owasp zap config v5

.gitea/workflows/deploy.yml

@@ -17,18 +17,11 @@ jobs:
       - name: 1. Build Application Image
         run: docker build -f backend/Dockerfile -t apex-solutions:latest .
 
-      - name: 1.5. Execute Unit Tests (Business Logic)
+      - name: 1.5. Execute Unit Tests
         run: |
-          echo ">>> Syncing dependencies and executing test suite..."
-          # O 'npm install' vai atualizar automaticamente o package-lock.json 
-          # caso exista alguma divergência com o package.json
           npm install
           npm test
 
-      # ==========================================
-      # STATIC SECURITY ANALYSIS STAGES
-      # ==========================================
-
       - name: 2. Secret Scanning (Gitleaks)
         run: |
           curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz | tar -xz -C /tmp
@@ -52,52 +45,15 @@ jobs:
             -Dsonar.qualitygate.wait=true \
             -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info
 
-      # ==========================================
-      # DYNAMIC SECURITY ANALYSIS & DEPLOYMENT
-      # ==========================================
-
       - name: 5. Dynamic Security Scan (OWASP ZAP)
         if: github.event_name == 'push'
         run: |
-          echo ">>> Creating isolated network for DAST..."
-          docker network create zap-net
-          
-          echo ">>> Provisioning ephemeral sandbox environment..."
-          docker run -d --name apex-sandbox --network zap-net apex-solutions:latest
-          sleep 10
-          
-          echo ">>> Initiating OWASP ZAP Baseline Scan..."
-          mkdir -p qatests
-          
-          # O truque aqui é mapear a pasta atual (.) para /zap/wrk/
-          docker run --user root --name zap-scanner \
-            --network zap-net \
-            -v ${{ github.workspace }}:/zap/wrk/:rw \
-            -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
-            -t http://apex-sandbox:3000 \
-            -r report.html \
-            -I -c zap-baseline.conf
-          
-          docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
-          
-          echo ">>> Decommissioning ephemeral sandbox and network..."
-          docker rm -f zap-scanner apex-sandbox || true
-          docker network rm zap-net || true- name: 5. Dynamic Security Scan (OWASP ZAP)
-        if: github.event_name == 'push'
-        run: |
-          echo ">>> Preparing isolated network for DAST..."
-          # Tenta remover a rede caso ela exista de uma execução anterior
           docker network rm zap-net || true
           docker network create zap-net
-          
-          echo ">>> Provisioning ephemeral sandbox environment..."
           docker rm -f apex-sandbox || true
           docker run -d --name apex-sandbox --network zap-net apex-solutions:latest
           sleep 10
-          
-          echo ">>> Initiating OWASP ZAP Baseline Scan..."
           mkdir -p qatests
-          
           docker run --user root --name zap-scanner \
             --network zap-net \
             -v ${{ github.workspace }}:/zap/wrk/:rw \
@@ -105,33 +61,19 @@ jobs:
             -t http://apex-sandbox:3000 \
             -r report.html \
             -I -c zap-baseline.conf
-          
           docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
-          
-          echo ">>> Decommissioning ephemeral sandbox and network..."
           docker rm -f zap-scanner apex-sandbox || true
           docker network rm zap-net || true
 
-      - name: 6. Production Deployment & Local Reports
+      - name: 6. Production Deployment
         if: github.event_name == 'push'
         run: |
-          echo ">>> Deploying application to production environment..."
           docker rm -f portal-corporativo || true
           docker run -d -p 3000:3000 --name portal-corporativo apex-solutions:latest
-          
-          echo ">>> Awaiting Node.js service initialization..."
           sleep 5
-          
-          echo ">>> Container logs (for diagnostic purposes):"
-          docker logs portal-corporativo
-          
-          echo ">>> Performing internal health check (via wget)..."
-          docker exec portal-corporativo wget --spider -S http://localhost:3000
-          
-          echo ">>> Publishing OWASP ZAP security report to web server..."
           docker cp qatests/report.html portal-corporativo:/usr/src/app/frontend/zap-report.html || true
 
-      - name: 7. Archive ZAP Report (Gitea Artifacts)
+      - name: 7. Archive ZAP Report
         if: always() && github.event_name == 'push' 
         uses: actions/upload-artifact@v3
         with: