From c23ad4f6d3f19a4296dbd2f7e5d3be03d28d1e67 Mon Sep 17 00:00:00 2001 From: pm Date: Sat, 13 Jun 2026 00:44:33 +0100 Subject: [PATCH 1/3] owasp zap config v3 --- .gitea/workflows/deploy.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 44b8e71..7f9264b 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -80,6 +80,34 @@ jobs: docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true + echo ">>> Decommissioning ephemeral sandbox and network..." + docker rm -f zap-scanner apex-sandbox || true + docker network rm zap-net || true- name: 5. Dynamic Security Scan (OWASP ZAP) + if: github.event_name == 'push' + run: | + echo ">>> Preparing isolated network for DAST..." + # Tenta remover a rede caso ela exista de uma execução anterior + docker network rm zap-net || true + docker network create zap-net + + echo ">>> Provisioning ephemeral sandbox environment..." + docker rm -f apex-sandbox || true + docker run -d --name apex-sandbox --network zap-net apex-solutions:latest + sleep 10 + + echo ">>> Initiating OWASP ZAP Baseline Scan..." + mkdir -p qatests + + docker run --user root --name zap-scanner \ + --network zap-net \ + -v ${{ github.workspace }}:/zap/wrk/:rw \ + -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ + -t http://apex-sandbox:3000 \ + -r report.html \ + -I -c zap-baseline.conf + + docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true + echo ">>> Decommissioning ephemeral sandbox and network..." docker rm -f zap-scanner apex-sandbox || true docker network rm zap-net || true From aba23ad583ff60b294b4c1cfb34e325121c2a4f3 Mon Sep 17 00:00:00 2001 From: pm Date: Sat, 13 Jun 2026 00:48:45 +0100 Subject: [PATCH 2/3] owasp zap config v4 --- .gitea/workflows/deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 7f9264b..c7f84f9 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -4,7 +4,7 @@ on: branches: [ main ] pull_request: branches: [ main ] - + jobs: security-gate-and-deploy: runs-on: ubuntu-latest From 430c41806204c47926f141349f5c806308f68c14 Mon Sep 17 00:00:00 2001 From: pm Date: Sat, 13 Jun 2026 00:50:04 +0100 Subject: [PATCH 3/3] owasp zap config v5 --- .gitea/workflows/deploy.yml | 66 +++---------------------------------- 1 file changed, 4 insertions(+), 62 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index c7f84f9..44a512c 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -4,7 +4,7 @@ on: branches: [ main ] pull_request: branches: [ main ] - + jobs: security-gate-and-deploy: runs-on: ubuntu-latest @@ -17,18 +17,11 @@ jobs: - name: 1. Build Application Image run: docker build -f backend/Dockerfile -t apex-solutions:latest . - - name: 1.5. Execute Unit Tests (Business Logic) + - name: 1.5. Execute Unit Tests run: | - echo ">>> Syncing dependencies and executing test suite..." - # O 'npm install' vai atualizar automaticamente o package-lock.json - # caso exista alguma divergência com o package.json npm install npm test - # ========================================== - # STATIC SECURITY ANALYSIS STAGES - # ========================================== - - name: 2. Secret Scanning (Gitleaks) run: | curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz | tar -xz -C /tmp @@ -52,52 +45,15 @@ jobs: -Dsonar.qualitygate.wait=true \ -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info - # ========================================== - # DYNAMIC SECURITY ANALYSIS & DEPLOYMENT - # ========================================== - - name: 5. Dynamic Security Scan (OWASP ZAP) if: github.event_name == 'push' run: | - echo ">>> Creating isolated network for DAST..." - docker network create zap-net - - echo ">>> Provisioning ephemeral sandbox environment..." - docker run -d --name apex-sandbox --network zap-net apex-solutions:latest - sleep 10 - - echo ">>> Initiating OWASP ZAP Baseline Scan..." - mkdir -p qatests - - # O truque aqui é mapear a pasta atual (.) para /zap/wrk/ - docker run --user root --name zap-scanner \ - --network zap-net \ - -v ${{ github.workspace }}:/zap/wrk/:rw \ - -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ - -t http://apex-sandbox:3000 \ - -r report.html \ - -I -c zap-baseline.conf - - docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true - - echo ">>> Decommissioning ephemeral sandbox and network..." - docker rm -f zap-scanner apex-sandbox || true - docker network rm zap-net || true- name: 5. Dynamic Security Scan (OWASP ZAP) - if: github.event_name == 'push' - run: | - echo ">>> Preparing isolated network for DAST..." - # Tenta remover a rede caso ela exista de uma execução anterior docker network rm zap-net || true docker network create zap-net - - echo ">>> Provisioning ephemeral sandbox environment..." docker rm -f apex-sandbox || true docker run -d --name apex-sandbox --network zap-net apex-solutions:latest sleep 10 - - echo ">>> Initiating OWASP ZAP Baseline Scan..." mkdir -p qatests - docker run --user root --name zap-scanner \ --network zap-net \ -v ${{ github.workspace }}:/zap/wrk/:rw \ @@ -105,33 +61,19 @@ jobs: -t http://apex-sandbox:3000 \ -r report.html \ -I -c zap-baseline.conf - docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true - - echo ">>> Decommissioning ephemeral sandbox and network..." docker rm -f zap-scanner apex-sandbox || true docker network rm zap-net || true - - name: 6. Production Deployment & Local Reports + - name: 6. Production Deployment if: github.event_name == 'push' run: | - echo ">>> Deploying application to production environment..." docker rm -f portal-corporativo || true docker run -d -p 3000:3000 --name portal-corporativo apex-solutions:latest - - echo ">>> Awaiting Node.js service initialization..." sleep 5 - - echo ">>> Container logs (for diagnostic purposes):" - docker logs portal-corporativo - - echo ">>> Performing internal health check (via wget)..." - docker exec portal-corporativo wget --spider -S http://localhost:3000 - - echo ">>> Publishing OWASP ZAP security report to web server..." docker cp qatests/report.html portal-corporativo:/usr/src/app/frontend/zap-report.html || true - - name: 7. Archive ZAP Report (Gitea Artifacts) + - name: 7. Archive ZAP Report if: always() && github.event_name == 'push' uses: actions/upload-artifact@v3 with: