ZAP DAST in CI (nightly against staging)

[tayebmokni]

Summary

Set up nightly ZAP (OWASP Zed Attack Proxy) DAST scans against the staging environment. Use the ZAP baseline + full-scan in headless mode against deployed staging. Reports posted to a security board with severity-grouped findings; high/critical findings auto-open issues. This is forward-referenced from doc 11 (test plumbing) but the policy lives in 13.

Design reference

• docs/13-security-baseline.md §7.6, §16.4 (continuous security testing)

Acceptance criteria

• Nightly GitHub Actions workflow runs zaproxy/action-full-scan against staging URL
• Configurable rules file (.zap/rules.tsv) to tune severity per rule
• HTML + Markdown + SARIF reports archived as workflow artifacts
• High/critical findings auto-create GitHub issues with type:security and priority:P1
• Workflow respects a zap-ignore allowlist with justification + expiry
• Smoke run executes successfully against staging before enabling nightly schedule

Dependencies

none

Complexity

M