{"categories":[{"label":"Quality Assurance","url":"https://skillfed.io/packages/category/software-development-quality-assurance/4"}],"enrichment":{"capability":"Converts GitLab security scanner output (SAST, secrets, container scanning, dependency checks) to JUnit XML format for display in merge requests on the free tier.","skillfed_tags":["gitlab-ci","security-scanning","junit-reporting"],"use_cases":["Display SAST findings in GitLab merge requests on free tier by converting semgrep or brakeman reports to JUnit.","Surface secret detection results in merge requests without upgrading to Ultimate tier.","Aggregate container scanning vulnerabilities as JUnit reports in CI/CD pipelines.","Suppress known vulnerabilities from security reports using a config file before conversion.","Run security scanning in Docker-based CI without pip by using the logchange/secscanner2junit image."],"what_it_does":"SecScanner2JUnit is a command-line tool that bridges GitLab's free-tier security scanning gap by converting native security scanner output into JUnit XML format. GitLab's free tier runs security scans (SAST, secret detection, container scanning, infrastructure-as-code scanning) but only displays results in merge requests on the Ultimate tier; this tool lets you work around that limitation by converting the JSON reports to JUnit format and uploading them as test reports, which GitLab displays in merge requests regardless of tier.\n\nThe tool accepts four report types (sast, secrets, container_scanning, maven_dependency_check), reads the JSON output from GitLab's security templates, and writes JUnit XML. It also supports suppression rules via a YAML config file to filter out known or accepted vulnerabilities. It's designed for GitLab CI/CD pipelines and is available both as a pip package and a Docker image.","worth_installing":"Yes, if you use GitLab's free tier and want security scan results visible in merge requests. The tool is actively maintained, has low install friction, and solves a specific GitLab limitation. GPLv3 copyleft is standard for security tooling and poses no barrier for internal use. No known vulnerabilities."},"id":"secscanner2junit","links":{"html":"https://skillfed.io/packages/secscanner2junit","md":"https://skillfed.io/packages/secscanner2junit.md","pypi":"https://pypi.org/project/secscanner2junit/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2025-02-08","license_spdx":null,"license_treatment":"copyleft","name":"secscanner2junit","python_support":"supports_current","summary":"Convert Security Scanner Output to JUnit Format"},"popularity":{"monthly_downloads":116452,"position":12203,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"1.1.0"}