Skip to content

ZAP DAST Scanner

ZAP DAST Scanner - Reusable Workflow

Runs the ZAP DAST scanner via the argus Python CLI. Equivalent to: python -m argus scan zap --target

For GHES users: Use the composite action directly instead of this workflow. See: examples/github-enterprise/dast-scanning.yml

uses: huntridge-labs/argus/.github/workflows/scanner-zap.yml@1.1.0

Triggers

  • Manual dispatch
  • Reusable (called by other workflows)

Permissions

Scope Access
contents read
actions read
packages read
pull-requests write

Inputs

Input Description Required Default
scan_name Unique scan identifier (for artifact naming) string No zap-scan
scan_mode Target mode: url, docker-run, or compose string No url
scan_type ZAP scan type: baseline, full, or api string No baseline
target_url Target URL for baseline/full scans string No —
api_spec OpenAPI/Swagger spec URL (for api scans) string No —
healthcheck_url URL to poll until target is ready string No —
app_image_ref Container image (for docker-run mode) string No —
app_build_context Docker build context (for local builds) string No —
app_dockerfile Dockerfile path (for local builds) string No —
app_image_tag Tag for locally built image string No —
app_ports Port mappings (e.g., 8080:8080) string No 8080:8080
compose_file Docker compose file path string No docker-compose.yml
compose_build Run docker compose with --build boolean No True
max_duration_minutes Max scan duration in minutes number No 10
rules_file_name ZAP rules file to ignore alerts (.tsv) string No —
cmd_options Additional ZAP command-line options string No —
fail_on_severity Fail threshold: none, low, medium, high, critical string No none
allow_failure Continue workflow on scan failure boolean No False
post_pr_comment Post results as PR comment boolean No False
allow_issue_writing Enable ZAP native GitHub Issue creation boolean No False
registry_username Registry username (for private images) string No —

Secrets

Secret Description Required
registry_password Registry password/token for private images No

Jobs

zap-scan — ZAP ${{ inputs.scan_type }} scan

Runs on: ubuntu-latest · Timeout: 60 minutes · Continue on error: Yes

Steps:

  1. Checkout repository — actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
  2. Set up Python — actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
  3. Install Argus
  4. Run scan
  5. Upload artifacts — actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
  6. Comment PR with results — huntridge-labs/argus/.github/actions/comment-pr@1.1.0