zap-owasp.yaml

name: ZAP OWASP Scan Code

on:
  workflow_call:

env:
  PGUSER: postgres
  DJANGO_SECRET_KEY: ${{ secrets.DJANGO_SECRET_KEY }}

jobs:
  zap-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: dev env setup
        uses: ./.github/actions/dev-env-setup
      - name: run app locally
        uses: ./.github/actions/run-registration1-app
        with:
          django_secret_key: ${{ env.DJANGO_SECRET_KEY }}
      - name: ZAP Frontend Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          docker_name: "ghcr.io/zaproxy/zaproxy:stable"
          target: "http://localhost:3000/"
          rules_file_name: ".zap/rules-frontend.tsv"
          cmd_options: "-a -d -T 5 -m 2"
          issue_title: OWASP Baseline - Frontend
          fail_action: false
          allow_issue_writing: false
      - name: ZAP Backend Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          docker_name: "ghcr.io/zaproxy/zaproxy:stable"
          target: "http://0.0.0.0:8000/"
          rules_file_name: ".zap/rules-backend.tsv"
          cmd_options: "-a -d -T 5 -m 2"
          issue_title: OWASP Baseline - Backend
          fail_action: false
          allow_issue_writing: false

  # Retry the workflow due to secondary rate limiting errors causing frequent failures
  retry-on-failure:
    needs: zap-scan
    if: failure() || needs.zap-scan.result != 'success' && fromJSON(github.run_attempt) < 3 && !cancelled()
    runs-on: ubuntu-latest
    steps:
      - env:
          GH_REPO: ${{ github.repository }}
          GH_TOKEN: ${{ github.token }}
          GH_DEBUG: api
        run: gh workflow run retry-workflow.yaml -F run_id=${{ github.run_id }}