dast.yml

name: DAST
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  dast:
    timeout-minutes: 60
    runs-on: ubuntu-latest

    services:
      redis:
        image: redis
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 6379:6379
      postgres:
        image: postgres:latest

        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_USER: postgres
          POSTGRES_DB: crappy_test

        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432
    steps:
    - uses: actions/checkout@v4
    - name: Run migrations
      run: psql -f migrations/init.sql postgresql://postgres:postgres@localhost:5432/crappy_test
    - name: Run seeds
      run: |
        psql -f .github/workflows/seeds/users.sql postgresql://postgres:postgres@localhost:5432/crappy_test &&
        psql -f .github/workflows/seeds/boards.sql postgresql://postgres:postgres@localhost:5432/crappy_test
    - name: Set up Gleam, Beam
      uses: erlef/setup-beam@v1
      with:
        otp-version: "26.0.2"
        gleam-version: "1.4.1"
        rebar3-version: "3"
    - run: gleam deps download
    - run: gleam build
    - name: "Start Backend"
      env:
        BASE_URL: http://localhost:8000
        SECRET_KEY_BASE: test-secret-key
        EMAIL_API_KEY: "fake-emil-api-key"
        REDIS_HOST: localhost
        PG_USER: postgres
        PG_PASSWORD: postgres
        PG_HOST: localhost
        PG_PORT: 5432
        PG_DB: crappy_test
      run: |
        gleam run &
        sleep 30 &&
        curl http://localhost:8000 -I
    - name: ZAP Scan
      uses: zaproxy/action-full-scan@v0.10.0
      with:
        docker_name: 'ictu/zap2docker-weekly:latest'
        target: 'http://localhost:8000'
        allow_issue_writing: false
        cmd_options: |
          '-a --hook=/zap/auth_hook.py -z "auth.loginurl=http://localhost:8000/signin
          auth.auto
          auth.username='aaa@aaa.com'
          auth.password='aaaaaaaa'
          auth.username_field="email"
          auth.password_field="password"
          auth.auto=1
          auth.submit_field="submit"
          auth.exclude='.*signout.*'
          "'