Migrating added and archiving completed

README.md

@@ -1,22 +1,35 @@
-## 🚨 Repository will be archived🚨
+## 🚨 Repository archived🚨
 
-At April 2nd 2024, this repository is marked as "WILL BE ARCHIVED". It will be archived in the coming months and will no longer be maintained anymore.
+At April 2nd 2024, this repository was marked as "WILL BE ARCHIVED". At May 13th 2024 it was actually archived. It will not be maintained anymore.
 
-## Why will this repository be archived?
+## Why is this repository archived?
 
-The purpose of this project was to add the option for authenticated scans mainly (and also to add Blind XSS payloads as a bonus). Meanwhile, ZAP supports this out-of-the-box. Besides that, ZAP is in the process of being updated to use Automation Framework for most of the tasks which changes the way scans are performed.
+The purpose of this project was to add the option for authenticated scans mainly (and also to add Blind XSS payloads as a bonus). Meanwhile, ZAP supports this out-of-the-box. Besides that, ZAP is (in the process of) being updated to use Automation Framework all tasks which changes the way scans are performed.
 
-## What should I do if I'm currently still using zap2docker-weekly?
+## Migrating from zap2docker-weekly to ZAP Automation Framework
 
-It's advisable to plan a migration where zap2docker-weekly will be phased out. It's advisable to use ZAP's Automation Framework in the latest version of ZAP to create an Automation Plan and test and use this plan both manually as well as in your CI/CD pipeline. If you have questions about this migration, please see "Get in touch" below, we would like to help! More details about migration will be shared on this page when archiving will be finalized.
+If you are still using zap2docker-weekly in your pipeline, it's advisable to plan a migration. It's advisable to use ZAP's Automation Framework in the latest version of ZAP to create an Automation Plan and test and use this plan both manually as well as in your CI/CD pipeline. You can follow the steps below.
+
+1. Familiarize yourself with the ZAP Automation Framework. A good starting point for this is https://www.zaproxy.org/docs/desktop/addons/automation-framework/. YouTube also has some very valuable videos about all aspects of the Automation Framework (https://www.youtube.com/@psiinon).
+2. Download and get used to the ZAP desktop application.
+3. Create a new Automation Plan using the ZAP desktop application.
+4. Analyze your current zap2docker-weekly usage. Identify the specific command parameters and configurations you need to replicate in your automation plan.
+5. Build your Automation Plan step-by-step to mirror your existing workflow. Pay close attention to spidering, active scanning, and report generation. Also, don't forget any custom scripts or exceptions built in for already managed false positives. This step is highly dependent on the project's specifics and the frameworks used.
+6. Test all steps individually and verify the report is as expected.
+7. Save your Automation Plan (as a YAML file) and add it to version control.
+8. Replace the current dependency step in your pipeline configuration (with something like "zap-cli -autorun plan.yaml"). If needed, the parameterization used can be transformed to be used by the Automation Plan.
+9. Run the full pipeline and thoroughly review the results. Verify that everything is working as expected.
+10. Set up periodic reviews of your Automation Plan (e.g., monthly or quarterly). Keep the ZAP software and any associated plugins up-to-date. As your application evolves, revisit and update your Automation Plan to ensure it remains effective.
+
+If you need more help, please feel free to contact us (see "Get in touch" below). We can also provide a short demontration of the ZAP desktop application to get you up to speed.
 
 ## What if I don't migrate?
 
-Probably, you will not notice. But it's very important to note that the base image where zap2docker-weekly is based on will NOT be maintained anymore since March 2024. So the reports being generated by zap2docker-weekly might not be accurate since that date and future changes to the way ZAP works (and vulnerabilities are being scanned an reported) might be missed. So it's NOT advisable
+Probably, you will not notice on short term. But it's very important to note that the base image where zap2docker-weekly is based on will NOT be maintained anymore since March 2024. So the reports being generated by zap2docker-weekly might not be accurate since that date and future changes to the way ZAP works (and vulnerabilities are being scanned an reported) might be missed. It's also possible that the original image will be removed so the existing pipeline will break. So it's NOT advisable to skip migrating.
 
-It is (only) a set of scripts to start several open source security tools but since some of them are deprecated or changed and all information in this repository is also available in documentation of the specific tools, there's no reason to keep it alive.
+The remainder of this README is preserved for archival purposes.
 
-# Automatic Authentication for OWASP ZAP Docker [WILL BE ARCHIVED]
+# Automatic Authentication for OWASP ZAP Docker
 
 This project adds support to perform authenticated scans using the OWASP ZAP Docker [scanscripts](https://www.zaproxy.org/docs/docker/). These main features are available: