Reports & Artifacts

Not every report appears for every project. Availability depends on the project type and whether the project has any environments linked:

The Velocity Report shows development velocity trends across your repositories — commit statistics, feature delivery, and charts. It is available for Code / Build projects.

To generate it, configure:

• Repositories — a multi-select of the project's repositories, each with its own Branch dropdown (defaults to the repository's default branch, with an "all branches" option). Select All / Deselect All are available.
• Granularity — Day, Week, or Month (default Month).
• Date Range — a date picker that switches between a month range and a day range to match the granularity.

Select Generate Report (enabled once at least one repository is chosen). Generation runs asynchronously with a live status feed ("Report generation started…" through "Report complete!"). The finished report is rendered as a preview and includes:

• Headline statistic tiles.
• A Velocity Trend chart (commits per day, lines per day).
• A Totals table by period (business days, commits, commits/day, insertions, and deletions).
• A Per-Service Breakdown — Lines Added table.
• A Feature Delivery breakdown by period.

Routine commit "noise" (dependency bumps, Renovate, merge commits, and lint/clean chores) is filtered out so the numbers reflect meaningful work.

Export: select Print View to open the rendered report in a new tab and print it (use your browser's print-to-PDF). Generate New Report resets the form.

The Runtime Vulnerabilities report shows vulnerability trends for the containers currently running in your environments, with a severity breakdown and remediation velocity. It appears only when the project has at least one environment.

Configure:

• Granularity — Day, Week, or Month (default Month).
• Date Range — the reporting window (defaults to roughly the last five months).
• Environment — a selector to scope the report to one environment, or All Environments.

Select Generate to render two charts:

• Active Vulnerabilities by Severity — a stacked area chart of active vulnerabilities over time, broken down into Critical, High, Medium, and Low.
• New vs Resolved — the number of vulnerabilities newly detected versus resolved in each period. When Resolved exceeds New, your backlog is shrinking.

The data comes from Trivy scans of your deployed workloads (the runtime findings surfaced in the Environments section), so it reflects what is live — not just what was scanned at build time. This report has no file export.

The Pipeline Vulnerabilities report aggregates all Trivy scan findings across your uploaded container images, taken from each image's build pipeline. It appears for Upload projects and loads immediately when opened.

At the top, a summary bar shows the total number of findings and how many containers are affected, with severity count tags: Critical, High, Medium, Low, and Unknown.

You can narrow the findings with:

• A search box (matches CVE ID, container, or package).
• A container multi-select.
• A severity multi-select.
• An Image versions control that lets you view a historical image tag per container. When a historical tag is selected, a "Historical" indicator and a banner explain that the findings reflect a past tag rather than the latest scan, with a Reset to latest action.

The findings table lists Severity, Vulnerability (CVE ID, linking to the source pipeline), Container (container:tag), Package, Installed version, Fixed version, and Justification. Findings are sorted most-severe first.

Justifications: for each finding you can add, edit, or delete a justification note (for example, "Accepted risk — not exploitable in our configuration"). Notes record their author and when they were created or edited.

If any upload pipelines are still running, a banner warns you and exports are disabled until the pipelines finish; a Refresh action re-checks. A separate warning lists any containers that do not yet have a readable scan report.

Export: PDF, JSON, and CSV. The PDF is a branded, landscape report of the currently filtered findings (it stamps the active filters and any historical tag selections into its summary). Exports are disabled while pipelines are still running.

The Container SBOMs report provides a CycloneDX software bill of materials for each uploaded container image. It appears for Upload projects. The table lists each Container, its Version, and an action to view or download the SBOM, with export to JSON and CSV.

The Authorization Boundary report generates a per-environment system boundary diagram for ATO (Authority to Operate) documentation — showing the components, data flows, and external connections within the accreditation scope.

Because it describes what is actually deployed, it is a runtime report: select an Environment to generate the diagram. If the project has no environments yet, an info message explains that you must have the application running in Rancher with a mapped environment first (link environments in the Environments section). The generated diagram is saved as a compliance artifact for the project.

The Component Inventory & SBOM report is a per-environment inventory of the workloads, images, and software composition actually deployed. Select an Environment, then Generate Component Inventory (or Regenerate Inventory).

The result is a filterable, sortable table with columns for Name, Workload Type, State, Image, Replicas, Ports, Cluster, and SBOM. Expanding a row shows the component's SBOM inline. You can link a repository to a component so that images are matched to their source repository automatically.

Export: CSV and JSON. Like the Authorization Boundary, the generated inventory is saved as a compliance artifact.

IronSled does not have a separate "Compliance" section. The two Runtime reports that support accreditation — the Authorization Boundary diagram and the Component Inventory & SBOM — are saved as compliance artifacts when you generate them, keyed to the project and environment. To produce or refresh these artifacts, generate the corresponding report from this section.