Fix scheduled API security workflow

.github/workflows/api-security-tests.yml

@@ -12,20 +12,37 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
-          node-version: '20'
+          node-version: '24'
           cache: npm
       - name: Install dependencies
-        run: npm install
+        run: npm ci
+      - name: Install vulnerable API lab
+        run: npm ci --prefix vulnerable-api-lab/node-api
+      - name: Start vulnerable API lab
+        run: |
+          npm start --prefix vulnerable-api-lab/node-api > /tmp/vulnerable-api-lab.log 2>&1 &
+          for attempt in {1..30}; do
+            if curl --fail --silent http://localhost:8081/api/v1/health > /dev/null; then
+              exit 0
+            fi
+            sleep 1
+          done
+          cat /tmp/vulnerable-api-lab.log
+          exit 1
       - name: Run OWASP API security smoke tests
         run: |
           mkdir -p reports
-          npx newman run collections/owasp-api-top10/owasp-api-top10-security.postman_collection.json             -e environments/production-safe.postman_environment.json             --reporters cli,json,junit             --reporter-json-export reports/newman.json             --reporter-junit-export reports/newman.xml
+          npx newman run collections/owasp-api-top10/owasp-api-top10-security.postman_collection.json \
+            -e environments/local.postman_environment.json \
+            --reporters cli,json,junit \
+            --reporter-json-export reports/newman.json \
+            --reporter-junit-export reports/newman.xml
       - name: Upload reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         if: always()
         with:
           name: newman-api-security-reports

environments/local.postman_environment.json

@@ -4,7 +4,7 @@
   "values": [
     {
       "key": "base_url",
-      "value": "http://localhost:8080",
+      "value": "http://localhost:8081",
       "type": "default"
     },
     {