feat: [DTOSS-9089] add separate ZAP Baseline scans for API and Website targets, with supporting Azure DevOps pipeline and Slack summary notifications (#1850)

nc-shahidazim · mrlockstar · web-flow · commit 46cfec4b7a6d · 2026-03-31T09:04:49.000Z
DTOSS-9089: Fix OWASP ZAP report in Cohort Manager pipeline

Co-authored-by: Alastair Lock &lt;alastair.lock@gmail.com&gt;
diff --git a/.azuredevops/pipelines/acr-image-retag.yaml b/.azuredevops/pipelines/acr-image-retag.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/adhoc-post-deployment-tests-dev.yaml b/.azuredevops/pipelines/adhoc-post-deployment-tests-dev.yaml
@@ -8,7 +8,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/cd-infrastructure-dev-audit.yaml b/.azuredevops/pipelines/cd-infrastructure-dev-audit.yaml
@@ -13,7 +13,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/cd-infrastructure-dev-core.yaml b/.azuredevops/pipelines/cd-infrastructure-dev-core.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/cd-infrastructure-int-audit.yaml b/.azuredevops/pipelines/cd-infrastructure-int-audit.yaml
@@ -13,7 +13,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/cd-infrastructure-int-core.yaml b/.azuredevops/pipelines/cd-infrastructure-int-core.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/cd-infrastructure-nft-audit.yaml b/.azuredevops/pipelines/cd-infrastructure-nft-audit.yaml
@@ -13,7 +13,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/cd-infrastructure-nft-core.yaml b/.azuredevops/pipelines/cd-infrastructure-nft-core.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/cd-infrastructure-preprod-audit.yaml b/.azuredevops/pipelines/cd-infrastructure-preprod-audit.yaml
@@ -13,7 +13,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/cd-infrastructure-preprod-core.yaml b/.azuredevops/pipelines/cd-infrastructure-preprod-core.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/cd-infrastructure-prod-audit.yaml b/.azuredevops/pipelines/cd-infrastructure-prod-audit.yaml
@@ -13,7 +13,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/cd-infrastructure-prod-core.yaml b/.azuredevops/pipelines/cd-infrastructure-prod-core.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/cd-infrastructure-sandbox-audit.yaml b/.azuredevops/pipelines/cd-infrastructure-sandbox-audit.yaml
@@ -13,7 +13,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/cd-infrastructure-sandbox-core.yaml b/.azuredevops/pipelines/cd-infrastructure-sandbox-core.yaml
@@ -9,7 +9,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/generate-owasp-zap-report.yaml b/.azuredevops/pipelines/generate-owasp-zap-report.yaml
@@ -17,9 +17,9 @@ schedules:
     always: true
 
 variables:
-  - group: global_variable_group
+  - group: DEV_core_backend
   - name: dev_rg
-    value: rg-cohort-manager-dev-uks
+    value: rg-cohman-dev-uks
 
 jobs:
   - job: owasp_zap_report
@@ -35,7 +35,8 @@ jobs:
         scriptLocation: 'inlineScript'
         inlineScript: |
           echo "generating report"
-          az account set --subscription $(DEV_SUBSCRIPTION_ID)
+
+          az account set --subscription $(TF_VAR_TARGET_SUBSCRIPTION_ID)
 
