When GitHub Action no longer works. Integrate SAST and DAST in shell scripting.

Описание и применение

Скрипт local.sh объединяет статический и динамический анализ безопасности в одном CI-пайплайне, позволяя разработчикам быстро выявлять уязвимости до слияния PR.

Задача

GitHub Actions pipelines fail to run both SAST and DAST scans efficiently, causing delays and missing runtime vulnerabilities.

Результат

The script enables developers to run a full SAST+DAST pipeline locally, catching vulnerabilities before PR merge and reducing CI run time.

Рабочий процесс

• 1. Trigger on code push or PR
• 2. Run Semgrep SAST in a Docker container
• 3. Build and start the application in a Docker container on port 8080
• 4. Wait for the app to respond using a curl health check loop
• 5. Run OWASP ZAP baseline scan against the local container
• 6. Handle ZAP exit codes and generate a report
• 7. Clean up containers on exit

Доказательства

To bridge this gap, top engineering teams combine Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) inside their continuous integration pipelines.

Источник

Below is example a complete, production-ready Shell scripting an alternative to GitHub Actions workflow file.

Источник

docker run --rm -v "$(pwd):/src" returntocorp/semgrep semgrep scan \
--config=auto \
--error

Источник

docker run --rm --network="host" -v "$(pwd):/zap/wrk/:rw" -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
-t http://localhost:8080 \
-g gen.conf \
-r zap_report.html || DAST_EXIT_CODE=$?

Источник