feat(security): add OWASP ZAP automated security scan workflow

Author: Dayz-tech-co

.github/workflows/zap-security-scan.yml

@@ -0,0 +1,93 @@
+name: OWASP ZAP Security Scan
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_url:
+        description: Target URL to scan (overrides STAGING_URL)
+        required: false
+        type: string
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  zap-scan:
+    name: OWASP ZAP Passive Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Determine target URL
+        id: target
+        run: |
+          if [ -n "${{ github.event.inputs.target_url }}" ]; then
+            echo "url=${{ github.event.inputs.target_url }}" >> "$GITHUB_OUTPUT"
+          elif [ -n "${{ vars.STAGING_URL }}" ]; then
+            echo "url=${{ vars.STAGING_URL }}" >> "$GITHUB_OUTPUT"
+          elif [ -n "${{ secrets.STAGING_URL }}" ]; then
+            echo "url=${{ secrets.STAGING_URL }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "url=http://localhost:3000" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Start local application stack
+        if: steps.target.outputs.url == 'http://localhost:3000'
+        run: docker compose up --build -d
+
+      - name: Wait for application readiness
+        if: steps.target.outputs.url == 'http://localhost:3000'
+        run: |
+          for i in $(seq 1 12); do
+            if curl -sf http://localhost:3000 > /dev/null 2>&1 && \
+               curl -sf http://localhost:3001/api/health > /dev/null 2>&1; then
+              echo "Application stack is ready"
+              exit 0
+            fi
+            echo "Waiting for application stack... attempt $i"
+            sleep 10
+          done
+          echo "Application stack failed to start"
+          exit 1
+
+      - name: Run OWASP ZAP Baseline Scan
+        uses: zaproxy/action-baseline@v0
+        with:
+          target: ${{ steps.target.outputs.url }}
+          allow_failure: false
+
+      - name: Upload ZAP Report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: zap-report
+          path: report*
+          retention-days: 30
+
+      - name: Comment PR with scan summary
+        if: always() && github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let body = '## OWASP ZAP Security Scan\n\n';
+            try {
+              const report = fs.readFileSync('report.md', 'utf8');
+              body += 'Scan completed against **${{ steps.target.outputs.url }}**.\n\n';
+              const lines = report.split('\n').slice(0, 30).join('\n');
+              body += '```\n' + lines + '\n```\n\n';
+              body += 'Full report available in the [ZAP Report artifact](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).';
+            } catch {
+              body += 'ZAP scan completed. Download the report artifact for details.';
+            }
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: body
+            });