Merge dev into test

.github/workflows/confluence-sync.yml

@@ -0,0 +1,166 @@
+name: Confluence Sync
+
+on:
+  schedule:
+    # Runs every Monday at 02:00 UTC
+    - cron: '0 2 * * 1'
+
+  workflow_dispatch:
+  # Allow manual trigger from GitHub UI
+
+  # Optional: trigger on push to main branch if confluence-config.json changes
+  push:
+    paths:
+      - 'scripts/src/confluence/confluence-config.json'
+      - 'scripts/src/confluence/sync-confluence.py'
+      - 'scripts/src/confluence/requirements.txt'
+      - '.github/workflows/confluence-sync.yml'
+    branches:
+      - main
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    name: Sync Confluence to Git
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r scripts/src/confluence/requirements.txt
+
+      - name: Run sync tests
+        run: |
+          python scripts/src/confluence/sync-confluence.py --self-test
+          python -m unittest -v scripts/src/confluence/test_sync_confluence.py
+
+      - name: Configure git
+        run: |
+          git config --local user.email "bot@dcsa.org"
+          git config --local user.name "DCSA Bot"
+
+      - name: Run Confluence Sync
+        env:
+          CONFLUENCE_BASE_URL: ${{ secrets.CONFLUENCE_BASE_URL }}
+          CONFLUENCE_USERNAME: ${{ secrets.CONFLUENCE_USERNAME }}
+          CONFLUENCE_API_TOKEN: ${{ secrets.CONFLUENCE_API_TOKEN }}
+          CONFLUENCE_SPACE_KEY: SD
+        run: |
+          python scripts/src/confluence/sync-confluence.py
+
+      - name: Check for changes
+        id: git-check
+        run: |
+          if git diff --quiet; then
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Commit and push changes
+        if: steps.git-check.outputs.has_changes == 'true'
+        run: |
+          git add specifications/confluence-sync/
+          git commit -m "docs: auto-sync Confluence documentation
+
+          - Synced specifications from Confluence space SD
+          - Timestamp: $(date -u +'%Y-%m-%dT%H:%M:%SZ')
+          - Workflow: Confluence Sync"
+          git push
+
+      - name: Create Pull Request
+        if: steps.git-check.outputs.has_changes == 'true'
+        uses: peter-evans/create-pull-request@v5
+        with:
+          commit-message: 'docs: auto-sync Confluence documentation'
+          title: 'docs: Auto-sync Confluence documentation'
+          body: |
+            ## Automated Confluence Sync
+
+            This PR contains automatically synced documentation from Confluence.
+
+            **Sync Details:**
+            - Source: Confluence Space `SD` (Standards Development)
+            - Destination: `specifications/confluence-sync/`
+            - Timestamp: ${{ github.event.head_commit.timestamp }}
+            - Trigger: ${{ github.event_name }}
+
+            ### What to check:
+            - [ ] Files have expected content
+            - [ ] No sensitive data exposed
+            - [ ] Markdown formatting looks correct
+            - [ ] Links are preserved
+
+            ### Merge Instructions:
+            If everything looks good, merge this PR to keep specifications current.
+          branch: confluence-sync-${{ github.run_number }}
+          delete-branch: true
+          labels: |
+            documentation
+            automated
+            confluence-sync
+
+      - name: Workflow Status
+        if: always()
+        run: |
+          echo "## Confluence Sync Status"
+          echo "- Scheduled: Every Monday at 02:00 UTC"
+          echo "- Last Run: $(date -u +'%Y-%m-%d %H:%M:%S UTC')"
+          echo "- Changes Detected: ${{ steps.git-check.outputs.has_changes }}"
+          echo "- Configuration: scripts/src/confluence/confluence-config.json"
+
+  verify:
+    runs-on: ubuntu-latest
+    name: Verify Sync Output
+    needs: sync
+    if: always()
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check sync directory exists
+        run: |
+          if [ -d "specifications/confluence-sync" ]; then
+            echo "✓ Sync directory exists"
+            ls -la specifications/confluence-sync/
+          else
+            echo "⚠ Sync directory not found (may be first run)"
+          fi
+
+      - name: Validate markdown files
+        run: |
+          if find specifications/confluence-sync -type f -name '*.md' | grep -q .; then
+            count=$(find specifications/confluence-sync -type f -name '*.md' | wc -l)
+            echo "✓ Found ${count} markdown files"
+            while IFS= read -r file; do
+              if [ -s "$file" ]; then
+                echo "  ✓ ${file} - $(wc -l < "$file") lines"
+              fi
+            done < <(find specifications/confluence-sync -type f -name '*.md' | sort)
+          else
+            echo "ℹ No markdown files found (check config or Confluence connectivity)"
+          fi
+
+      - name: Summary
+        run: |
+          echo "## Sync Verification Complete"
+          echo "- Documentation location: specifications/confluence-sync/"
+          echo "- Config file: scripts/src/confluence/confluence-config.json"
+          echo "- Next sync: Monday 02:00 UTC"
+          echo ""
+          echo "To manually trigger sync:"
+          echo "  1. Go to: Actions → Confluence Sync"
+          echo "  2. Click: Run workflow"
+

