devsecops.yml

name: DevSecOps
on:
  push:
    branches:
      - main
jobs:
  sonarcloud:
      name: SonarCloud
      runs-on: ubuntu-latest
      steps:
        - uses: actions/checkout@v4
          with:
            fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
        - name: SonarCloud Scan
          uses: SonarSource/sonarcloud-github-action@master
          env:
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
            SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  gitleaks:
      name: gitleaks
      runs-on: ubuntu-latest
      needs: sonarcloud
      steps:
        - uses: actions/checkout@v4
          with:
            fetch-depth: 0
        - uses: gitleaks/gitleaks-action@v2
          env:
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
            GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for Organizations, not personal accounts.

  snyk:
    runs-on: ubuntu-latest
    needs: sonarcloud
    steps:
      - uses: actions/checkout@master
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  zap_scan:
      runs-on: ubuntu-latest
      needs: sonarcloud
      name: ZAP
      steps:
  #      - name: Checkout
  #        uses: actions/checkout@v4
  #       with:
  #         ref: master
        - name: ZAP Scan
          uses: zaproxy/action-baseline@v0.13.0
          with:
            token: ${{ secrets.GITHUB_TOKEN }}
            docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
            target: 'http://demo.owasp-juice.shop'
            rules_file_name: '.zap/rules.tsv'
            cmd_options: '-a'