Automate OWASP ZAP DAST by integrating the ZAP Docker image into your CI pipeline, running a baseline scan with the active scan API, and failing the build when any alert exceeds a defined risk threshold.
Steps
1. Add ZAP Docker to the pipeline
```bash
docker pull owasp/zap2docker-stable:latest
```
2. Start ZAP in daemon mode
```bash
docker run -u zap -d -p 8090:8090 \
-v $(pwd)/zap-reports:/zap/wrk \
owasp/zap2docker-stable zap.sh -daemon -port 8090 -host 0.0.0.0 \
-config api.disablekey=true
```
3. Define target URL and context (optional for authentication). Example for JWT‑protected API:
```json
{
"loginUrl": "https://api.example.com/auth",
"loginRequest": "{\"user\":\"test\",\"pass\":\"test\"}",
"tokenHeader": "Authorization",
"tokenPrefix": "Bearer "
}
```
4. Run the baseline scan (quick sanity check)
```bash
docker exec -i $(docker ps -q -f ancestor=owasp/zap2docker-stable) \
zap-baseline.py -t https://staging.example.com -r zap-report.html \
-g gen.conf -J -m 2
```
-m 2 sets the maximum alert risk level to Medium; the build exits with non‑zero code if a higher‑risk issue is found.
5. Execute a full active scan for deeper coverage
```bash
docker exec -i $(docker ps -q -f ancestor=owasp/zap2docker-stable) \
zap-full-scan.py -t https://staging.example.com -r zap-full-report.html \
-j -m 1
```
-m 1 fails on Low or higher alerts; adjust per policy.
6. Publish reports – attach zap-report.html and zap-full-report.html as artifacts.
7. Fail the pipeline – in Jenkins, GitLab CI, or GitHub Actions, check the exit code of the scan commands and use error/failFast to abort on violations.
Quick checklist
- [ ] ZAP Docker image version pinned.
- [ ] Daemon runs on a fixed port.
- [ ] Context file includes authentication if needed.
- [ ] Baseline -m matches your risk appetite.
- [ ] Reports archived as CI artifacts.
- [ ] Build fails on non‑zero exit.