service-dast-scanner.yaml

name: Service DAST Scanner

on:
  workflow_call:
    inputs:
      path:
        description: 'Path to the project directory'
        required: true
        type: string
      port:
        description: 'Port number of the service'
        required: true
        type: number
      dbName:
        description: 'Database name of the service'
        required: false
        type: string

jobs:
  dast-scanner:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:alpine
        ports:
          - 5432:5432
        env:
          POSTGRES_DB: ${{ inputs.dbName }}
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        options: >-
          --health-cmd="pg_isready -U postgres"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=5

      zookeeper:
        image: wurstmeister/zookeeper
        ports:
          - "2181:2181"

      kafka:
        image: wurstmeister/kafka:latest
        ports:
          - 29092:29092
        env:
          KAFKA_BROKER_ID: 1
          KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
          KAFKA_ADVERTISED_HOST_NAME: localhost
          KAFKA_ADVERTISED_LISTENERS: INTERNAL://localhost:29092
          KAFKA_LISTENERS: INTERNAL://:29092
          KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INTERNAL:PLAINTEXT
          KAFKA_INTER_BROKER_LISTENER_NAME: INTERNAL

    steps:
      - name: Checkout to repo
        uses: actions/checkout@v4

      - name: Setup Java JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'corretto'
          java-version: '17'
          cache: 'gradle'

      - name: Start the application
        run: cd ${{ inputs.path }} && ./gradlew bootRun &
        env:
          SPRING_PROFILES_ACTIVE: github-ci-cd
          DB_HOST: localhost
          DB_PORT: 5432
          DB_USERNAME: postgres
          DB_PASSWORD: postgres
          KAFKA_BROKER_URL: localhost:29092

      - name: Run OWASP ZAP Scanner
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: 'http://localhost:${{ inputs.port }}'
          fail_action: false
          docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
          allow_issue_writing: false
          artifact_name: 'ZAP Scanner report'