0 56.6l-29.4 29.4-71-71 29.4-29.4c15.6-15.6 40.9-15.6 56.6 0zM311.9 417L441.1 287.8l71 71L382.9 487.9c-4.1 4.1-9.2 7-14.9 8.4l-60.1 15c-5.5 1.4-11.2-.2-15.2-4.2s-5.6-9.7-4.2-15.2l15-60.1c1.4-5.6 4.3-10.8 8.4-14.9z"/></svg> <span>Note</span> </div> <div class="admonition-content"> <p>The filename of the artifact does not determine its type. Only the <code>artifacts: reports:</code> key matters. A file named <code>anything.json</code> declared under <code>reports: sast</code> is processed as a SAST report.</p>