devsecops.yml

name: DevSecOps Pipeline
on: pull_request
  branches: master, main
jobs: 
  sonarcloud:
    needs: recon
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
      with:
        # Disabling shallow clone is recommended for improving relevancy of reporting
        fetch-depth: 0
    - name: SonarCloud Scan
      uses: sonarsource/sonarcloud-github-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

  snyk:
    runs-on: ubuntu-latest
    needs: sonarcloud
    steps:
      - uses: actions/checkout@master
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master # For node projects, change accordingly
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}    
        with:
          command: monitor

  zap_scan:
    runs-on: ubuntu-latest
    name: zap
    needs: snyk
    steps:
      - name: Checkout
        uses: actions/checkout@v2
        with:
          ref: master
      - name: ZAP Scan
        uses: zaproxy/action-baseline@v0.6.1
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          docker_name: 'owasp/zap2docker-stable'
          target: 'http://test.com' # Change URL or IP of your target application
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a'