DevOps Shield - DevSecOps Automation - Create devopsshield-dast-zed-attack-proxy-zap.yml

Author: CalinL

.github/workflows/devopsshield-dast-zed-attack-proxy-zap.yml

@@ -0,0 +1,61 @@
+# Last applied at: Fri, 24 Jan 2025 13:36:24 GMT
+# DevOps Shield - The ultimate DevSecOps platform designed to secure your DevOps.
+# https://devopsshield.com
+##############################################################
+# This is a DevOps Shield - Application Security - Code Security Template. 
+
+# This workflow template uses actions that are not certified by DevOps Shield. 
+# They are provided by a third-party and are governed by separate terms of service, privacy policy, and support documentation.
+
+# Use this workflow template for integrating code security into your pipelines and workflows.
+
+# DevOps Shield Workflow Template Details:
+# ------------------------------------------------------------
+# Code: GH_DAST_Zed_Attack_Proxy_ZAP
+# Name: Zed Attack Proxy (ZAP) Penetration Testing
+# DevSecOpsControls: DAST
+# Provider: Checkmarx
+# Categories: Code Scanning, Penetration Testing
+# Description: 
+# Zed Attack Proxy (ZAP) by Checkmarx is a free, open-source penetration testing tool. 
+# ZAP is designed specifically for testing web applications and is both flexible and extensible.
+# Automate with ZAP. ZAP provides range of options for security automation. 
+# The world's most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. 
+# A GitHub Action for running the ZAP Full Scan to perform Dynamic Application Security Testing (DAST).
+# The ZAP full scan action runs the ZAP spider against the specified target (by default with no time limit) followed by an optional ajax spider scan and then a full active scan before reporting the results.
+# WARNING this action will perform attacks on the target website. You should only scan targets that you have permission to test.
+# Read the official documentation to find out more. 
+# For more information: 
+# https://www.zaproxy.org/
+# https://www.zaproxy.org/docs/
+# https://github.com/zaproxy/
+# https://www.zaproxy.org/docs/automate/
+# https://www.zaproxy.org/docs/guides/zapping-the-top-10-2021/
+# ------------------------------------------------------------
+# Source repository: https://github.com/zaproxy/action-full-scan
+##############################################################
+
+name: Zed Attack Proxy (ZAP) Full Scan
+
+on:
+  push:
+    branches: [ main ]
+  schedule:
+    - cron: 0 0 * * 0
+
+jobs:
+  zap_scan:
+    name: ZAP Full Scan
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Run ZAP Scan
+      uses: zaproxy/action-full-scan@v0.12.0
+      id: zap
+      with:
+        target: 'https://www.zaproxy.org/'