fix(gitlab): omit an absent identifier url instead of sending null

The GitLab dependency-scanning schema types an identifier's url as a string
matching ^(https?|ftp)://, so a null fails validation. The socket_alert
identifier emitted null whenever an alert carried no url, which invalidates that
finding for every consumer that validates the report.

Verified against the published schema: a report containing an alert with no url
now produces zero validation errors.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

socketsecurity/core/messages.py

@@ -648,13 +648,18 @@ def extract_identifiers_gitlab(alert: Issue) -> list:
         """
         identifiers = []
 
-        # Primary identifier: Socket alert type
-        identifiers.append({
+        # Primary identifier: Socket alert type. The GitLab schema types identifier
+        # url as a string matching ^(https?|ftp)://, so an absent url is omitted
+        # rather than sent as null, which fails validation for the whole finding.
+        socket_identifier = {
             "type": "socket_alert",
             "name": f"Socket {alert.type}",
             "value": alert.type,
-            "url": alert.url if hasattr(alert, 'url') and alert.url else None
-        })
+        }
+        alert_url = getattr(alert, "url", None)
+        if alert_url:
+            socket_identifier["url"] = alert_url
+        identifiers.append(socket_identifier)
 
         props = getattr(alert, "props", None) or {}
         # Alerts reach Issue.props from several sources, so both spellings of each

tests/unit/test_gitlab_format.py

@@ -281,6 +281,25 @@ def test_location_file_is_unknown_only_when_nothing_is_known(self):
 
         assert Messages.extract_location_gitlab(issue)["file"] == "unknown"
 
+    def test_identifier_url_is_omitted_rather_than_null(self):
+        """GitLab types identifier url as a string; null fails schema validation"""
+        issue = Issue(
+            pkg_name="nourl-pkg",
+            pkg_version="1.0.0",
+            type="malware",
+            severity="critical",
+            title="Malware",
+            pkg_type="npm",
+            key="test-key",
+            purl="pkg:npm/nourl-pkg@1.0.0",
+        )
+
+        identifiers = Messages.extract_identifiers_gitlab(issue)
+
+        # An absent key is correct; a present-but-null value is what breaks validation.
+        assert all("url" not in i or i["url"] for i in identifiers)
+        assert "url" not in identifiers[0]
+
     def test_severity_mapping(self):
         """Test all Socket severities map to GitLab severities"""
         severity_tests = [