main.yml

# This is a basic workflow to help you get started with Actions

name: CICD

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the master branch
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build_app_then_launch:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest
    name: Scan all the things
    steps:
      - uses: actions/checkout@v2 
      #Let's start up our app!
      - name: Docker-Compose
        run: |
          sudo docker-compose up -d
          sudo docker-compose config
      #sleep so that the app has time to fully start before we scan
      - run: sleep 30s

      #let's do some DAST! 
      #- name: OWASP ZAP FULL Scan
      #  uses: zaproxy/action-full-scan@v0.2.0
      #  with:
      #    target: 'http://localhost:8000'
      #    fail_action: 'false'
      #    token: ${{ secrets.GITHUB_TOKEN }}
  
      - name: cloud defense
        uses: cdefense/actions/node@master
        with:
          project-name: brokencrystals
          api-key: ${{ secrets.cloud_defense }}