unit-sec-test.yml

name: Unit and Security Testing
on:
  workflow_call:

jobs: 
    # Run unit test cases for the Docker image
  testing_phase:
    name: Run unit test
    runs-on: ubuntu-latest

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
    
    - name: Install dependencies
      run: pip install -r requirements.txt

    - name: Run tests
      run: pytest tests/


  # Run snyk code scanning for vulnerabilities
  snyk_scan:      
    permissions:
      contents: read
      security-events: write
      actions: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.12.5"

  
      - name: Install dependencies
        run: pip install -r requirements.txt
          
      - name: Install Snyk CLI
        uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb

        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      - name: Snyk Code test
        run: snyk code test --sarif > snyk-cide.sarif

      - name: Snyk Test Dependencies
        run: snyk test


  # Scan the contianer and lists all security vulnerabilities
  trivy_scans:
    name: Run Trivy security scanner against the image
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
        with:
          image-ref: 'awesome-fastapi:${{ github.sha }}'
          format: 'template'
          template: '@/contrib/sarif.tpl'
          output: 'GitHub Actions/Trivy Automation'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  owasp_zap_scan:
        runs-on: ubuntu-latest
        name: app scan
        steps:
         - name: Checkout
           uses: actions/checkout@v4
           with:
            ref: master
        
         - name: zap scan
           uses: zaproxy/action-api-scan@v0.9.0
           with:
            token: ${{ secrets.GITHUB_TOKEN}}
            docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
            format: openapi
            target: '<fast-api-url>'
            rules_file_name: '.zap/rules.tsv'
            cmd_options: '-a'