Merge pull request #1582 from SOOS-JAlvarez/soosdast

Add SOOS DAST starter workflow

code-scanning/properties/soos-dast-scan.properties.json

@@ -0,0 +1,7 @@
+{
+    "name": "SOOS DAST Scan",
+    "creator": "SOOS",
+    "description": "SOOS DAST is the easy-to-integrate no-limit web vulnerability scanner. Integrate SOOS DAST with your CI pipeline to find vulnerabilities by scanning a web app or APIs.",
+    "iconName": "soos",
+    "categories": ["Code Scanning"]
+}

code-scanning/soos-dast-scan.yml

@@ -0,0 +1,41 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# SOOS is the easy-to-integrate software security solution for your whole team, learn more at https://soos.io/
+#
+# To use this action you need to fill the following requirements:
+#
+# 1.  Create an account on https://app.soos.io to obtain a Client ID and API Key (Free 30 days trials for both our SCA/DAST product).
+#
+# 2.  Set up your API KEY/Client ID as Github Secrets named SOOS_CLIENT_ID & SOOS_API_KEY. (Also set SOOS_GITHUB_PAT with your Github Personal Access Token if you're going to use sarif upload)
+#
+
+name: "SOOS DAST Scan"
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    branches: [ $default-branch ]
+
+jobs:
+  soos:
+    permissions:
+      security-events: write # for uploading code scanning alert info
+    name: SOOS DAST Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run SOOS DAST Scan
+        uses: soos-io/soos-dast-github-action@5f8e2a1994d618e6ac9902e0f491fd1656b698e6
+        with:
+          client_id: ${{ secrets.SOOS_CLIENT_ID }}
+          api_key: ${{ secrets.SOOS_API_KEY }}
+          project_name: ${{ github.repository }} # If you're going to use SARIF the project name should be on the form of `repoowner/reponame` or use the token github.repository
+          scan_mode: "baseline"
+          target_url: "https://www.example.com/"
+          sarif: true # Only set to true if you want to upload the SARIF report to Github
+          gpat: ${{ secrets.SOOS_GITHUB_PAT }}
+
+

icons/soos.svg

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 25.3.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 600 600" style="enable-background:new 0 0 600 600;" xml:space="preserve">
+<style type="text/css">
+	.st0{fill:#FF2B55;}
+	.st1{fill:#001267;}
+</style>
+<g id="Layer_2_1_">
+	<g id="Layer_1-2">
+		<path class="st0" d="M231.4,411.4H48v-34.6h183.4c21.2,0.1,41.2-9.6,54.4-26.1l98.6-123c19.7-24.8,49.7-39.2,81.4-39.1H552v34.6
+			h-86.3c-21.2,0-41.2,9.6-54.4,26.1l-98.6,123C293,397.1,263,411.5,231.4,411.4z"/>
+		<path class="st1" d="M134.3,411.4H48v-34.6h86.3c21.2,0,41.2-9.6,54.4-26.1l98.6-123c19.7-24.8,49.7-39.2,81.4-39.1H552v34.6
+			H368.6c-21.2-0.1-41.2,9.6-54.4,26.1l-98.6,123C195.9,397.1,165.9,411.5,134.3,411.4z"/>
+	</g>
+</g>
+</svg>