version v8.0.
For up-to-date documentation, see the
latest version.
Security Report
4 minute read
GitLab does not pull security findings from external scanners directly.
The only ingestion mechanism is the security report artifact:
a CI/CD job produces a JSON file and declares it under artifacts: reports: <type> in .gitlab-ci.yml.
GitLab validates the file against its JSON schemas
, then surfaces findings
in the Security Dashboard, Vulnerability Report, MR security widget, and Dependency List,
depending on the report type.
The filename of the artifact does not determine its type.
Only the artifacts: reports: key matters.
A file named anything.json declared under reports: sast is processed as a SAST report.
Supported report types
artifacts: reports: key | Conventional filename | Where findings appear |
|---|---|---|
sast | gl-sast-report.json | Security Dashboard, MR widget, Vulnerability Report |
dependency_scanning | gl-dependency-scanning-report.json | Dependency List, Security Dashboard, MR widget |
container_scanning | gl-container-scanning-report.json | Security Dashboard, MR widget |
license_scanning | gl-licenses-report.json | License Compliance Dashboard |
cyclonedx | gl-sbom-*.cdx.json | Continuous Dependency Scanning (GitLab 17+) |
sarif | *.sarif | MR widget only (not the Security Dashboard) |
The canonical JSON schemas for each type are maintained by GitLab (see References ).
artifacts: reports: sarif is accepted by GitLab but populates the MR widget only.
Findings declared this way never reach the Security Dashboard or Vulnerability Report.
Use a typed report (sast, dependency_scanning, …) for full dashboard coverage.
Integration matrix: Software Factory tools
The table below summarises what each Software Factory security tool can currently produce as a GitLab report artifact.
| Tool | sast | dependency_scanning | cyclonedx (SBOM) | sarif (MR only) |
|---|---|---|---|---|
| SonarQube | ✅ (vulnerabilities only) | n/a | n/a | ❌ |
| Coverity (Connect) | ⚠️ (post-scan converter) | n/a | n/a | ❌ |
| Black Duck SCA | n/a | ✅ (Bridge CLI required) | ✅ | ❌ |
| JFrog Xray | n/a | ❌ | ✅ | ✅ |
Legend: ✅ supported · ⚠️ possible with limitations · ❌ not available · n/a: out of scope.
Tool notes
SonarQube
SonarQube produces a sast artifact natively (Developer Edition+).
Limitations:
- Only vulnerability issues are exported; code quality findings are not included.
- SonarQube has no SARIF export. SARIF is import-only in SonarQube. A native SARIF export for code quality is a long-standing community request with no shipping date.
Coverity (Connect)
There is no native path from Coverity Connect to a GitLab report artifact.
The Black Duck Bridge CLI REPORTS_GITLAB_CREATE parameter exists only for Polaris and Black Duck SCA,
not for Coverity Connect.
The documented workaround (How to Display Coverity Results in GitLab Security Dashboard
)
uses a post-scan custom Python script: export results with cov-format-errors --json-output-v10,
then convert to GitLab sast format.
The vendor’s converter derives the vulnerability ID from the line number. Any code change above a finding regenerates its ID, causing previously dismissed findings to reappear as new in the next pipeline run.
Alternative: a SARIF export exists (cov-format-sarif-for-github.js) but is tailored for GitHub
and requires GitHub-specific context variables; it is not usable as-is.
Black Duck SCA
Black Duck SCA can produce a dependency_scanning artifact via the Bridge CLI.
The Software Factory’s NextGen Black Duck templates do not use the Bridge CLI,
so this path is not available out of the box and would require reworking the templates.
JFrog Xray
Limitations:
- There is no working path to a
dependency_scanningartifact: no official converter exists, and the communitysarif-converterdoes not support this target type. - A native SARIF output exists (
jf audit --format=sarif) but populates the MR widget only and has known SARIF v2.1.0 compliance issues.
The SARIF converter path
A cross-tool strategy is possible: each tool exports SARIF, then a single converter
transforms it to a typed GitLab report.
The community sarif-converter
(MIT license) supports two targets:
sast and codequality.
This covers code-level findings but not SCA: there is no dependency_scanning target.
References
| Resource | Maintained by | Purpose |
|---|---|---|
| GitLab Security Report Schemas | GitLab (official) | JSON schemas + validation tooling |
| sarif-converter | Community (MIT) | Any SARIF → GitLab sast or codequality |
| Black Duck Bridge CLI | Black Duck (official) | Coverity SAST + Black Duck SCA → GitLab |
| Black Duck Security Scan templates | Black Duck (official) | GitLab CI templates for all BD products |
| SonarQube Vulnerability Reporting | Sonar (official) | SonarQube Dev Ed+ → GitLab sast |