owasp zap config v3

.gitea/workflows/deploy.yml

@@ -80,6 +80,34 @@ jobs:
           
           docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
           
+          echo ">>> Decommissioning ephemeral sandbox and network..."
+          docker rm -f zap-scanner apex-sandbox || true
+          docker network rm zap-net || true- name: 5. Dynamic Security Scan (OWASP ZAP)
+        if: github.event_name == 'push'
+        run: |
+          echo ">>> Preparing isolated network for DAST..."
+          # Tenta remover a rede caso ela exista de uma execução anterior
+          docker network rm zap-net || true
+          docker network create zap-net
+          
+          echo ">>> Provisioning ephemeral sandbox environment..."
+          docker rm -f apex-sandbox || true
+          docker run -d --name apex-sandbox --network zap-net apex-solutions:latest
+          sleep 10
+          
+          echo ">>> Initiating OWASP ZAP Baseline Scan..."
+          mkdir -p qatests
+          
+          docker run --user root --name zap-scanner \
+            --network zap-net \
+            -v ${{ github.workspace }}:/zap/wrk/:rw \
+            -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
+            -t http://apex-sandbox:3000 \
+            -r report.html \
+            -I -c zap-baseline.conf
+          
+          docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true
+          
           echo ">>> Decommissioning ephemeral sandbox and network..."
           docker rm -f zap-scanner apex-sandbox || true
           docker network rm zap-net || true