reference Flags

--gitlab-sast-output

Accepted by
opengrep scan, opengrep ci
Value
FILE
See also
--gitlab-sast, --output

Writes the GitLab SAST report that --gitlab-sast prints to FILE, in addition to the output on standard output. In a GitLab CI job, artifacts:reports:sast can name this file.

The flag can be repeated to write several files. The file is written even when the scan finds nothing.

Examples

A report for GitLab

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan --config rule.yaml --gitlab-sast-output gl-sast-report.json app.py > /dev/null 2>&1
$ jq . gl-sast-report.json
{
  "$schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/sast-report-format.json",
  "version": "15.0.4",
  "scan": {
    "start_time": "2026-09-15T09:12:22",
    "end_time": "2026-09-15T09:12:22",
    "analyzer": {
      "id": "opengrep",
      "name": "Opengrep",
      "url": "https://opengrep.dev",
      "version": "X.Y.Z",
      "vendor": {
        "name": "Opengrep"
      }
    },
    "scanner": {
      "id": "opengrep",
      "name": "Opengrep",
      "url": "https://opengrep.dev",
      "version": "X.Y.Z",
      "vendor": {
        "name": "Opengrep"
      }
    },
    "version": "X.Y.Z",
    "status": "success",
    "type": "sast"
  },
  "vulnerabilities": [
    {
      "id": "752d5925-3fdf-44e8-5075-75f6f0d3364c",
      "category": "sast",
      "cve": "app.py:568470d013cd12e4f388206520da39ab9a4e4c3c6b95846cbc281abc1ba3c959:find-eval",
      "message": "found eval",
      "description": "found eval",
      "severity": "Medium",
      "scanner": {
        "id": "opengrep",
        "name": "Opengrep",
        "vendor": {
          "name": "Opengrep"
        }
      },
      "location": {
        "file": "app.py",
        "start_line": 1,
        "end_line": 1
      },
      "identifiers": [
        {
          "type": "opengrep_type",
          "name": "Opengrep - find-eval",
          "value": "find-eval",
          "url": "not available"
        }
      ],
      "flags": [],
      "details": {}
    }
  ]
}