Automation Framework - compatible with config file / basic auth? about action-baseline

[cruddasj]

@a-h - I've spent the morning looking at the same issue (site behind basic auth) and have configured the below (which draws the basic auth base64 hash from a github secret).

Building on your posted solution from last year, this is a slightly different tact in that it doesn't require a config file (as the args are all supplied through command options).

It's a little ugly - but in positive news - it does work with the ZAP Github actions out of the box and avoids secrets needing to be stored in files 👍

uses: zaproxy/[email protected]
with:
  target: 'https://xyz.com'
  token: ${{ secrets.GH_ACCESS_TOKEN }}
  cmd_options: '-z "-config replacer.full_list(0).description=auth1 -config replacer.full_list(0).enabled=true -config replacer.full_list(0).matchtype=REQ_HEADER -config replacer.full_list(0).matchstr=Authorization -config replacer.full_list(0).regex=false -config replacer.full_list(0).replacement=\"Basic ${{ secrets.<<github-repo-secret-name-for-base64-auth-hash>>}}\"'