search

OtherDevOpsGene / zap-sonar-plugin

Integrates OWASP Zed Attack Proxy reports into SonarQube
GNU General Public License v3.0
69 stars 31 forks source link

adding a handy example showing how to automate the pentest within the CI pipeline #89

Open newlight77 opened 3 years ago

newlight77 commented 3 years ago

… CI pipeline

This uses docker and docker-compose to run sandbox with sonarqube, zap tool and zap-sonar-plugin altogether in 3 steps :

  1. run a sonarqube instance using docker with zap-sonar-plugin installed
  2. generate a zapproxy.html report
  3. publish the zapproxy.html report to sonarqube