From e019e9cf1122194c766e50f114e866742ebf5046 Mon Sep 17 00:00:00 2001 From: Carlo Costino Date: Thu, 28 Sep 2023 17:28:27 -0400 Subject: [PATCH] Update OWASP ZAP scans The OWASP ZAP scan GitHub Actions have been updated recently and we need to make sure our GitHub Actions account for the recent changes. This changeset makes sure we are using the latest version of the OWASP ZAP API scan, the correct Docker image, and adjusts the name of the step to accurately reflect what scan is being run. Signed-off-by: Carlo Costino --- .github/workflows/checks.yml | 2 +- .github/workflows/daily_checks.yml | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml index 08634f6e3..280d2566e 100644 --- a/.github/workflows/checks.yml +++ b/.github/workflows/checks.yml @@ -131,7 +131,7 @@ jobs: run: make run-flask & env: SQLALCHEMY_DATABASE_TEST_URI: postgresql://user:password@localhost:5432/test_notification_api - - name: Run OWASP Baseline Scan + - name: Run OWASP API Scan uses: zaproxy/action-api-scan@v0.5.0 with: docker_name: 'ghcr.io/zaproxy/zaproxy:weekly' diff --git a/.github/workflows/daily_checks.yml b/.github/workflows/daily_checks.yml index 661532561..91404fe97 100644 --- a/.github/workflows/daily_checks.yml +++ b/.github/workflows/daily_checks.yml @@ -75,14 +75,18 @@ jobs: run: make bootstrap env: SQLALCHEMY_DATABASE_TEST_URI: postgresql://user:password@localhost:5432/test_notification_api + NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }} + NOTIFY_E2E_TEST_HTTP_AUTH_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_HTTP_AUTH_PASSWORD }} + NOTIFY_E2E_TEST_HTTP_AUTH_USER: ${{ secrets.NOTIFY_E2E_TEST_HTTP_AUTH_USER }} + NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }} - name: Run server run: make run-flask & env: SQLALCHEMY_DATABASE_TEST_URI: postgresql://user:password@localhost:5432/test_notification_api - - name: Run OWASP Baseline Scan - uses: zaproxy/action-api-scan@v0.4.0 + - name: Run OWASP API Scan + uses: zaproxy/action-api-scan@v0.5.0 with: - docker_name: 'owasp/zap2docker-weekly' + docker_name: 'ghcr.io/zaproxy/zaproxy:weekly' target: 'http://localhost:6011/docs/openapi.yml' fail_action: true allow_issue_writing: false