When GitHub Action no longer works. Integrate SAST and DAST in shell scripting.

说明与用途

local.sh 脚本将 SAST 与 DAST 集成到单一 CI 流水线中，帮助开发者在 PR 合并前快速发现漏洞。

问题

GitHub Actions pipelines fail to run both SAST and DAST scans efficiently, causing delays and missing runtime vulnerabilities.

结果

The script enables developers to run a full SAST+DAST pipeline locally, catching vulnerabilities before PR merge and reducing CI run time.

工作流

• 1. Trigger on code push or PR
• 2. Run Semgrep SAST in a Docker container
• 3. Build and start the application in a Docker container on port 8080
• 4. Wait for the app to respond using a curl health check loop
• 5. Run OWASP ZAP baseline scan against the local container
• 6. Handle ZAP exit codes and generate a report
• 7. Clean up containers on exit

证据

To bridge this gap, top engineering teams combine Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) inside their continuous integration pipelines.

来源

Below is example a complete, production-ready Shell scripting an alternative to GitHub Actions workflow file.

来源

docker run --rm -v "$(pwd):/src" returntocorp/semgrep semgrep scan \
--config=auto \
--error

来源

docker run --rm --network="host" -v "$(pwd):/zap/wrk/:rw" -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
-t http://localhost:8080 \
-g gen.conf \
-r zap_report.html || DAST_EXIT_CODE=$?

来源