First class support for junit

[wyardley]

Given the number of other (some relatively uncommon) report formats, and the fact that tfsec supports junit natively, is there a reason why support for junit is only via the template in contrib vs. --format junit?

Not only is it much longer to write out using the template, but some distributions (e.g., alpine package, homebrew) don't seem to ship with the contrib templates included.

[AnaisUrlichs]

This is probably a question for @knqyf263

[knqyf263]

It is tough to maintain several formats on our end. We wanted to maintain basic formats like JSON only. It is debatable whether JUnit is basic or not.

[wyardley]

You support formats like “github”, "spdx", etc, which seem pretty specific / single purpose (admittedly, a lot of the other supported formats are a subset of JSON, which is probably somewhat easier to support than something xml-based like junit, and I recognize that if there aren't xml libs included already, that might add a certain amount of bloat).

But, junit is a pretty standard format for reporting on and tracking CI test results. Is one of the existing standard formats suitable for that purpose with, for example, CircleCI or Travis? I would imagine that junit is much more useful a format for more people than some of the currently available formats.

Also, for folks migrating from tfsec, it already supports this natively with the builtin report types.