{"id":20445847,"url":"https://github.com/rapid7/insightappsec-scan-github-actions","last_synced_at":"2025-04-13T00:44:11.212Z","repository":{"id":39750330,"uuid":"450473591","full_name":"rapid7/insightappsec-scan-github-actions","owner":"rapid7","description":null,"archived":false,"fork":false,"pushed_at":"2025-03-24T15:57:01.000Z","size":573,"stargazers_count":10,"open_issues_count":13,"forks_count":12,"subscribers_count":19,"default_branch":"master","last_synced_at":"2025-04-13T00:44:03.302Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rapid7.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-01-21T11:58:20.000Z","updated_at":"2025-04-01T16:34:04.000Z","dependencies_parsed_at":"2024-06-24T16:47:00.803Z","dependency_job_id":"c955b765-9e92-4d40-8142-1d9e29129413","html_url":"https://github.com/rapid7/insightappsec-scan-github-actions","commit_stats":{"total_commits":46,"total_committers":7,"mean_commits":6.571428571428571,"dds":0.6304347826086957,"last_synced_commit":"9e9787d0acbc63dca3b329b7cdcd13fc21bdffb4"},"previous_names":[],"tags_count":9,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-scan-github-actions","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-scan-github-actions/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-scan-github-actions/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-scan-github-actions/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rapid7","download_url":"https://codeload.github.com/rapid7/insightappsec-scan-github-actions/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248650419,"owners_count":21139672,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-15T10:14:51.031Z","updated_at":"2025-04-13T00:44:11.188Z","avatar_url":"https://github.com/rapid7.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cimg src=\"insighAppSec-logo-black.png\" alt=\"InsightAppSec\" width=\"150\"\u003e\n\n# InsightAppSec Scan Action\nThe [InsightAppSec Scan](https://docs.rapid7.com/insightappsec/github-actions-integration) GitHub Action allows security and development teams to integrate dynamic application security testing (DAST) into the CI/CD pipeline.\n\n# About InsightAppSec\n[InsightAppSec](https://www.rapid7.com/products/insightappsec/) is Rapid7’s industry leading Dynamic Application Security Testing (DAST) that helps you understand and minimize risk in your web applications and APIs. \n\n# Usage\nThe action will start a scan on Rapid7 InsightAppSec and depending on configuration either:\n- wait for its completion and return a result summary to the logs. These results can be filtered using the `vuln-query` (scan gating) option in the config.\n- immediately return the InsightAppSec scan ID to the logs and the action finishes.\n\nThis behavior can be configured using the `wait-for-scan-complete` option in the config.\n\nThe InsightAppSec API key will need to be added as a GitHub secret in order for the action to work. See how to do this here: https://docs.github.com/en/actions/security-guides/encrypted-secrets\n\n\n```yaml\n- uses: rapid7/insightappsec-scan-github-actions@v1.3.5\n  with:\n    # The region indicates the geo-location of the Insight Platform. For example 'us'.\n    region: \"us\"\n    # The API key used to authorized the GitHub action to interact with the Rapid7 API. The API key should be stored as\n    # a GitHub secret. Instructions for creating an InsightAppSec API key are shown in the Rapid7 InsightAppSec\n    # documentation.\n    api-key: ${{ secrets.INSIGHTAPPSEC_API_KEY }}\n    # The UUID of the scan configuration to be used during scanning. The scan configuration should be a sub-resource of\n    # the application and can be obtained from InsightAppSec.\n    scan-config-id: \"999703e4-a4p0-4ea6-a3sc-53cg789e4fc1\"\n    # Scan gating query. Used to filter results by vulnerability properties. If this has a value and the query returns\n    # vulnerabilities from the scan then the job will be marked as failed. The format of the scan gating query should conform to the \n    # VULNERABILITY search query format described in the documentation: \n    # https://help.rapid7.com/insightappsec/en-us/api/v1/docs.html#tag/Search\n    vuln-query: \"vulnerability.vulnerabilityScore \u003e 4\"\n    # If false the Scan ID will be returned as soon as the scan is kicked off, else the workflow will continually poll \n    # until the scan is completed and return the results. Defaults to true.\n    wait-for-scan-complete: true\n```\n\nA full example yaml may look similar to:\n```yaml\nname: IAS Scan\non:\n  push:\n    branches: [ master ]\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - id: my-scan\n        uses: rapid7/insightappsec-scan-github-actions@v1.3.5\n        with:\n          region: \"us\"\n          api-key: ${{ secrets.IAS_API_KEY }}\n          scan-config-id: \"999703e4-a4p0-4ea6-a3sc-53cg789e4fc1\"\n          vuln-query: \"vulnerability.vulnerabilityScore \u003e 4\"\n      - name: Upload findings\n        if: always()\n        run: echo \"${{ steps.my-scan.outputs.scan-findings }}\"\n```\n\nThe body of a vulnerability query cannot contain double quotes (\"), single quotes (') should be used instead. The entire vuln-query property can be wrapped in double quotes. For example:\n```yaml\n  vuln-query: \"vulnerability.severity = 'MEDIUM'\"\n```\n\n## Development\nTo develop new versions of this action\n1. Make the required code updates and test\n2. Remove node_modules and reinstall with the --production flag\n```\nnpm install --production\n```\n3. Globally install the build tool (only once)\n```\nnpm i -g @vercel/ncc@0.31.1\n```\n4. From the root project directory, in a terminal execute\n```\nnpm run build\n```\n5. Add the contents of the /dist directory to the changelist.\n6. Submit the changes for review.\n7. Once approved and merged a tag should also be created. It's this tag that's referenced in the implementing yaml file, the below example uses a v1.0.0 tag.\n```\nuses: rapid7/insightappsec-scan-github-actions@v1.0.0\n```\n\n### Unit tests\nThe unit tests use the jest framework. This can be installed using node package manager.\n\n1. From the insightappsec-scan-github-actions directory `npm  install` (only the first time)\n2. From the insightappsec-scan-github-actions directory `npm run build`\n\n### Execution\n\nTo execute all tests\n- From the insightappsec-scan-github-actions directory run `npm t`\n\nFor a code coverage report\n- From the insightappsec-scan-github-actions directory run `npm run coverage`","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frapid7%2Finsightappsec-scan-github-actions","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frapid7%2Finsightappsec-scan-github-actions","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frapid7%2Finsightappsec-scan-github-actions/lists"}