Bump zaproxy/action-api-scan from 0.7.0 to 0.8.0

[dependabot]

Bumps zaproxy/action-api-scan from 0.7.0 to 0.8.0.

Release notes

Sourced from zaproxy/action-api-scan's releases.

Version 0.8.0

Changed

• Update dependencies, which adds rate-limiting when accessing the GitHub API.

Fixed

• Allow to write any file from the Docker container. #22

Changelog

Sourced from zaproxy/action-api-scan's changelog.

Changelog

All notable changes to this GitHub action will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased]

[0.8.0] - 2024-09-25

Changed

• Update dependencies, which adds rate-limiting when accessing the GitHub API.

Fixed

• Allow to write any file from the Docker container. #22

[0.7.0] - 2024-04-02

Changed

• Update dependencies.

[0.6.0] - 2024-01-25

Changed

• Run with node20. #29

[0.5.0] - 2023-08-24

Added

• An input (artifact_name) used to name the artifact that contains the ZAP reports.

[0.4.0] - 2023-08-02

Changed

• The default Docker image was changed to ghcr.io/zaproxy/zaproxy:stable.

[0.3.1] - 2023-07-05

Fixed

• Check issues with authenticated user. #19

[0.3.0] - 2023-06-29

Changed

• To use Node 16
• Updated dependencies

[0.2.0] - 2022-09-09

Added

• Support for authentication environment variables.

[0.1.1] - 2022-05-23

Fixed

• Use default zap user rather than root.

... (truncated)

Commits

• 0d599ab Merge pull request #40 from thc202/release-v0.8.0
• 8fea8bf Release v0.8.0
• 3bb62c8 Merge pull request #39 from thc202/update-dep
• 7c7f701 Update dependencies
• f48fba2 Merge pull request #37 from thc202/write-all-dir
• 2a23248 Allow to write any file to the workspace
• 20577ca Merge pull request #36 from zaproxy/dependabot/npm_and_yarn/undici-5.28.4
• eb48aa8 Update dist file and changelog
• d165f93 Bump undici from 5.28.3 to 5.28.4
• 73e2ea0 Merge pull request #35 from thc202/update-changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/zaproxy/action-api-scan	0d599ab8270165cd4e547f87c4e8fd3d6c08b826	🟢 5	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Manifest Files

.github/workflows/main.yml

• zaproxy/action-api-scan@0d599ab
• zaproxy/action-api-scan@f34b074