Option to fail or pass the action based on alerts

[sshniro]

Currently, the action fails if it finds any alerts in the report. This will trigger an email for the failed action. It will be good to make this behavior configurable.

  fail_action:
    description: 'Fail or pass the action based on alerts'
    required: false
    default: false

[richAtreides]

Is this being worked on?

[kingthorin]

As a work around you could simply add a step to your action workflow that exits successfully, if your goal is to always run the action but not ever fail the build

...
steps:
    ...
    - name: Exit with success
      run: exit 0

[Lewiscowles1986]

Will it fail every time? The warnings are not new on the second run. If it's just priming to give discoverability this seems almost desirable. If not, then they are not warnings, but errors and it's an indictment of the tool. For example running on a website with no cookies, hardly any JS, no contact forms, no user login, it starts telling me about software discoverability. There is no software I own in the stack, and the complaints are at best paranoid.

HSTS header missing... Well if I were testing an e-commerce site that might make sense, but actually I want http access.

[kingthorin]

Will it fail every time?

It depends how you've configured it.

The warnings are not new on the second run.

Have you configured it to only care about new alerts?

HSTS header missing... Well if I were testing an e-commerce site that might make sense, but actually I want http access.

That's why you have the option of passing a rules file. If you don't care about HSTS then configure it as such...

• https://github.com/zaproxy/action-baseline#rules_file_name
• https://www.zaproxy.org/docs/docker/baseline-scan/