owasp_zap_full.yml

---
name: OWASP ZAP Full Scan

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  schedule:
    - cron: "30 3 * * SAT" # every Saturday at 3:30am

permissions: read-all

jobs:
  ZAP:
    name: OWASP ZAP Full Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: OWASP ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.4.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          docker_name: "owasp/zap2docker-stable"
          # yamllint disable-line rule:line-length
          target: "https://federalist-edd11e6f-8be2-4dc2-a85e-1782e0bcb08e.app.cloud.gov/site/gsa/usagov-benefits-eligibility/"
          rules_file_name: ".zap/rules.tsv"
          cmd_options: "-a -n .zap/context.txt"