Dynamic Application Security Tests #85

	name: Dynamic Application Security Tests

	on:
	push:
	branches: [main, staging, release*]

	jobs:
	zap-proxy-scan:
	name: ZAP Proxy Test
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Install
	run: npm ci
	env:
	CI: true

	- name: Docker Build
	run: docker build --build-arg AEM_GRAPHQL_ENDPOINT=${{secrets.AEM_GRAPHQL_ENDPOINT}} -t secure-client-hub .
	env:
	CI: true
	AEM_GRAPHQL_ENDPOINT: ${{secrets.AEM_GRAPHQL_ENDPOINT}}

	- name: Docker run
	run: docker run -d -p 3000:3000 secure-client-hub
	env:
	CI: true
	AEM_GRAPHQL_ENDPOINT: ${{secrets.AEM_GRAPHQL_ENDPOINT}}

	- name: OWASP ZAP FULL Scan
	uses: zaproxy/[email protected]
	with:
	target: "http://localhost:3000"
	fail_action: "false"
	token: ${{ secrets.GITHUB_TOKEN }}

Provide feedback