It would be nice to have a working example of this, and some accompanying documentation, but I'm not sure if/when this paradigm should be followed. That would likely need to be clarified within a Wikimedia .gitlab-ci.yml style guide. Yes, this will likely always be the "cleanest" approach, but it might also be more of a hassle given the ease and flexibility that most security-related reporting can likely be accomplished by simple shell commands, python -c one-liners, etc. And the fact that, currently, gerrit + jenkins ci tends to favor raw output over report artifact generation for the time being.