secscanner2junit

What it is and what it does

SecScanner2JUnit is a command-line tool that bridges GitLab's free-tier security scanning gap by converting native security scanner output into JUnit XML format. GitLab's free tier runs security scans (SAST, secret detection, container scanning, infrastructure-as-code scanning) but only displays results in merge requests on the Ultimate tier; this tool lets you work around that limitation by converting the JSON reports to JUnit format and uploading them as test reports, which GitLab displays in merge requests regardless of tier.

The tool accepts four report types (sast, secrets, container_scanning, maven_dependency_check), reads the JSON output from GitLab's security templates, and writes JUnit XML. It also supports suppression rules via a YAML config file to filter out known or accepted vulnerabilities. It's designed for GitLab CI/CD pipelines and is available both as a pip package and a Docker image.

Use it for:

• Display SAST findings in GitLab merge requests on free tier by converting semgrep or brakeman reports to JUnit.
• Surface secret detection results in merge requests without upgrading to Ultimate tier.
• Aggregate container scanning vulnerabilities as JUnit reports in CI/CD pipelines.
• Suppress known vulnerabilities from security reports using a config file before conversion.
• Run security scanning in Docker-based CI without pip by using the logchange/secscanner2junit image.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Converts GitLab security scanner output (SAST, secrets, container scanning, dependency checks) to JUnit XML format for display in merge requests on the free tier.

Yes, if you use GitLab's free tier and want security scan results visible in merge requests. The tool is actively maintained, has low install friction, and solves a specific GitLab limitation. GPLv3 copyleft is standard for security tooling and poses no barrier for internal use. No known vulnerabilities.

Install

secscanner2junit on PyPI

pip install secscanner2junit

uv add secscanner2junit

poetry add secscanner2junit

Installing secscanner2junit

Before you install

Low friction: pure Python wheel with four common runtime dependencies (junit-xml, PyYAML, pytest, setuptools). Active maintenance with recent commits; last release 2025-02-08.

License in practice

GPLv3 copyleft license; you may use and modify the package freely, but any derivative work or distribution must also be licensed under GPLv3.

Quickstart

pip install SecScanner2JUnit
ss2ju secrets gl-secret-detection-report.json gl-secret-detection-report.xml

Requires Python 3.10 or later; input JSON must be a valid GitLab security scanner report.

Verify before relying

• Whether the tool handles all edge cases in GitLab's security report schema across different scanner versions.
• Performance characteristics when processing large security reports.

Package facts

Evidence: secscanner2junit-1.1.0-py3-none-any.whl

Tags

More Quality Assurance packages