reference > Flags

--junit-xml

Accepted by

opengrep scan, opengrep ci

See also

--json, --sarif, --gitlab-sast, --output, --junit-xml-output

Prints the findings as JUnit XML, a format that most CI systems display as test results. The document holds one testsuite named opengrep results, and one testcase per finding: name is the rule id, classname and file are the path, and line is the line where the match starts. Each test case holds a failure whose type is the severity of the rule and whose message is its message, with the matched lines as its content. A scan without findings appears as a test run without failures. The time attributes hold the duration of the scan.

--junit-xml-output writes the same document to a file.

## Examples

### The shape of the report

rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING

eval(1)

The sed command removes the time attributes, which differ from run to run.

$ opengrep scan --config rule.yaml --junit-xml app.py 2>/dev/null | sed 's/ time="[^"]*"//g'
<?xml version="1.0" encoding="UTF-8"?>
<testsuites disabled="0" errors="0" failures="1" tests="1"><testsuite disabled="0" errors="0" failures="1" name="opengrep results" skipped="0" tests="1"><testcase name="find-eval" classname="app.py" file="app.py" line="1"><failure type="WARNING" message="found eval">eval(1)</failure></testcase></testsuite></testsuites>