Using Artifact Reports

1. Using JUnit Reports

Property	Description	Default	Notes
junit_reports	Path to JUnit report files	`none`	Supports glob patterns like `*/.xml`
junit_reports.fail_on_missing	Fail job if no JUnit report files are found	`false`	Set to `true` to enforce report existence
junit_reports.artifact_name	Name of the artifact created from JUnit reports	`junit`	Used in job artifacts and UI display

Example: Configuring JUnit Reports in .gitlab-ci.yml

test:
  script:
    - mvn test
  artifacts:
    reports:
      junit: **/target/surefire-reports/*.xml

Note: JUnit reports must be in XML format and follow the standard JUnit schema to be parsed correctly.

2. Using Coverage Reports

Property	Values	Description
coverage	`0.0` to `1.0`	Coverage percentage as a decimal (e.g., `0.85` for 85%)
coverage_format	`lcov`, `cobertura`, `jacoco`	Format of the coverage report file
coverage_path	File path pattern	Path to coverage report file(s) (e.g., `coverage/lcov.info`)

Example: Configuring Coverage Report in .gitlab-ci.yml

job_name:
  script:
    - npm test
  artifacts:
    reports:
      coverage:
        coverage_format: lcov
        coverage_path: coverage/lcov.info

Note: Coverage reports are only processed if the artifacts section includes a reports block with valid configuration.

Warning: If coverage_path does not match any files, the job will fail with an error.

3. Using Code Quality Reports

Property	Description	Values	Notes
code_quality.artifacts	Path to the code quality report file	`reports/code-quality.json`	Default location for GitLab's code quality report
code_quality.format	Format of the code quality report	`checkmarx`, `sonarqube`, `eslint`	Supported formats for code quality analysis

Example: Configuring Code Quality Report in .gitlab-ci.yml

job_name:
  script:
    - npm run lint
    - npm run test:coverage
  artifacts:
    reports:
      code_quality: reports/code-quality.json

Note: The code quality report must be in a supported format to be parsed and displayed correctly in GitLab.

4. Using SAST Reports

Property	Values	Description
artifacts.reports.sast	`string`	Path to SAST report file (e.g., `gl-sast-report.json`)
artifacts.reports.sast.enabled	`boolean`	Enable SAST report processing (default: `false`)
artifacts.reports.sast.path	`string`	Path to SAST report file (e.g., `gl-sast-report.json`)

Example: Configure SAST Report in GitLab CI

variables:
  SAST_REPORT_PATH: gl-sast-report.json

sast:
  stage: test
  image: registry.gitlab.com/gitlab-org/security-products/analyzers/sast:latest
  script:
    - sast
  artifacts:
    reports:
      sast: $SAST_REPORT_PATH

Note: SAST reports must be in the GitLab Security Report format to be processed correctly.

Warning: Ensure that the SAST analyzer image supports the project's language and dependencies.

Report Field	Description	Example Value
version	Version of the report format	`"2.0"`
vulnerabilities	List of identified vulnerabilities	`[{...}]`
scanner	Tool used to generate the report	`"GitLab SAST"`

5. Using Dependency Scanning Reports

Field	Description	Example
dependency_scanning	Enables dependency scanning in the job	`dependency_scanning:`
report_format	Format of the report (e.g., `json`, `xml`)	`json`
report_path	Path to the generated report file	`dependency-scanning-report.json`

Example: Configuring Dependency Scanning

job_name:
  stage: test
  script:
    - echo "Running dependency scan"
  artifacts:
    reports:
      dependency_scanning: dependency-scanning-report.json

Note: The dependency scanning report must be in a supported format like JSON or XML to be processed by GitLab.

6. Using Container Scanning Reports

Property	Description	Values	Notes
container_scanning	Enables container scanning in the job	`true`	Requires GitLab Runner with `container_scanning` support
report_format	Format of the report output	`json`, `html`	Default is `json`
report_path	Path to the generated report file	`path/to/report.json`	Used to publish or store the report

Example: Container Scanning Job Configuration

scan-container:
  image: gitlab/gitlab-runner:latest
  services:
    - name: gitlab/gitlab-container-scanner:latest
  script:
    - container-scanner scan --format json --output report.json
  artifacts:
    reports:
      container_scanning: report.json

Note: Container scanning requires GitLab Runner version 15.0 or higher with container scanning support enabled.

7. Using DAST Reports

Property	Description	Values
dast_report	Path to the DAST report file	`gl-dast-report.json`
dast_report_format	Format of the DAST report	`json`, `xml`

Example: DAST Report Configuration

variables:
  DAST_REPORT_PATH: "gl-dast-report.json"
  DAST_REPORT_FORMAT: "json"

dast:
  stage: security
  script:
    - echo "Running DAST scan..."
    - dast-scan --output-file $DAST_REPORT_PATH
  artifacts:
    reports:
      dast: $DAST_REPORT_PATH

Note: Ensure the DAST report is generated in a supported format (JSON or XML) to enable proper parsing and display in GitLab.

8. Using License Reports

Property	Description	Values	Notes
license_report	Enables license report generation	`true`	Requires `artifacts` to be configured
license_report.format	Output format of the license report	`json`, `csv`	Default: `json`
license_report.output_path	Path where the license report is saved	`string`	Default: `license_report.json`

Example: License Report Configuration

job_name:
  script:
    - npm install
  license_report:
    format: json
    output_path: "reports/license-report.json"
  artifacts:
    reports:
      license: "reports/license-report.json"

Note: License reports are generated using the license-report tool or similar, and must be configured in your project's build process.

9. Using dotenv Reports

Property	Description	Values	Notes
dotenv	Path to the dotenv file	`.env`	Default path to the dotenv file
report	Report type to generate	`dotenv`	Specifies that the report is a dotenv file

Example: dotenv Report Configuration

job_name:
  script:
    - echo "Generating dotenv report"
  artifacts:
    reports:
      dotenv: dotenv-report.env

Note: The dotenv report is used to store environment variables in a structured format for use in downstream jobs or services.

10. Using Terraform Reports

Property	Description	Values	Notes
terraform_report	Enables Terraform report generation	`true`	Requires `terraform` to be installed in the job
terraform_report.path	Path to Terraform state file	`terraform.tfstate`	Relative to job workspace
terraform_report.output	Output format for report	`json`, `hcl`	Defaults to `json`

Example: Configuring Terraform Report

job_name:
  script:
    - terraform init
    - terraform plan -out=tf.plan
    - terraform show -json tf.plan > tf_report.json
  artifacts:
    reports:
      terraform_report: true

Note: Terraform reports are generated using terraform show command and stored as artifacts in GitLab.