test-security-zap.yml

name: ZAP

on: [push]

permissions:
  contents: read

jobs:
  test-security:
    name: ZAP
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK 21
        uses: actions/setup-java@v4
        with:
          java-version: "21"
          distribution: "oracle"
      - name: Clean install
        run: ./mvnw --no-transfer-progress clean install -DskipTests -Ddependency-check.skip -Dcyclonedx.skip=true -Dexec.skip
      - name: Start application
        run: ./mvnw spring-boot:run -Dspring-boot.run.profiles=test &
      - name: Wait till application is up
        run: |
          until curl --output /dev/null --silent --head --fail http://localhost:8080; do
            printf '.'
            sleep 5
          done
      - name: ZAP Scan
        uses: zaproxy/action-baseline@v0.13.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          allow_issue_writing: false
          docker_name: "ghcr.io/zaproxy/zaproxy:stable"
          target: "http://localhost:8080"
          rules_file_name: zap/rule-config.tsv
          fail_action: true
          cmd_options: '-z "-configFile /zap/wrk/zap/options.conf" -a'