pen-testing-api.yml

name: API Penetration testing
on: 
  # schedule:
  #   - cron: '0 0 1 * *'
  workflow_dispatch:
    inputs:
      target:
        description: 'URL target of the pen testing'
        required: true
        default: 'https://server.amplication-sandbox.com'

jobs:
  zap_scan_graphql:
    runs-on: ubuntu-latest
    name: Scan the graphql API
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: ZAP Scan
        uses: zaproxy/action-api-scan@v0.7.0
        with:
          target: '${{ github.event.inputs.target }}/graphql'
          format: graphql
          cmd_options: '-T 30 -n amplication.context'
          rules_file_name: 'amplication.conf'
        env:
          ZAP_AUTH_HEADER_VALUE: ${{ secrets.AMPLICATION_BOT_TOKEN }}
          ZAP_AUTH_HEADER_SITE: ${{ github.event.inputs.target }}

  zap_scan_rest:
    runs-on: ubuntu-latest
    name: Scan the REST API
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: ZAP Scan
        uses: zaproxy/action-api-scan@v0.7.0
        with:
          target: '${{ github.event.inputs.target }}/api-json'
          format: openapi
          cmd_options: '-T 30 -n amplication.context'
          rules_file_name: 'amplication.conf'
        env:
          ZAP_AUTH_HEADER_VALUE: ${{ secrets.AMPLICATION_BOT_TOKEN }}
          ZAP_AUTH_HEADER_SITE: ${{ github.event.inputs.target }}