devsecops.yml

name: CI/CD Pipeline

on:
  push:
    branches: [ main ]

jobs:
  devsecops:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Use Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'
  
      - name: Install dependencies
        run: |
          yarn install
          yarn build
      - name: dockerise
        run: |
          docker build -t backend-ashutosh .
          docker run -d -p 3000:3000 backend-ashutosh
  
      - uses: actions/checkout@master
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master 
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}    
        with:
          command: monitor

    # steps:
      
      - name: ZAP Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: 'http://localhost:3000'