# Zaproxy API Scan CI

> Run OWASP ZAP packaged Docker scans in CI (baseline, full, API) with stable images, mounted workdirs, and report artifacts. Use when adding DAST against a running web app or OpenAPI target.

- Skill: `deangrant/zaproxy-api-scan-ci` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add deangrant/zaproxy-api-scan-ci`
- Raw SKILL.md: https://api.skillmd.com/api/skills/deangrant/zaproxy-api-scan-ci/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: deangrant (https://skillmd.com/u/deangrant)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/deangrant/zaproxy-api-scan-ci

---


# ZAP Docker CI

Use this skill for **DAST** against running apps (complements deepsec source
scanning).

---

## 1. Image

Prefer `ghcr.io/zaproxy/zaproxy:stable` (or `zap-stable`). Weekly for new AF
exit codes; nightly only experimental; bare has no packaged scripts.

---

## 2. Workdir

Mount a host work directory for reports/hooks. Run as documented UID if
permission issues arise.

---

## 3. Scan type

| Script | Use |
| ------ | --- |
| baseline | Smoke / PR-friendly |
| full | Deeper scheduled scans |
| api | OpenAPI/GraphQL targets |

Point at a reachable staging URL. Fail CI on policy thresholds; publish HTML/JSON
artifacts.

---

## 4. Quick checklist

- [ ] Stable image pinned or digest-tracked.
- [ ] Target up before scan job.
- [ ] Reports archived.
- [ ] Auth/env for staging documented (no secrets in logs).
- [ ] Complements SAST/deepsec — does not replace them.

See [reference.md](reference.md) and [examples.md](examples.md).