           function_list=$(az resource list --resource-group $(dev_rg) --resource-type Microsoft.Web/sites --query "[?kind=='functionapp,linux,container'].name" | sed 's/[][]//g; s/[",]//g' | sed '/^$/d')
           for function in $function_list; do
@@ -55,5 +56,3 @@ jobs:
           for function in $function_list; do
             cat zap_report_$function
           done
-
-
diff --git a/.azuredevops/pipelines/owasp-zap-report-dev-core.yaml b/.azuredevops/pipelines/owasp-zap-report-dev-core.yaml
@@ -0,0 +1,36 @@
+---
+name: $(Build.SourceBranchName)-$(Date:yyyyMMdd)_$(Rev:r)
+trigger: none
+pr: none
+
+schedules:
+  - cron: "0 0 * * Sun"
+    displayName: Run every Sunday at 0:00
+    branches:
+      include:
+        - main
+    always: true
+
+resources:
+  repositories:
+    - repository: dtos-devops-templates
+      type: github
+      name: NHSDigital/dtos-devops-templates
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
+      endpoint: NHSDigital
+
+variables:
+  - name: hostPoolName
+    value: private-pool-dev-uks
+  - group: SBRK_core_backend
+  - name: ENVIRONMENT
+    value: dev
+
+stages:
+  - template: ../templates/owasp-zap-report-core-common.yaml
+    parameters:
+      hostPoolName: $(hostPoolName)
+      environment: $(ENVIRONMENT)
+      slackWebHook: $(SLACK_WEBHOOK_URL_WORKFLOWS)
+      apiUrl: 'https://dev-uks-retrieve-cohort-distribution-data.azurewebsites.net/api/RetrieveCohortDistributionData'
+      webUrl: 'https://cohort-dev.non-live.screening.nhs.uk'
diff --git a/.azuredevops/pipelines/owasp-zap-report-sandbox-core.yaml b/.azuredevops/pipelines/owasp-zap-report-sandbox-core.yaml
@@ -0,0 +1,28 @@
+---
+name: $(Build.SourceBranchName)-$(Date:yyyyMMdd)_$(Rev:r)
+trigger: none
+pr: none
+
+resources:
+  repositories:
+    - repository: dtos-devops-templates
+      type: github
+      name: NHSDigital/dtos-devops-templates
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
+      endpoint: NHSDigital
+
+variables:
+  - name: hostPoolName
+    value: private-pool-dev-uks
+  - group: SBRK_core_backend
+  - name: ENVIRONMENT
+    value: sandbox
+
+stages:
+  - template: ../templates/owasp-zap-report-core-common.yaml
+    parameters:
+      hostPoolName: $(hostPoolName)
+      environment: $(ENVIRONMENT)
+      slackWebHook: $(SLACK_WEBHOOK_URL_WORKFLOWS)
+      apiUrl: 'https://sbrk-uks-retrieve-cohort-distribution-data.azurewebsites.net/api/RetrieveCohortDistributionData'
+      webUrl: 'https://cohort-dev.non-live.screening.nhs.uk'
diff --git a/.azuredevops/pipelines/post-deployment-tests-dev.yaml b/.azuredevops/pipelines/post-deployment-tests-dev.yaml
@@ -16,7 +16,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/task_azure_sql_backup_prod.yaml b/.azuredevops/pipelines/task_azure_sql_backup_prod.yaml
@@ -17,7 +17,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 variables:
diff --git a/.azuredevops/pipelines/task_azure_sql_scaling_dev.yaml b/.azuredevops/pipelines/task_azure_sql_scaling_dev.yaml
@@ -27,7 +27,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/task_azure_sql_scaling_int.yaml b/.azuredevops/pipelines/task_azure_sql_scaling_int.yaml
@@ -27,7 +27,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/task_azure_sql_scaling_nft.yaml b/.azuredevops/pipelines/task_azure_sql_scaling_nft.yaml
@@ -27,7 +27,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/task_azure_sql_scaling_preprod.yaml b/.azuredevops/pipelines/task_azure_sql_scaling_preprod.yaml
@@ -27,7 +27,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/pipelines/task_azure_sql_scaling_prod.yaml b/.azuredevops/pipelines/task_azure_sql_scaling_prod.yaml
@@ -27,7 +27,7 @@ resources:
     - repository: dtos-devops-templates
       type: github
       name: NHSDigital/dtos-devops-templates
-      ref: 8d9323116e7e0442e3f89750df39af27a2e1a4a7
+      ref: 0abead1e42da2bb60cbc85054ac2452746679d29
       endpoint: NHSDigital
 
 parameters:
diff --git a/.azuredevops/templates/owasp-zap-report-core-common.yaml b/.azuredevops/templates/owasp-zap-report-core-common.yaml
diff --git a/scripts/zap/generate-junit-reports.py b/scripts/zap/generate-junit-reports.py
diff --git a/scripts/zap/run-zap-scan-api.sh b/scripts/zap/run-zap-scan-api.sh
diff --git a/scripts/zap/run-zap-scan-web.sh b/scripts/zap/run-zap-scan-web.sh
