owasp zap config

.gitea/workflows/deploy.yml

@@ -59,31 +59,30 @@ jobs:
       - name: 5. Dynamic Security Scan (OWASP ZAP)
         if: github.event_name == 'push'
         run: |
+          echo ">>> Creating isolated network for DAST..."
+          docker network create zap-net
+          
           echo ">>> Provisioning ephemeral sandbox environment..."
-          docker rm -f apex-sandbox || true
-          docker run -d --name apex-sandbox apex-solutions:latest
-          sleep 5
+          docker run -d --name apex-sandbox --network zap-net apex-solutions:latest
+          sleep 10 # Aumentei para 10s para garantir que o Node arranca bem
           
           echo ">>> Initiating OWASP ZAP Baseline Scan..."
           mkdir -p qatests
-          docker rm -f zap-scanner || true
-          docker volume rm zap-reports || true
-          docker volume create zap-reports
           
+          # O ZAP precisa de aceder ao contentor pela rede criada
           docker run --user root --name zap-scanner \
-            --link apex-sandbox:apex-sandbox \
+            --network zap-net \
             -v zap-reports:/zap/wrk/:rw \
             -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
             -t http://apex-sandbox:3000 \
             -r report.html \
-            -I
+            -I -c zap-baseline.conf
           
           docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
           
-          echo ">>> Decommissioning ephemeral sandbox..."
-          docker rm -f zap-scanner || true
-          docker volume rm zap-reports || true
-          docker rm -f apex-sandbox || true
+          echo ">>> Decommissioning ephemeral sandbox and network..."
+          docker rm -f zap-scanner apex-sandbox || true
+          docker network rm zap-net || true
 
       - name: 6. Production Deployment & Local Reports
         if: github.event_name == 'push'