Skip to content

Commit f17b43c

Browse files
francisco-videira-nhsfrancisco-videira-nhs
committed
Add act workflow
1 parent bc2a0f2 commit f17b43c

3 files changed

Lines changed: 232 additions & 181 deletions

File tree

‎.github/workflows/zap-active-scan-act.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: ZAP API Active Scan
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
target_env_oas:
7+
description: "Target proxygen environment OAS"
8+
required: true
9+
default: "internal-dev"
10+
11+
jobs:
12+
zap-api-scan:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v4
17+
18+
- name: Run ZAP API Scan (active)
19+
id: scan
20+
uses: zaproxy/action-api-scan@v0.10.0
21+
env:
22+
# Set the Authorization header value for ZAP
23+
ZAP_AUTH_HEADER_VALUE: "Bearer ${{ secrets.TEMP_ACCESS_TOKEN }}"
24+
with:
25+
target: "build/notify-supplier-int.json"
26+
format: openapi
27+
fail_action: true
28+
cmd_options: "-a"
29+
allow_issue_writing: false
30+
31+
- name: Upload ZAP HTML report
32+
if: steps.scan.outcome == 'success'
33+
uses: actions/upload-artifact@v4
34+
with:
35+
name: zap-report
36+
path: report_html.html
37+
38+
- name: Upload ZAP JSON report
39+
if: steps.scan.outcome == 'success'
40+
uses: actions/upload-artifact@v4
41+
with:
42+
name: zap-report-json
43+
path: report_json.json

‎.github/workflows/zap-active-scan.yml‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
# name: ZAP API Active Scan
2+
3+
# on:
4+
# # schedule:
5+
# # - cron: "0 3 * * *" # nightly 3am
6+
# workflow_dispatch:
7+
# inputs:
8+
# target_env_oas:
9+
# description: "Target proxygen environment OAS"
10+
# required: true
11+
# default: "internal-dev"
12+
# # kid_name:
13+
# # description: "KID name for JWT authentication"
14+
# # required: true
15+
# # default: "int-dev-1"
16+
17+
# jobs:
18+
# metadata:
19+
# name: "Set CI/CD metadata"
20+
# runs-on: ubuntu-latest
21+
# timeout-minutes: 1
22+
# outputs:
23+
# build_datetime_london: ${{ steps.variables.outputs.build_datetime_london }}
24+
# build_datetime: ${{ steps.variables.outputs.build_datetime }}
25+
# build_timestamp: ${{ steps.variables.outputs.build_timestamp }}
26+
# build_epoch: ${{ steps.variables.outputs.build_epoch }}
27+
# nodejs_version: ${{ steps.variables.outputs.nodejs_version }}
28+
# python_version: ${{ steps.variables.outputs.python_version }}
29+
# terraform_version: ${{ steps.variables.outputs.terraform_version }}
30+
# version: ${{ steps.variables.outputs.version }}
31+
# is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
32+
# steps:
33+
# - name: "Checkout code"
34+
# uses: actions/checkout@v5
35+
# - name: "Set CI/CD variables"
36+
# id: variables
37+
# run: |
38+
# datetime=$(date -u +'%Y-%m-%dT%H:%M:%S%z')
39+
# version=$(head -n 1 .version 2> /dev/null || echo unknown)
40+
# echo "build_datetime_london=$(TZ=Europe/London date --date=$datetime +'%Y-%m-%dT%H:%M:%S%z')" >> $GITHUB_OUTPUT
41+
# echo "build_datetime=$datetime" >> $GITHUB_OUTPUT
42+
# echo "build_timestamp=$(date --date=$datetime -u +'%Y%m%d%H%M%S')" >> $GITHUB_OUTPUT
43+
# echo "build_epoch=$(date --date=$datetime -u +'%s')" >> $GITHUB_OUTPUT
44+
# echo "nodejs_version=$(grep "^nodejs\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
45+
# echo "python_version=$(grep "^python\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
46+
# echo "terraform_version=$(grep "^terraform\s" .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT
47+
# echo "version=$(echo $version)" >> $GITHUB_OUTPUT
48+
# echo "is_version_prerelease=$(if [[ $version == *-* ]]; then echo "true"; else echo "false"; fi)" >> $GITHUB_OUTPUT
49+
# - name: "List variables"
50+
# run: |
51+
# export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
52+
# export BUILD_DATETIME="${{ steps.variables.outputs.build_datetime }}"
53+
# export BUILD_TIMESTAMP="${{ steps.variables.outputs.build_timestamp }}"
54+
# export BUILD_EPOCH="${{ steps.variables.outputs.build_epoch }}"
55+
# export NODEJS_VERSION="${{ steps.variables.outputs.nodejs_version }}"
56+
# export PYTHON_VERSION="${{ steps.variables.outputs.python_version }}"
57+
# export TERRAFORM_VERSION="${{ steps.variables.outputs.terraform_version }}"
58+
# export VERSION="${{ steps.variables.outputs.version }}"
59+
# export IS_VERSION_PRERELEASE="${{ steps.variables.outputs.is_version_prerelease }}"
60+
# make list-variables
61+
62+
# # - name: "Build OAS spec"
63+
# # uses: ./.github/actions/build-oas-spec
64+
# # with:
65+
# # version: "${{ inputs.version }}"
66+
# # apimEnv: "${{ matrix.apimEnv }}"
67+
# # buildSandbox: false
68+
# # nodejs_version: ${{ inputs.nodejs_version }}
69+
# # NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
70+
71+
# zap-api-scan:
72+
# runs-on: ubuntu-latest
73+
# steps:
74+
# - name: Checkout
75+
# uses: actions/checkout@v4
76+
77+
# - name: Setup Node
78+
# uses: actions/setup-node@v4
79+
# with:
80+
# node-version: 22
81+
# registry-url: "https://npm.pkg.github.com"
82+
# scope: "@nhsdigital"
83+
# always-auth: true
84+
85+
# - name: Npm install
86+
# working-directory: .
87+
# env:
88+
# NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN }}
89+
# run: npm ci
90+
# shell: bash
91+
92+
# - name: Set up dependencies
93+
# working-directory: .
94+
# shell: bash
95+
# run: |
96+
# apt-get update && apt-get -y install gettext-base
97+
98+
# - name: Build OAS File
99+
# working-directory: .
100+
# shell: bash
101+
# run: |
102+
# echo "Building env specific JSON OAS spec"
103+
# make build-json-oas-spec APIM_ENV=${{ inputs.target_env_oas }}
104+
# # jq 'del(.servers[] | select(.url == "http://127.0.0.1:9000")) | .servers += [{ "url": "https://internal-dev.api.service.nhs.uk/nhs-notify-supplier"}]' build/notify-supplier.json > build/notify-supplier.json
105+
106+
# # - name: "Setup ASDF"
107+
# # uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
108+
109+
# # - name: Install python
110+
# # run: |
111+
# # asdf install python || true
112+
# # echo "Installed python version:"
113+
# # python --version
114+
115+
# # - name: Configure AWS Credentials
116+
# # uses: aws-actions/configure-aws-credentials@v5
117+
# # with:
118+
# # role-to-assume: arn:aws:iam::${{ secrets.SUPPLIERS_DEV_AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ASSUME_ROLE_NAME }}
119+
# # role-session-name: ${{ github.run_id }}
120+
# # aws-region: eu-west-2
121+
# # role-skip-session-tagging: true
122+
123+
# # - name: Fetch private key from SSM (parameter store) and save to file
124+
# # id: fetch_key
125+
# # run: |
126+
# # aws ssm get-parameter --name "/jwt/kids/${KID_NAME}" --with-decryption --query "Parameter.Value" --output text > "${KID_NAME}.pem"
127+
# # chmod 600 "${KID_NAME}.pem"
128+
# # env:
129+
# # KID_NAME: ${{ env.KID_NAME }}
130+
131+
# # - name: Get JWT bearer token (run your Python script)
132+
# # id: get_token
133+
# # run: |
134+
# # python ./scripts/JWT/get_bearer_token.py --kid "${KID_NAME}.pem" --env "int" --appid "${{ secrets.APIGEE_APPKEY }}" > jwt_output.json
135+
136+
# # ACCESS_TOKEN=$(jq -r '.access_token // empty' jwt_output.json || true)
137+
138+
# # echo "token=$ACCESS_TOKEN" >> $GITHUB_OUTPUT
139+
# # env:
140+
# # KID_NAME: ${{ env.KID_NAME }}
141+
# # APIGEE_APPKEY: ${{ secrets.APIGEE_APPKEY }}
142+
143+
# # - name: Install Proxygen client
144+
# # shell: bash
145+
# # run: |
146+
# # # Install proxygen cli
147+
# # pip install pipx
148+
# # pipx install proxygen-cli
149+
150+
# # # Setup proxygen auth and settings
151+
# # mkdir -p ${HOME}/.proxygen
152+
# # echo -n $PROXYGEN_PRIVATE_KEY | base64 --decode > ${HOME}/.proxygen/key
153+
# # envsubst < ./.github/proxygen-credentials-template.yaml > ${HOME}/.proxygen/credentials.yaml
154+
# # envsubst < ./.github/proxygen-credentials-template.yaml | cat
155+
# # envsubst < ./.github/proxygen-settings.yaml > ${HOME}/.proxygen/settings.yaml
156+
# # envsubst < ./.github/proxygen-settings.yaml | cat
157+
158+
# # - name: Obtain OAS from target via Proxygen
159+
# # run: |
160+
# # proxygen instance get ${{ env.TARGET_ENV }} nhs-notify-supplier
161+
162+
# - name: Run ZAP API Scan (active)
163+
# uses: zaproxy/action-api-scan@v0.10.0
164+
# env:
165+
# # Set the Authorization header value for ZAP
166+
# ZAP_AUTH_HEADER_VALUE: "Bearer ${{ secrets.TEMP_ACCESS_TOKEN }}"
167+
# with:
168+
# target: "build/notify-supplier.json"
169+
# format: openapi
170+
# fail_action: true
171+
# cmd_options: >
172+
# -d
173+
# -a
174+
# -J zap-report.json
175+
# -r zap-report.html
176+
177+
# - name: Upload ZAP HTML report
178+
# if: always()
179+
# uses: actions/upload-artifact@v4
180+
# with:
181+
# name: zap-report
182+
# path: zap-report.html
183+
184+
# - name: Upload ZAP JSON report
185+
# if: always()
186+
# uses: actions/upload-artifact@v4
187+
# with:
188+
# name: zap-report-json
189+
# path: zap-report.json

0 commit comments

Comments
 (0)