Merge pull request #81 from OWASP/dev

Dev Release: v0.17.2 Publish Github Action

action.yml

@@ -0,0 +1,56 @@
+name: 'OWASP OFFAT CICD Scanner'
+description: 'Autonomously assesses your API for prevalent vulnerabilities in CICD pipelines'
+branding:
+  icon: shield
+  color: blue
+
+inputs:
+  file:
+    description: 'path or url of openapi/swagger specification file'
+    required: true
+
+  rate_limit:
+    description: 'API requests rate limit per second. default: 60'
+    required: false
+    default: '60'
+
+  artifact_retention_days:
+    description: 'artifact retention period in days. default: 2'
+    required: false
+    default: '2'
+
+runs:
+  using: composite
+  steps:
+      - name: Setup Python 3.12
+        uses: actions/setup-python@v5.1.0
+        with:
+          python-version: '3.12'
+
+      - name: Install OFFAT
+        run: pip install -U offat
+        shell: bash
+
+      - name: Run Scanner
+        env:
+          scanner_file: ${{ inputs.file }}
+          scanner_rate_limit: ${{ inputs.rate_limit }}
+
+        run: |
+          mkdir -p ./offat-tmp/
+          offat --file $scanner_file --rate-limit $scanner_rate_limit -of json -o ./offat-tmp/results.json --capture-failed -H 'User-Agent: github-action-offat'
+        shell: bash
+
+      - name: Upload Scan Results to Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: offat-results.json
+          path: ./offat-tmp/results.json
+          retention-days: ${{ inputs.artifact_retention_days }}
+          # retention period docs: https://docs.github.com/en/actions/learn-github-actions/usage-limits-billing-and-administration#artifact-and-log-retention-policy
+
+      - name: CleanUp
+        run: rm -rf ./offat-tmp/
+        shell: bash
+
+

src/offat/__main__.py

@@ -68,7 +68,7 @@ def start():
         '--output',
         dest='output_file',
         type=str,
-        help='path to store test results in specified format. Default format is html',
+        help='path to store test results',
         required=False,
         default=None,
     )

src/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "offat"
-version = "0.17.1"
+version = "0.17.2"
 description = "Offensive API tester tool automates checks for common API vulnerabilities"
 authors = ["Dhrumil Mistry <dhrumil.mistry@owasp.org>"]
 license = "MIT"