Skip to content

Add status, start_time, end_time to SAST, CS, DS reports

Problem to solve

SAST, Container Scanning, and Dependency Scanning analyzers don't the n ew JSON fields introduced in gitlab-org/security-products/security-report-schemas!13 (merged): they don't report their status and execution time.

Intended users

Proposal

Add scan.status, scan.start_time, scan.end_time to the JSON security reports generated by SAST, Container Scanning, and Dependency Scanning analyzers.

Depending on how the analyzer project is implemented, the change has to be implemented in the command package of the common library or in the analyzer project itself. Currently the following analyzer projects don't use the command package: nodejs-scan, secrets, gemnasium, and klar.

Implementation plan

Further details

Permissions and Security

N/A

Documentation

scan.status, scan.start_time, and scan.end_time are already documented in the JSON schemas.

Availability & Testing

To be tested as part of QA, when comparing generated reports with expected ones.

What does success look like, and how can we measure that?

All aforementioned analyzers generate these extra fields in their reports.

What is the type of buyer?

GitLab Ultimate

Is this a cross-stage feature?

Yes, and this issue covers all analyzer projects except DAST.

Links / references

Edited by Adam Cohen