diff --git a/.github/workflows/snyk-zap.yml b/.github/workflows/snyk-zap.yml index 53bd609..4119498 100644 --- a/.github/workflows/snyk-zap.yml +++ b/.github/workflows/snyk-zap.yml @@ -1,6 +1,6 @@ # Define the name of the workflow -name: snyk-zap +name: snyk # Define when the workflow should be triggered (on push to a specific branch and pull requests to the master branch) on: @@ -113,54 +113,3 @@ jobs: with: name: reports path: ./*.pdf - - ZAP-Docker-Scan: - needs: Snyk-Docker-Image - runs-on: - group: ncats-onprem-internal-runners - - permissions: - actions: read - contents: read - security-events: write - issues: write - - steps: - # Step 1: Get BUILD_VERSION from Snyk-Docker-Image job - - name: Get BUILD_VERSION from Snyk-Docker-Image job - id: get_runner_ip - run: | - echo "BUILD_VERSION=${{ needs.Snyk-Docker-Image.outputs.build_version }}" >> $GITHUB_ENV - echo "::set-output name=runner_ip::$(hostname -I | cut -d' ' -f1)" - - - name: Login to Dockerhub - run: docker login -u "${{ secrets.DKRHUB_NCATSSVCDVOPS_USERNAME }}" -p "${{ secrets.DKRHUB_NCATSSVCDVOPS_TOKEN_WRITE }}" - - # Step 2: Add the command to start Docker image on port 8000 - - name: Start Docker image on port 8000 - continue-on-error: true - run: docker run -d -p 8000:8000 ncats/pharos-graphql-server:${{ needs.Snyk-Docker-Image.outputs.build_version }} - - # Step 3: ZAP BASELINE SCAN - - name: ZAP base Scan - continue-on-error: true - uses: zaproxy/action-baseline@v0.11.0 - with: - target: 'http://${{ steps.get_runner_ip.outputs.runner_ip }}:8000' - docker_name: 'ghcr.io/zaproxy/zaproxy:stable' - token: ${{ secrets.GITHUB_TOKEN }} - fail_action: false - - # Step 4: Stop and remove the Docker container - - name: Stop and remove Docker container - run: docker stop $(docker ps -q --filter ancestor=ncats/pharos-graphql-server:$BUILD_VERSION) && docker rm $(docker ps -a -q --filter ancestor=ncats/pharos-graphql-server:$BUILD_VERSION) || true - - # Step 5: Create SARIF file from ZAP results - - name: Create SARIF file from ZAP results - uses: SvanBoxel/zaproxy-to-ghas@main - - # Step 6: Upload SARIF file to GitHub Code Scanning - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: results.sarif