feat(scanner): make reportFormat configurable

.families.yaml

@@ -97,6 +97,7 @@ secrets:
   scanners_config:
     gitleaks:
       binary_path: "/usr/local/bin/gitleaks"
+      report_format: "json"
 
 exploits:
   enabled: false

cli/state/testdata/effective-config.json

@@ -75,7 +75,8 @@
     "inputs": null,
     "scanners_config": {
       "gitleaks": {
-        "binary_path": ""
+        "binary_path": "",
+        "report_format": ""
       }
     }
   },

scanner/families/secrets/gitleaks/config/config.go

@@ -16,17 +16,34 @@
 package config
 
 const (
-	DefaultGitleaksBinary = "gitleaks"
+	defaultGitleaksBinary = "gitleaks"
+	defaultReportFormat   = "json"
 )
 
+var allowedFormats = map[string]bool{
+	"json":  true,
+	"csv":   true,
+	"junit": true,
+	"sarif": true,
+}
+
 type Config struct {
-	BinaryPath string `yaml:"binary_path" mapstructure:"binary_path" json:"binary_path"`
+	BinaryPath   string `yaml:"binary_path" mapstructure:"binary_path" json:"binary_path"`
+	ReportFormat string `yaml:"report_format" mapstructure:"report_format" json:"report_format"`
 }
 
 func (c *Config) GetBinaryPath() string {
 	if c.BinaryPath != "" {
 		return c.BinaryPath
 	}
 
-	return DefaultGitleaksBinary
+	return defaultGitleaksBinary
+}
+
+func (c *Config) GetReportFormat() string {
+	if c.ReportFormat != "" && allowedFormats[c.ReportFormat] {
+		return c.ReportFormat
+	}
+
+	return defaultReportFormat
 }

scanner/families/secrets/gitleaks/gitleaks.go

@@ -65,14 +65,15 @@ func (a *Scanner) Scan(ctx context.Context, sourceType common.InputType, userInp
 		_ = os.Remove(file.Name())
 	}()
 	reportPath := file.Name()
+	reportFormat := a.config.GetReportFormat()
 
 	fsPath, cleanup, err := familiesutils.ConvertInputToFilesystem(ctx, sourceType, userInput)
 	if err != nil {
 		return nil, fmt.Errorf("failed to convert input to filesystem: %w", err)
 	}
 	defer cleanup()
 
-	// gitleaks detect --source <source> --no-git -r <report-path> -f json --exit-code 0 --max-target-megabytes 50
+	// gitleaks detect --source <source> --no-git -r <report-path> -f <report-format> --exit-code 0 --max-target-megabytes 50
 	// nolint:gosec
 	args := []string{
 		"detect",
@@ -82,7 +83,7 @@ func (a *Scanner) Scan(ctx context.Context, sourceType common.InputType, userInp
 		"-r",
 		reportPath,
 		"-f",
-		"json",
+		reportFormat,
 		"--exit-code",
 		"0",
 		"--max-target-megabytes",