OWASP ZAP Setup - EL-Kae/SAST_DAST_Tools GitHub Wiki

Below is the step by step process to set up our DAST tool on a repo. Advanced security should be turned on by default but if not those steps are included here. In this example we will be enabling this tool on an imaginary repo.

We must first create the DAST_WEB_URL variable. From the Github repo page, go to 'Settings > Secrets > Actions' and click on the 'New repository secret' button.
The 'Name' field should be 'DAST_WEB_URL' or else this Github action will not recognize it.
The 'Value' field should contain the test URL that ZAP will scan.
Click on the green 'Add secret' button once this is done.
Go to the repo’s specific setting "Settings" > "Code security and analysis”.
Click on the “Enable” button for “Github Advanced Security”.
Then agree to the prompt by clicking “Enable Advanced Security for this repository”.
Next to “Code scanning” click on the “Set up” button, this will redirect you to the code scanning page.
Click on “Set up this workflow” in the “CodeQL Analysis” box.
Once in the editor, delete the entire file and replace the content with this template from this repo.
This is the master file that should be used in repositories that pertains to a web application. The file should be named "dast.yml".
Once you’re done editing the file click on the green “Start commit” button.
Give a description of what was done.
And lastly commit your changes by clicking on the green “Commit new file” button.
Once the file has been created and pushed to the default branch, the action should start automatically.
Wait for the run to finish and view your results.
This process described above only needs to be done once, when a staging environment is live. Once done, the scan will run every time there is new code pushed to the default branch or a pull request is merged. Set it and forget it.