From 5afbb57dcc3c9032a395b8385ad67dee1ebdb182 Mon Sep 17 00:00:00 2001 From: pm Date: Sat, 13 Jun 2026 10:11:13 +0100 Subject: [PATCH] owasp zap config v8 --- .gitea/workflows/deploy.yml | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 2062be5..9b43079 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -48,27 +48,39 @@ jobs: - name: 5. Dynamic Security Scan (OWASP ZAP) if: github.event_name == 'push' run: | + echo ">>> 1. Limpeza profunda do ambiente..." docker rm -f apex-sandbox zap-scanner || true docker network rm zap-net || true - docker network create zap-net + docker volume rm zap-data || true + echo ">>> 2. Criar rede e iniciar Sandbox..." + docker network create zap-net docker run -d --name apex-sandbox --network zap-net apex-solutions:latest sleep 10 + echo ">>> 3. Preparar Volume do ZAP (Criar config localmente)..." mkdir -p qatests + docker volume create zap-data - # Mapeamos o diretório atual do runner para /zap/wrk/ + # A MAGIA ACONTECE AQUI: Escrevemos o ficheiro de configuração diretamente no volume! + docker run --rm -v zap-data:/zap/wrk alpine sh -c 'echo "FAIL_ON_SEVERITY: HIGH" > /zap/wrk/zap-baseline.conf' + + echo ">>> 4. Executar OWASP ZAP..." docker run --user root --name zap-scanner \ --network zap-net \ - -v "$(pwd):/zap/wrk/:rw" \ + -v zap-data:/zap/wrk/:rw \ -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ -t http://apex-sandbox:3000 \ -r report.html \ - -I -c zap-baseline.conf - + -I -c zap-baseline.conf || true + + echo ">>> 5. Recolher o relatório HTML..." docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true + + echo ">>> 6. Limpeza final..." docker rm -f zap-scanner apex-sandbox || true docker network rm zap-net || true + docker volume rm zap-data || true - name: 6. Production Deployment if: github.event_name == 'push' -- 2.52.0