ci: test wapiti reports

.github/actions/attack/action.yml

@@ -17,12 +17,20 @@ runs:
   using: composite
   steps:
     #
+    # wapiti
+    # emits .wapiti/generated_reports/report.html
+    # for now, base default scan
+    - name: Wapiti Scan
+      uses: gipo355/[email protected]
+      with:
+        target: "http://localhost:8080/tomcat-webapp-boilerplate/app"
+        github_token: ${{ inputs.github_token }}
     - name: ZAP Scan
       uses: zaproxy/action-full-scan@d2a07475d467566c9a3e3c700f31f47724aa1060 # v0.10.0
       with:
         token: ${{ inputs.pat }}
         # docker_name: ${{ env.TEST_TAG }}
-        target: "http://localhost:8080/tomcat-webapp-boilerplate"
+        target: "http://localhost:8080/tomcat-webapp-boilerplate/app"
         # rules_file_name: ".zap/rules.tsv"
         cmd_options: "-a"
     # TODO: ZAP emits json or creates an issue only

.github/workflows/vulnerability-scans.yml

@@ -85,12 +85,19 @@ jobs:
         run: mv ./report_json.json ./docs/gh-pages/zap/report_json.json
       - name: Copy snyk-container.sarif report to docs/gh-pages/snyk-container
         run: mv ./snyk-container.sarif ./docs/gh-pages/snyk-container/snyk-container.json
+      - name: Copy wapiti report to docs/gh-pages/nmap
+        # requires sudo as docker container creating those files runs as root
+        run: |
+          sudo mv ./.wapiti/generated_reports/* ./docs/gh-pages/wapiti/
       - name: Copy nmap report to docs/gh-pages/nmap
         # requires sudo as docker container creating those files runs as root
         run: |
           sudo mv ./nmap-reports/vulner/vulner-output.log ./docs/gh-pages/nmap/vulner-output.log
           sudo mv ./nmap-reports/direct/direct-output.log ./docs/gh-pages/nmap/direct-output.log
           sudo mv ./nmap-reports/vulscan/vulscan-output.log ./docs/gh-pages/nmap/vulscan-output.log
+      - name: Change ownerhip of docs/gh-pages
+        run: |
+          sudo chown -R $USER:$USER ./docs/gh-pages
       #
       # post all results to github pages
       - name: Deploy to GitHub Pages