feat: penetration tests and reporting (#117)

.github/workflows/pentests.yml

@@ -0,0 +1,29 @@
+name: Penetration Tests
+
+on:
+  schedule: [cron: "0 11 * * 6"] # 3 AM PST = 12 PM UDT, Saturdays
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zap_scan:
+    name: Penetration Tests
+    env:
+      DOMAIN: apps.silver.devops.gov.bc.ca
+      PREFIX: ${{ github.event.repository.name }}-test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        component: [backend, frontend]
+    steps:
+      - name: ZAP Scan
+        uses: zaproxy/[email protected]
+        with:
+          allow_issue_writing: true
+          artifact_name: "zap_${{ matrix.component }}"
+          cmd_options: "-a"
+          issue_title: "ZAP: ${{ matrix.component }}"
+          target: https://${{ env.PREFIX }}-${{ matrix.component }}.${{ env.DOMAIN }}

.github/workflows/pr-close.yml

@@ -1,4 +1,4 @@
-name: Pull Request Closed
+name: PR Closed
 
 on:
   pull_request:

.github/workflows/pr-open.yml

@@ -1,4 +1,4 @@
-name: Pull Request
+name: PR
 
 on:
   pull_request:
@@ -31,7 +31,7 @@ jobs:
             Thanks for the PR!
 
             Any successful deployments (not always required) will be available below.
-            [Backend](https://${{ env.PREFIX }}-backend.${{ env.DOMAIN }})
+            [Backend](https://${{ env.PREFIX }}-backend.${{ env.DOMAIN }}/actuator/health)
             [Frontend](https://${{ env.PREFIX }}-frontend.${{ env.DOMAIN }})
 
             Once merged, code will be promoted and handed off to following workflow run.