fix(ci): bound pentest DAST scan runtime so it cannot hang

.github/workflows/scan-pentest.yml

@@ -4,7 +4,7 @@
 # provider tests use, discovers the served edges, ingests existing scan output
 # (code-scanning alerts + SBOM) for correlation, runs open DAST tooling
 # (baseline + API + template scans), optionally forwards results to a pluggable
 # analysis endpoint (configured via secrets; degrades to DAST-only if unset), and
 # publishes a consolidated report. Report-only: it never fails the build.
 
 name: "Scan: Pen Test (DAST)"
@@ -23,7 +23,7 @@
         required: false
         default: "ghcr.io/janssenproject/jans/all-in-one:0.0.0-nightly"
       full_scan:
         description: "Run the full active scan (slower) instead of baseline only"
         type: boolean
         default: false
 
@@ -41,12 +41,12 @@
     runs-on: ubuntu-latest
     permissions:
       contents: read
       security-events: read   # pentest_ingest_scans.py lists code-scanning alerts via github.token
       id-token: write         # keyless cosign sign-blob for the release report bundles
     env:
       JANS_FQDN: pentest-${{ github.run_id }}.jans.test
       JANS_PERSISTENCE: MYSQL
       AIO_IMAGE_TAG: ${{ github.event.inputs.aio_image_tag || 'ghcr.io/janssenproject/jans/all-in-one:0.0.0-nightly' }}
       FULL_SCAN: ${{ github.event.inputs.full_scan || 'false' }}
       # Present only when configured; the analysis step is skipped when empty.
       PENTEST_AI_ENDPOINT: ${{ secrets.PENTEST_AI_ENDPOINT }}
@@ -55,7 +55,7 @@
       PENTEST_AI_API_VERSION: ${{ vars.PENTEST_AI_API_VERSION || '2023-06-01' }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
         with:
           egress-policy: audit
 
@@ -76,42 +76,56 @@
           PENTEST_TARGETS: targets.json
         run: |
           python3 .github/workflows/scripts/pentest_discover_endpoints.py
-          jq -r '.targets[]' targets.json > targets.txt
+          # Scanner containers run as non-root; give them a world-writable dir for
+          # inputs/outputs (fixes ZAP "AccessDenied /zap/wrk/zap.json").
+          mkdir -p dast && chmod 777 dast
+          jq -r '.targets[]' targets.json > dast/targets.txt
           cat targets.json
 
       - name: Ingest existing scan results
         env:
           GH_TOKEN: ${{ github.token }}
           PENTEST_CONTEXT: context.json
           PENTEST_RELEASE_TAG: ${{ github.ref_type == 'tag' && github.ref_name || 'nightly' }}
         run: python3 .github/workflows/scripts/pentest_ingest_scans.py || true
 
       - name: DAST — baseline scan
+        timeout-minutes: 20
         env:
           JANS_URL: https://${{ env.JANS_FQDN }}
         run: |
-          docker run --rm --network host --add-host "${JANS_FQDN}:127.0.0.1" -v "$PWD:/zap/wrk:rw" \
+          timeout 900 docker run --rm --network host --add-host "${JANS_FQDN}:127.0.0.1" -v "$PWD/dast:/zap/wrk:rw" \
             ghcr.io/zaproxy/zaproxy:stable \
             zap-baseline.py -t "$JANS_URL" -J zap.json -I || true
 
       - name: DAST — API scan (OpenAPI-seeded, full only)
         if: env.FULL_SCAN == 'true'
+        timeout-minutes: 20
         run: |
           spec=$(jq -r '.openapi_specs[0] // empty' targets.json)
           if [ -n "$spec" ]; then
-            docker run --rm --network host --add-host "${JANS_FQDN}:127.0.0.1" -v "$PWD:/zap/wrk:rw" \
+            timeout 900 docker run --rm --network host --add-host "${JANS_FQDN}:127.0.0.1" -v "$PWD/dast:/zap/wrk:rw" \
               ghcr.io/zaproxy/zaproxy:stable \
               zap-api-scan.py -t "$spec" -f openapi -J zap-api.json -I || true
           else
             echo "no OpenAPI spec discovered; skipping API scan"
           fi
 
       - name: DAST — template scan
+        timeout-minutes: 25   # backstop; the shell timeout below should fire first
         run: |
-          docker run --rm --network host --add-host "${JANS_FQDN}:127.0.0.1" -v "$PWD:/data:rw" \
+          # -no-interactsh: skip OOB polling (can stall on egress); -disable-update-check
+          # + -timeout/-retries: bound network waits. Wrapped in `timeout` so a slow scan
+          # is killed and partial results are still used (report-only step).
+          # -no-mhe: don't drop the host after N errors — a hardened IDP resets many
+          # probe requests, which otherwise trips the default max-host-error (30) and
+          # skips the whole target.
+          timeout 900 docker run --rm --network host --add-host "${JANS_FQDN}:127.0.0.1" -v "$PWD/dast:/data:rw" \
             projectdiscovery/nuclei:latest \
             -l /data/targets.txt -jsonl -o /data/nuclei.jsonl \
-            -severity low,medium,high,critical || true
+            -severity low,medium,high,critical \
+            -no-interactsh -disable-update-check -timeout 10 -retries 1 -no-mhe \
+            || echo "nuclei ended (timeout or non-zero exit); using partial results"
 
       - name: Analysis (Messages API)
         if: env.PENTEST_AI_ENDPOINT != ''
@@ -122,8 +136,8 @@
             --arg sys "$SYS" \
             --slurpfile targets targets.json \
             --slurpfile context context.json \
-            --arg zap "$(cat zap.json 2>/dev/null || echo '{}')" \
-            --arg nuclei "$(cat nuclei.jsonl 2>/dev/null || echo '')" \
+            --arg zap "$(cat dast/zap.json 2>/dev/null || echo '{}')" \
+            --arg nuclei "$(cat dast/nuclei.jsonl 2>/dev/null || echo '')" \
             '{
                model: $model,
                max_tokens: 4096,
@@ -187,7 +201,7 @@
         run: |
           pip install --quiet --require-hashes -r .github/workflows/scripts/requirements-pentest.txt
           python3 .github/workflows/scripts/pentest_report.py \
-            --zap zap.json --nuclei nuclei.jsonl \
+            --zap dast/zap.json --nuclei dast/nuclei.jsonl \
             --context context.json --analysis analysis.json \
             --meta meta.json --pdf \
             --logo docs/assets/logo/janssen_project_transparent_630px_182px.png \