feat(ci): schedule job for ZAP

bcgov · Jan 30, 2024 · 4c725a0 · 4c725a0
1 parent 7219b5c
commit 4c725a0
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 10 deletions.
diff --git a/.github/workflows/merge-main.yml b/.github/workflows/merge-main.yml
@@ -240,7 +240,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: false
- penetration_test: false
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
  -p PROMOTE=${{ github.repository }}/database:${{ env.ZONE }}
@@ -253,7 +252,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  verification_path: health
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
@@ -273,7 +271,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  verification_path: health
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
@@ -288,7 +285,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
  -p PROMOTE=${{ github.repository }}/frontend:${{ env.ZONE }}
@@ -304,7 +300,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  verification_path: health
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
@@ -394,7 +389,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: false
- penetration_test: false
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
  -p PROMOTE=${{ github.repository }}/database:${{ env.PREV }}
@@ -407,7 +401,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  verification_path: health
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
@@ -427,7 +420,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  verification_path: health
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
@@ -442,7 +434,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}
  -p PROMOTE=${{ github.repository }}/frontend:${{ env.PREV }}
@@ -458,7 +449,6 @@ jobs:
  oc_server: ${{ secrets.OC_SERVER }}
  oc_token: ${{ secrets.OC_TOKEN }}
  overwrite: true
- penetration_test: false
  verification_path: health
  parameters:
  -p ZONE=${{ env.ZONE }} -p NAME=${{ github.event.repository.name }}

diff --git a/.github/workflows/scheduled.yml b/.github/workflows/scheduled.yml
@@ -0,0 +1,34 @@
+name: Scheduled
+
+on:
+ schedule: [cron: "0 11 * * 6"] # 3 AM PST = 12 PM UDT, Saturdays
+ workflow_dispatch:
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+jobs:
+ zap_scan:
+ runs-on: ubuntu-latest
+ name: Penetration Tests
+ env:
+ DOMAIN: apps.silver.devops.gov.bc.ca
+ PREFIX: ${{ github.event.repository.name }}-test
+ strategy:
+ matrix:
+ name: [backend, frontend]
+ include:
+ - name: backend
+ target: https://nr-forest-client-test-backend.apps.silver.devops.gov.bc.ca
+ - name: frontend
+ target: https://nr-forest-client-test-frontend.apps.silver.devops.gov.bc.ca
+ steps:
+ - name: ZAP Scan
+ uses: zaproxy/action-full-scan@v0.9.0
+ with:
+ allow_issue_writing: true
+ artifact_name: "zap_${{ matrix.name }}"
+ cmd_options: "-a"
+ issue_title: "ZAP: ${{ matrix.name }}"
+ target: ${{ matrix.target }}