How to write reports to file and summary to stdout?

[jasonkarns]

I'm trying to set up a brakeman invocation on CI that writes to json and html, while also printing the text report to stdout.

However, a bunch of the options seem to have impact on other options.

The following prints summary in plain text but does not generate json or html reports to file.

    Brakeman::Commandline.run output_formats: [:json, :html],
      quiet: true, run_all_checks: true, summary_only: true

I tried the above with output_files: "tmp/brakeman" also, hoping to get the two reports written to tmp/brakeman/ directory, but no joy. (that generates an error)

So I explicitly listed both files (which seems redundant when you want them both in the same directory?).

    output_files = %w[tmp/brakeman/report.json tmp/brakeman/report.html]
    Brakeman::Commandline.run output_files:,
      quiet: true, run_all_checks: true, summary_only: true, print_report: true

This at least generates the report, but apparently the inclusion of output_files kills the print_report option? How do I get plain text summary to stdout while generating json and html files?

[presidentbeef]

You can't get the full HTML report when requesting a summary. There's no way to specify to only summarize in one report type and not another.

But you can get everything else you are looking for, because luckily the JSON report doesn't support summaries. Try adding /dev/stdout to the output file list:

    output_files = %w[tmp/brakeman/report.json tmp/brakeman/report.html /dev/stdout]
    Brakeman::Commandline.run output_files:,
      quiet: true, run_all_checks: true, summary_only: true

(Pretty sure print_report does not do anything if output_files is specified.)

[jasonkarns]

Thank you. I didn't realize that the summary option also affected html reports. It makes sense to be careful with that one, if it applies to other report formats.

I do think it would be an improvement, however, for print_report to still take effect when output_files is provided. Needing to pass along the obscure file handle for stdout doesn't feel good or self-evident. (especially when print_report exists for ostensibly this purpose?) It works though!