devsecops.yml

name: DevSecOps Pipeline1
on: push

jobs: 
  sonarcloud-SAST:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
      with:
        # Disabling shallow clone is recommended for improving relevancy of reporting
        fetch-depth: 0
    - name: SonarCloud Scan
      uses: sonarsource/sonarcloud-github-action@master
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
   
  zap-scan-SCA: 
      runs-on: ubuntu-latest
      steps:
        - name: ZAP Scan
          uses: zaproxy/action-baseline@v0.7.0
          with:
            target: 'https://www.zaproxy.org'
  snyk-DAST:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@master
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master # For node projects, change accordingly 
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}  
        with:
          command: monitor