add DAST

.github/workflows/codeql.yml

@@ -36,25 +36,19 @@ jobs:
           languages: ${{ matrix.language }}
           queries: security-extended
 
-
       - uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: 21
 
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@v4
         with:
           gradle-version: current
 
-      - name: Gradle Build and Publish
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Gradle Build
         run: |
-          gradle build cyclonedxBom -x test \
-            -DGITHUB_REPOSITORY=${{ github.repository }} \
-            -DGITHUB_ACTOR=${{ github.actor }} \
-            -DGITHUB_TOKEN=$GITHUB_TOKEN
+          gradle build cyclonedxBom -x test
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -77,3 +71,51 @@ jobs:
         with:
           name: sbom
           path: build/resources/main/META-INF/sbom/application.cdx.json
+
+  DAST:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
+        with:
+          gradle-version: current
+
+      - name: Gradle Build
+        run: gradle build -x test -x integration
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: DAST - Build and run containerised app
+        run: |
+          docker compose -f docker/docker-compose.integration.yml up -d
+
+          echo "Waiting for health endpoint..."
+          for i in {1..30}; do
+            if curl -s http://localhost:8082/health > /dev/null; then
+              echo "App is healthy"
+              break
+            fi
+            echo "Waiting for app to be healthy ($i)..."
+            sleep 2
+          done
+
+      - name: Run OWASP ZAP DAST Scan
+        uses: zaproxy/action-baseline@v0.14.0
+        with:
+          target: "http://localhost:8082"
+          cmd_options: "-a -J zap_report.json -r zap_report.html"
+
+      - name: Upload ZAP HTML Report
+        uses: actions/upload-artifact@v4
+        with:
+          name: zap-html-report
+          path: zap_report.html