Nightly Security Analysis #419

	name: Nightly Security Analysis
	on:
	workflow_dispatch:
	schedule:
	# cron format: 'minute hour dayofmonth month dayofweek'
	# this will run at 8AM UTC every day (3am EST / 4am EDT)
	- cron: '0 8 * * *'

	jobs:
	dast-scan:
	name: OWASP Zap Scan
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4

	- name: Run OWASP Zap Scan on live-dev
	uses: zaproxy/action-full-scan@e058236b1221595033527ccc8a79959c7396d53f # v0.7.0
	with:
	docker_name: 'owasp/zap2docker-stable'
	target: 'https://ops-dev.fr.cloud.gov/'
	allow_issue_writing: false
	fail_action: false
	cmd_options: '-I'

	## Manually reviewed the action, and validated it performs basic
	## conversion from zap.json to zap.sarif.
	## Reviewed by tdonaworth 08.09.2022
	- name: Create sarif file from zaproxy results
	uses: SvanBoxel/zaproxy-to-ghas@cfc77481d74a17a4c3d6b753aa9d7abef453d501 # v1.0.2

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@0116bc2df50751f9724a2e35ef1f24d22f90e4e1 # v2
	with:
	sarif_file: results.sarif

Provide feedback