added owasp step to code quality

swisstopo · Sep 27, 2024 · 494e67e · 494e67e
1 parent 9c8671d
commit 494e67e
Show file tree

Hide file tree

Showing 2 changed files with 74 additions and 257 deletions.
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
@@ -150,67 +150,77 @@ jobs:
         run: npx nx reset
       - name: Run build
         run: npm run build
-#  cypress:
-#    runs-on: ubuntu-latest
-#    needs:
-#      - test
-#      - lint
-#      - dependency-review
-#    strategy:
-#      # https://github.com/cypress-io/github-action/issues/48
-#      fail-fast: false
-#      matrix:
-#        # Use 2 parallel instances
-#        containers: [1, 2]
-#    steps:
-#      - name: Checkout repository
-#        uses: actions/checkout@v4
-#      - name: Setup node
-#        uses: actions/setup-node@v4
-#        with:
-#          node-version: ${{ env.NODE_VERSION }}
-#      - name: Restore cached node modules
-#        uses: actions/cache/restore@v4
-#        with:
-#          path: ./node_modules
-#          key: "${{ runner.os }}-node_modules-${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('**/schema.prisma') }}"
-#      - name: Start services
-#        env:
-#          DB_USER: ${{ env.DB_USERNAME }}
-#          DB_PASSWORD: ${{ env.DB_PASSWORD }}
-#        run: |
-#          cd development
-#          chmod +x ./init/elasticsearch/init.sh
-#          sed -i 's/- \.\/volumes\/elasticsearch\/data:\/usr\/share\/elasticsearch\/data//g' ./docker-compose.yaml
-#          docker compose up -d db oidc elasticsearch
-#          sleep 60
-#      - name: Migrate database
-#        run: npm run prisma -- migrate deploy
-#      - name: Restore cached e2e node modules
-#        uses: actions/cache/restore@v4
-#        with:
-#          path: ./e2e/node_modules
-#          key: "${{ runner.os }}-node_modules_e2e-${{ env.NODE_VERSION }}-${{ hashFiles('./e2e/package-lock.json') }}"
-#      - name: Cypress run
-#        uses: cypress-io/github-action@v6
-#        with:
-#          command: |
-#            npx cypress run \
-#              --browser edge \
-#              --record \
-#              --parallel \
-#              --key ${{ secrets.CYPRESS_RECORD_KEY }} \
-#              --ci-build-id ${{ github.repository }}-${{ github.head_ref || github.ref_name }}-${{ github.sha }}
-#          build: npm run build
-#          start: npm start
-#          wait-on: "http://localhost:4200"
-#          wait-on-timeout: 120
-#          working-directory: ./e2e
-#        env:
-#          VITE_APP_VERSION: 0.0.99+dev
-#          TZ: Europe/Zurich
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#      - name: Stop services
-#        run: |
-#          cd development
-#          docker compose down
+  cypress:
+    runs-on: ubuntu-latest
+    needs:
+      - test
+      - lint
+      - dependency-review
+    strategy:
+      # https://github.com/cypress-io/github-action/issues/48
+      fail-fast: false
+      matrix:
+        # Use 2 parallel instances
+        containers: [1, 2]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Setup node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+      - name: Restore cached node modules
+        uses: actions/cache/restore@v4
+        with:
+          path: ./node_modules
+          key: "${{ runner.os }}-node_modules-${{ env.NODE_VERSION }}-${{ hashFiles('package-lock.json') }}-${{ hashFiles('**/schema.prisma') }}"
+      - name: Start services
+        env:
+          DB_USER: ${{ env.DB_USERNAME }}
+          DB_PASSWORD: ${{ env.DB_PASSWORD }}
+        run: |
+          cd development
+          chmod +x ./init/elasticsearch/init.sh
+          sed -i 's/- \.\/volumes\/elasticsearch\/data:\/usr\/share\/elasticsearch\/data//g' ./docker-compose.yaml
+          docker compose up -d db oidc elasticsearch
+          sleep 60
+      - name: Migrate database
+        run: npm run prisma -- migrate deploy
+      - name: Restore cached e2e node modules
+        uses: actions/cache/restore@v4
+        with:
+          path: ./e2e/node_modules
+          key: "${{ runner.os }}-node_modules_e2e-${{ env.NODE_VERSION }}-${{ hashFiles('./e2e/package-lock.json') }}"
+      - name: Cypress run
+        uses: cypress-io/github-action@v6
+        with:
+          command: |
+            npx cypress run \
+              --browser edge \
+              --record \
+              --parallel \
+              --key ${{ secrets.CYPRESS_RECORD_KEY }} \
+              --ci-build-id ${{ github.repository }}-${{ github.head_ref || github.ref_name }}-${{ github.sha }}
+          build: npm run build
+          start: npm start
+          wait-on: "http://localhost:4200"
+          wait-on-timeout: 120
+          working-directory: ./e2e
+        env:
+          VITE_APP_VERSION: 0.0.99+dev
+          TZ: Europe/Zurich
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: OWASP ZAP Full Scan
+        uses: zaproxy/[email protected]
+        with:
+          target: "http://localhost:4200"
+          cmd_options: -a -j -U "admin" -n /zap/context/default.context
+      - name: Upload ZAP Scan Results
+        uses: actions/upload-artifact@v4
+        with:
+          name: zap_scan
+          path: ./zap/scan-results
+      - name: Stop services
+        run: |
+          cd development
+          docker compose down
diff --git a/.github/workflows/zap_scan.yaml b/.github/workflows/zap_scan.yaml