.github/workflows/zap-authenticated-scan.yaml

@@ -0,0 +1,71 @@
+name: OWASP ZAP Authenticated Scan
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_environment:
+        description: Non-production GitHub Environment that provides the Conformance scan configuration
+        required: true
+        type: choice
+        options:
+          - conformance-dev
+
+permissions:
+  contents: read
+
+jobs:
+  authenticated-scan:
+    name: Authenticated scan (${{ inputs.target_environment }})
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.target_environment }}
+    env:
+      APP_URL: ${{ vars.APP_URL }}
+      API_URL: ${{ vars.API_URL }}
+      CONFORMANCE_USER_EMAIL: ${{ secrets.CONFORMANCE_USER_EMAIL }}
+      CONFORMANCE_USER_PASSWORD: ${{ secrets.CONFORMANCE_USER_PASSWORD }}
+    steps:
+      - name: Check out the scan plan
+        uses: actions/checkout@v6.0.2
+
+      - name: Create a fallback report
+        shell: bash
+        run: printf '%s\n' '<!doctype html><title>ZAP authenticated scan did not produce a report</title><p>Review this workflow run for failure details.</p>' > zap-authenticated-report-fallback.html
+
+      - name: Require authenticated scan configuration
+        shell: bash
+        run: |
+          if [ -z "$APP_URL" ] || [ -z "$API_URL" ] || [ -z "$CONFORMANCE_USER_EMAIL" ] || [ -z "$CONFORMANCE_USER_PASSWORD" ]; then
+            echo "APP_URL, API_URL, CONFORMANCE_USER_EMAIL, and CONFORMANCE_USER_PASSWORD must be configured for this GitHub Environment."
+            exit 1
+          fi
+
+          if [ "$APP_URL" != "https://dev.conformance-development-1.dcsa.org" ] || [ "$API_URL" != "https://dev-webui.conformance-development-1.dcsa.org" ]; then
+            echo "The initial authenticated scan is restricted to the approved Conformance Dev origins."
+            exit 1
+          fi
+
+      - name: Run authenticated passive scan
+        uses: zaproxy/action-af@v0.3.0
+        with:
+          plan: .github/workflows/zap/zap-authenticated-plan.yaml
+          docker_env_vars: |
+            APP_URL
+            API_URL
+            CONFORMANCE_USER_EMAIL
+            CONFORMANCE_USER_PASSWORD
+
+      - name: Select authenticated HTML report
+        if: always()
+        shell: bash
+        run: |
+          if [ ! -f zap-authenticated-report.html ]; then
+            mv zap-authenticated-report-fallback.html zap-authenticated-report.html
+          fi
+
+      - name: Upload authenticated HTML report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: zap-authenticated-report-${{ inputs.target_environment }}
+          path: zap-authenticated-report.html
+          if-no-files-found: error

.github/workflows/zap-baseline-scan.yaml

@@ -0,0 +1,73 @@
+name: OWASP ZAP Baseline Scan
+
+on:
+  workflow_dispatch:
+    inputs:
+      target_environment:
+        description: GitHub Environment that provides the Conformance application URL
+        required: true
+        type: choice
+        options:
+          - conformance-dev
+          - conformance-dt
+          - conformance-test
+
+permissions:
+  contents: read
+
+jobs:
+  baseline-scan:
+    name: Baseline scan (${{ inputs.target_environment }})
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.target_environment }}
+    env:
+      APP_URL: ${{ vars.APP_URL }}
+    steps:
+      - name: Check out the scan plan
+        uses: actions/checkout@v6.0.2
+
+      - name: Create a fallback report
+        shell: bash
+        run: printf '%s\n' '<!doctype html><title>ZAP baseline scan did not produce a report</title><p>Review this workflow run for failure details.</p>' > zap-baseline-report-fallback.html
+
+      - name: Require the approved target URL
+        shell: bash
+        run: |
+          if [ -z "$APP_URL" ]; then
+            echo "APP_URL must be configured as a GitHub Environment variable."
+            exit 1
+          fi
+
+          case "${{ inputs.target_environment }}" in
+            conformance-dev) expected_url="https://dev.conformance-development-1.dcsa.org" ;;
+            conformance-dt) expected_url="https://dt.conformance-dt-1.dcsa.org" ;;
+            conformance-test) expected_url="https://test.conformance-test-1.dcsa.org" ;;
+            *) echo "Unsupported target environment."; exit 1 ;;
+          esac
+
+          if [ "$APP_URL" != "$expected_url" ]; then
+            echo "APP_URL does not match the approved URL for ${{ inputs.target_environment }}."
+            exit 1
+          fi
+
+      - name: Run passive baseline scan
+        uses: zaproxy/action-af@v0.3.0
+        with:
+          plan: .github/workflows/zap/zap-baseline-plan.yaml
+          docker_env_vars: APP_URL
+
+      - name: Select baseline HTML report
+        if: always()
+        shell: bash
+        run: |
+          if [ ! -f zap-baseline-report.html ]; then
+            mv zap-baseline-report-fallback.html zap-baseline-report.html
+          fi
+
+      - name: Upload baseline HTML report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: zap-baseline-report-${{ inputs.target_environment }}
+          path: zap-baseline-report.html
+          if-no-files-found: error