dast-test.yaml

name: deploy

on:
  push:
    branches: ["main"]

jobs:
  build:
    name: SAST Test

    runs-on: ubuntu-latest

    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    steps:
      - uses: actions/checkout@v3
        name: Checkout code

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: 'javascript'

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
  dast:
    name: ZAP - DAST Test
    runs-on: ubuntu-latest

    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@v3
        name: Checkout code

      - name: run api
        run: |
          npm install
          npm run dev&

      - name: ZAP Scan
        uses: zaproxy/action-api-scan@v0.7.0
        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          target: 'http://localhost:3000/search?q=123'