feat(ci): zap (#204)

bcgov · Jan 31, 2024 · dc80ef5 · dc80ef5
1 parent 4c8032a
commit dc80ef5
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 24 deletions.
diff --git a/.github/workflows/merge-main.yml b/.github/workflows/merge-main.yml
@@ -116,16 +116,14 @@ jobs:
           oc_token: ${{ secrets.OC_TOKEN }}
           overwrite: true
           verification_path: /health
-          penetration_test: false
           parameters:
-            -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
-            -p PROMOTE=${{ github.repository }}/api:${{ env.ZONE }}
             -p ORACLEDB_USER=${{ secrets.ORACLEDB_USERNAME }}
             -p ORACLEDB_PASSWORD=${{ secrets.ORACLEDB_PASSWORD }}
             -p ORACLEDB_DATABASE=${{ secrets.ORACLEDB_DATABASE }}
             -p ORACLEDB_HOST=${{ secrets.ORACLEDB_HOST }}
             -p ORACLEDB_SERVICENAME=${{ secrets.ORACLEDB_SERVICENAME }}
             -p ORACLEDB_SECRET=${{ secrets.ORACLEDB_SECRET }}
+            -p ZONE=${{ env.ZONE }}
 
       - name: Publish API
         uses: bcgov-nr/action-gwa-publish@v0.1.0
@@ -225,17 +223,15 @@ jobs:
           oc_server: ${{ secrets.OC_SERVER }}
           oc_token: ${{ secrets.OC_TOKEN }}
           overwrite: true
-          penetration_test: false
           verification_path: /health
           parameters:
-            -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
-            -p PROMOTE=${{ github.repository }}/api:${{ env.ZONE }}
             -p ORACLEDB_USER=${{ secrets.ORACLEDB_USERNAME }}
             -p ORACLEDB_PASSWORD=${{ secrets.ORACLEDB_PASSWORD }}
             -p ORACLEDB_DATABASE=${{ secrets.ORACLEDB_DATABASE }}
             -p ORACLEDB_HOST=${{ secrets.ORACLEDB_HOST }}
             -p ORACLEDB_SERVICENAME=${{ secrets.ORACLEDB_SERVICENAME }}
             -p ORACLEDB_SECRET=${{ secrets.ORACLEDB_SECRET }}
+            -p ZONE=${{ env.ZONE }}
       - name: Publish API
         uses: bcgov-nr/action-gwa-publish@v0.1.0
         with:

diff --git a/.github/workflows/pr-open.yml b/.github/workflows/pr-open.yml
@@ -161,14 +161,13 @@ jobs:
           overwrite: true
           verification_path: /health
           parameters:
-            -p ZONE=${{ github.event.number }} -p NAME=${{ github.event.repository.name }}
-            -p PROMOTE=${{ github.repository }}/api:${{ github.event.number }}
             -p ORACLEDB_USER=${{ secrets.ORACLEDB_USERNAME }}
             -p ORACLEDB_PASSWORD=${{ secrets.ORACLEDB_PASSWORD }}
             -p ORACLEDB_DATABASE=${{ secrets.ORACLEDB_DATABASE }}
             -p ORACLEDB_HOST=${{ secrets.ORACLEDB_HOST }}
             -p ORACLEDB_SERVICENAME=${{ secrets.ORACLEDB_SERVICENAME }}
             -p ORACLEDB_SECRET=${{ secrets.ORACLEDB_SECRET }}
+            -p ZONE=${{ github.event.number }}
 
   postman:
     name: Smoke Test

diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
@@ -0,0 +1,23 @@
+name: Scheduled
+
+on:
+  schedule: [cron: "0 11 * * 6"] # 3 AM PST = 12 PM UDT, Saturdays
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zap_scan:
+    runs-on: ubuntu-latest
+    name: Penetration Tests
+    steps:
+      - name: ZAP Scan
+        uses: zaproxy/action-full-scan@v0.9.0
+        with:
+          allow_issue_writing: true
+          artifact_name: "zap_api"
+          cmd_options: "-a"
+          issue_title: "ZAP: API"
+          target: https://nr-forest-client-api-test-backend.apps.silver.devops.gov.bc.ca
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
@@ -2,16 +2,9 @@ name: Unit Tests and Analysis
 
 on:
   pull_request:
-    types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
+    types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
   push:
-    branches:
-      - main
-    paths-ignore:
-      - "**.md"
+    branches: [main]
   workflow_dispatch:
 
 concurrency:

diff --git a/openshift.deploy.yml b/openshift.deploy.yml
@@ -32,12 +32,6 @@ parameters:
     value: 75Mi
   - name: MEMORY_LIMIT
     value: 75Mi
-  - name: REGISTRY
-    description: Container registry to import from (internal is image-registry.openshift-image-registry.svc:5000)
-    value: ghcr.io
-  - name: PROMOTE
-    description: Image (namespace/name:tag) to promote/import
-    value: bcgov/nr-old-growth:prod-backend
   - name: ORACLEDB_USER
     description: Oracle database user name
     required: true
@@ -88,7 +82,7 @@ objects:
         - name: ${IMAGE_TAG}
           from:
             kind: DockerImage
-            name: ${REGISTRY}/${PROMOTE}
+            name: ghcr.io/bcgov/${NAME}/api:${ZONE}
           referencePolicy:
             type: Local
   - apiVersion: v1