The goal is to have a "Pentest Pipeline" that uses the OWASP ZAP.

The following GitHub Actions wrap the above packaged scans and also support raising GitHub issues for potential vulnerabilities found:

• ZAP Baseline Scan
• ZAP Full Scan
• ZAP API Scan
• GitHub Action Marketplace

Usage of ZAP in Docker:

• https://www.zaproxy.org/docs/docker/

For more details see the blog posts:

• Automate Security Testing with ZAP and GitHub Actions
• Dynamic Application Security Testing with ZAP and GitHub Actions

These GitHub actions are a simple way to run the packaged scans, especially if you already use GitHub.

This is a PoC. Tje result should be presented at:
https://heise-academy.de/webinare/devsecops923?wt_mc=intern.academy.newsticker.web_devsecops.ticker-1.link.link