feat: Add DAST scan support to SSC ci action

fcli-core/fcli-app/src/main/resources/com/fortify/cli/app/actions/build-time/ci-doc.yaml

@@ -353,7 +353,7 @@ formatters:
               \n* Debug logging for Scancentral Client is disabled; pass --debug on the fcli invocation to enable debug logging.
       - title: Scan Execution
         overview: >-
-          Configure SAST and Debricked scan execution and waiting behavior for ${productNames.ssc}.
+          Configure SAST, DAST, and Debricked scan execution and waiting behavior for ${productNames.ssc}.
         vars:
           - names: DO_SAST_SCAN\nSAST_SCAN_EXTRA_OPTS
             desc: >-
@@ -363,6 +363,21 @@ formatters:
               the fcliCmd:fcli sc-sast scan start: command, for example to request a scan completion email notification.
               Note that these environment variables only control the submission of the scan request; see the
               information below for details on waiting for the scan to complete. 
+          - names: DAST_SETTINGS\nDO_DAST_SCAN\nDAST_SCAN_NAME\nDAST_SCAN_EXTRA_OPTS
+            desc: >-
+              The fcli `ci` action can run a ScanCentral DAST scan using pre-existing scan settings that have
+              already been configured for the target application version; this action does not create or modify
+              scan settings. Set `DAST_SETTINGS` to the CI/CD token or numeric id of the SC-DAST scan settings to
+              use (see the `cicdToken` and `id` fields returned by fcliCmd:fcli sc-dast scan-settings list:).
+              Unlike the SAST scan, the DAST scan is disabled by default, even if `DAST_SETTINGS` is configured,
+              as `DAST_SETTINGS` may be a permanent CI/CD variable while DAST scans are often only meant to run
+              on demand. Set `DO_DAST_SCAN` to `true` to enable the DAST scan for a given pipeline run (in
+              addition to `DAST_SETTINGS` being set). By default, the scan name is auto-generated from the
+              application version and run id (with `:`/`/` characters replaced by `-`); set `DAST_SCAN_NAME` to
+              use a custom scan name instead. The `DAST_SCAN_EXTRA_OPTS` environment variable can be used
+              to provide additional options to the fcliCmd:fcli sc-dast scan start: command. Note that these
+              environment variables only control the submission of the scan request; see the information below
+              for details on waiting for the scan to complete.
           - names: DO_DEBRICKED_SCAN\nDEBRICKED_SCAN_EXTRA_OPTS\nDEBRICKED_ACCESS_TOKEN\nDEBRICKED_VERSION\nDEBRICKED_HOME
             desc: >-
               The fcli `ci` action supports running a Debricked Software Composition Analysis (SCA) scan, which
@@ -377,13 +392,17 @@ formatters:
               \n  * `latest` to use the latest available Debricked CLI version
               \n  * `auto` (default) to use a pre-installed version if available, otherwise installs latest
               \n* If neither `DEBRICKED_VERSION` nor `DEBRICKED_HOME` are set, defaults to `auto` behavior.
-          - names: DO_WAIT\nDO_SAST_WAIT\nSAST_WAIT_EXTRA_OPTS\nDEBRICKED_WAIT_EXTRA_OPTS
+          - names: DO_WAIT\nDO_SAST_WAIT\nSAST_WAIT_EXTRA_OPTS\nDAST_WAIT_EXTRA_OPTS\nDEBRICKED_WAIT_EXTRA_OPTS
             desc: >-
               By default, the fcli `ci` action will wait for all started scans to complete; set `DO_WAIT` to
               `false` to just kick off any configured scans without waiting for completion. Note that doing so
               will skip any post-scan tasks. The `SAST_WAIT_EXTRA_OPTS` environment variable can be used to pass
-              extra options to the fcliCmd:fcli sc-sast scan wait-for: command, and similarly, the `DEBRICKED_WAIT_EXTRA_OPTS`
-              environment variable can be used to pass extra options to the fcliCmd:fcli ssc artifact wait-for: command.
+              extra options to the fcliCmd:fcli sc-sast scan wait-for: command, and similarly, the `DAST_WAIT_EXTRA_OPTS`
+              environment variable can be used to pass extra options to the fcliCmd:fcli sc-dast scan wait-for: command,
+              and the `DEBRICKED_WAIT_EXTRA_OPTS` environment variable can be used to pass extra options to the
+              fcliCmd:fcli ssc artifact wait-for: command.\n\nDAST scans can take considerably longer than SAST scans,
+              potentially exceeding CI/CD job time limits (for example on GitHub Actions or GitLab CI); if the
+              default wait timeout doesn't suffice, pass a `--timeout` option through `DAST_WAIT_EXTRA_OPTS`.
       - title: Post-Scan Actions
         overview: >
           Configure post-scan tasks including Aviator auditing, application version summaries, policy checks,

