---
id: secscanner2junit
version: "1.1.0"
license: GPL-3.0-only
license_treatment: copyleft
maintenance: active
---

# secscanner2junit — Convert Security Scanner Output to JUnit Format

License: copyleft · Maintenance: active · Downloads: 116.5K/mo

## What it is and what it does

SecScanner2JUnit is a command-line tool that bridges GitLab's free-tier security scanning gap by converting native security scanner output into JUnit XML format. GitLab's free tier runs security scans (SAST, secret detection, container scanning, infrastructure-as-code scanning) but only displays results in merge requests on the Ultimate tier; this tool lets you work around that limitation by converting the JSON reports to JUnit format and uploading them as test reports, which GitLab displays in merge requests regardless of tier.

The tool accepts four report types (sast, secrets, container_scanning, maven_dependency_check), reads the JSON output from GitLab's security templates, and writes JUnit XML. It also supports suppression rules via a YAML config file to filter out known or accepted vulnerabilities. It's designed for GitLab CI/CD pipelines and is available both as a pip package and a Docker image.

Use it for:

- Display SAST findings in GitLab merge requests on free tier by converting semgrep or brakeman reports to JUnit.
- Surface secret detection results in merge requests without upgrading to Ultimate tier.
- Aggregate container scanning vulnerabilities as JUnit reports in CI/CD pipelines.
- Suppress known vulnerabilities from security reports using a config file before conversion.
- Run security scanning in Docker-based CI without pip by using the logchange/secscanner2junit image.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Converts GitLab security scanner output (SAST, secrets, container scanning, dependency checks) to JUnit XML format for display in merge requests on the free tier.

Yes, if you use GitLab's free tier and want security scan results visible in merge requests. The tool is actively maintained, has low install friction, and solves a specific GitLab limitation. GPLv3 copyleft is standard for security tooling and poses no barrier for internal use. No known vulnerabilities.

## Install

pip install secscanner2junit
uv add secscanner2junit
poetry add secscanner2junit

## Installing secscanner2junit

Before you install: Low friction: pure Python wheel with four common runtime dependencies (junit-xml, PyYAML, pytest, setuptools). Active maintenance with recent commits; last release 2025-02-08.

License in practice: GPLv3 copyleft license; you may use and modify the package freely, but any derivative work or distribution must also be licensed under GPLv3.

Quickstart:

pip install SecScanner2JUnit
ss2ju secrets gl-secret-detection-report.json gl-secret-detection-report.xml

Requires Python 3.10 or later; input JSON must be a valid GitLab security scanner report.

Verify before relying:

- Whether the tool handles all edge cases in GitLab's security report schema across different scanner versions.
- Performance characteristics when processing large security reports.

## Package facts

- License: GPL-3.0-only (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 116.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

gitlab security report to junit, convert sast output junit, gitlab free tier security scanning, security scanner xml conversion, gitlab ci junit report generation, gitlab-ci, security-scanning, junit-reporting

[View on SkillFed](https://skillfed.io/packages/secscanner2junit) · [View on PyPI](https://pypi.org/project/secscanner2junit/)