hapi.f5labs.dev-zap-api.yml

name: "hapi.f5labs.dev - ZAP API Scan"
on:
  workflow_dispatch:
  schedule:
    - cron: "15 00 * * *"
# Declare default permissions as read only.
permissions: read-all
jobs:
  zap-api:
    name: "ZAP API Scan"
    runs-on: ubuntu-latest
    permissions:
      # Needed to write to Issues.
      issues: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
        with:
          ref: master
      - name: ZAP Scan
        uses: zaproxy/action-api-scan@v0.7.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          docker_name: "ghcr.io/zaproxy/zaproxy:stable"
          format: openapi
          target: tests/hapi/hapi-swagger.json
          issue_title: "hapi.f5labs.dev - OWASP ZAP API Scan"
          fail_action: "true"
          cmd_options: "-I -S"