fcli-core/fcli-ssc/src/main/resources/com/fortify/cli/ssc/actions/zip/ci.yaml

@@ -10,7 +10,8 @@ usage:
     * Create & configure SSC application version if needed
     * Package source code
     * Submit SAST scan request
-    * Wait for SAST scan completion
+    * Submit DAST scan request, using pre-existing SC-DAST scan settings
+    * Wait for SAST/DAST scan completion
     * Perform post-scan activities, like checking policy outcome, exporting results, ...
 
     Configuration for this fcli action is done through environment variables; the
@@ -59,8 +60,11 @@ steps:
       # Configure session name
       sessionName: ci-${#action.runID()}
       # Configure scan types to run
-      dast.skipReason:  # TODO
-      dast.skip: true
+      dast.skipReason: > # Disabled by default; requires DO_DAST_SCAN=true and DAST_SETTINGS to be enabled
+        ${
+            #fcliCmdSkipFromEnvReason('DAST_SCAN', true)
+            ?:#skipBlankEnvReason('DAST_SETTINGS')
+        }
       sast.skipReason: > # Enabled by default, unless explicitly disabled
         ${
             #fcliCmdSkipFromEnvReason('SAST_SCAN', false)
@@ -87,6 +91,11 @@ steps:
             #fcliCmdSkipFromEnvReason('WAIT', false)
             ?:#fcliCmdSkipFromEnvReason('SAST_WAIT', false) 
         }
+      # Sanitize ':'/'/' from app/repo names for SC-DAST; override via DAST_SCAN_NAME
+      dast.scanName: >-
+        ${
+            #env('DAST_SCAN_NAME')?:(global.ci.av + '-' + #action.runID()).replaceAll('[:/]', '-')
+        }
       # Post-scan tasks will be skipped if wait is skipped or if no scans were completed
       # successfully. Post-scan skip reason will be reset to null once the wait task for
       # any scan completed successfully. 
@@ -134,6 +143,12 @@ steps:
                 - ${sast.skipReason}                     # Skip if SAST scan is skipped
                 - ${PACKAGE_ACTION.dependencySkipReason} # Skip if PACKAGE_ACTION was skipped or failed
 
+            # DAST scan using pre-existing SC-DAST settings (DAST_SETTINGS); not created here
+            DAST_SCAN:
+              cmd: ${#fcliCmd('DAST_SCAN', 'sc-dast scan start')} --settings "${#env('DAST_SETTINGS')}" --name "${dast.scanName}" --store sc_dast_scan
+              skip.if-reason:
+                - ${dast.skipReason} # Skip if DAST scan is skipped
+
             DEBRICKED_SCAN_ACTION:
               # --extra-scan-opts is passed through global.debrickedScan.extraOpts variable defined above
               cmd: >
@@ -172,6 +187,15 @@ steps:
                 - ${SAST_SCAN.dependencySkipReason}                  # Skip if SAST_SCAN was skipped or failed
               on.success:
                 - var.set: { postScan.skipReason: } # Reset postScan.skipReason to allow post-scan tasks to run
+
+            # DAST can be slow; use DAST_WAIT_EXTRA_OPTS to pass --timeout if needed
+            DAST_WAIT:
+              cmd: "${#fcliCmd('DAST_WAIT', 'sc-dast scan wait-for')} ::sc_dast_scan::"
+              skip.if-reason:
+                - ${wait.skipReason}                                 # Skip if wait.skipReason!=null
+                - ${DAST_SCAN.dependencySkipReason}                  # Skip if DAST_SCAN was skipped or failed
+              on.success:
+                - var.set: { postScan.skipReason: } # Reset postScan.skipReason to allow post-scan tasks to run
 
             DOWNLOAD_SAST_LOG:
               cmd: "${#fcliCmd('DOWNLOAD_SAST_LOG', 'sc-sast scan download -t log')} ::sc_sast_scan::"