nightly_scans.yml

name: Nightly Security Analysis
on:
  workflow_dispatch:
  schedule:
    # cron format: 'minute hour dayofmonth month dayofweek'
    # this will run at 8AM UTC every day (3am EST / 4am EDT)
    - cron: '0 8 * * *'

jobs:
  dast-scan:
    name: OWASP Zap Scan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3

      - name: Run OWASP Zap Scan on live-dev
        uses: zaproxy/action-full-scan@6eade0f93b10fad8cfb4e63b979703a2cbd0cc98 # v0.4.0
        with:
          docker_name: 'owasp/zap2docker-stable'
          target: 'https://ops-dev.fr.cloud.gov/'
          allow_issue_writing: false
          fail_action: false
          cmd_options: '-I'

      ## Manually reviewed the action, and validated it performs basic
      ## conversion from zap.json to zap.sarif.
      ## Reviewed by tdonaworth 08.09.2022
      - name: Create sarif file from zaproxy results
        uses: SvanBoxel/zaproxy-to-ghas@cfc77481d74a17a4c3d6b753aa9d7abef453d501 # v1.0.2

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@6c089f53dd51dc3fc7e599c3cb5356453a52ca9e # v2
        with:
          sarif_file: results.sarif