scripts

name: "Tenable WAS DAST Scan"
description: "Launch and monitor a Tenable Web App Scanning (WAS) v2 scan, optionally gate on severity counts, and export results."

inputs:
  tenable_base_url:
    description: "Base URL for Tenable cloud (usually https://cloud.tenable.com)"
    required: false
    default: "https://cloud.tenable.com"

  config_id:
    description: "Tenable WAS scan configuration ID to launch"
    required: true

  poll_interval_seconds:
    description: "Seconds between status checks"
    required: false
    default: "30"

  timeout_minutes:
    description: "Max minutes to wait for scan completion"
    required: false
    default: "120"

  # Optional gating
  fail_on_severity:
    description: "Fail if findings at/above this severity exist. One of: none, low, medium, high, critical"
    required: false
    default: "high"

  # Optional export
  export_report:
    description: "Whether to export a scan report after completion"
    required: false
    default: "true"

  report_format:
    description: "Report format: json|csv|xml|html|pdf (availability depends on Tenable WAS export support)"
    required: false
    default: "json"

outputs:
  scan_id:
    description: "Launched scan ID"
    value: ${{ steps.launch.outputs.scan_id }}

  final_status:
    description: "Final scan status/state"
    value: ${{ steps.wait.outputs.final_status }}

  findings_critical:
    description: "Count of critical findings (best-effort parsing)"
    value: ${{ steps.gate.outputs.critical }}

  findings_high:
    description: "Count of high findings (best-effort parsing)"
    value: ${{ steps.gate.outputs.high }}

  findings_medium:
    description: "Count of medium findings (best-effort parsing)"
    value: ${{ steps.gate.outputs.medium }}

  findings_low:
    description: "Count of low findings (best-effort parsing)"
    value: ${{ steps.gate.outputs.low }}

runs:
  using: "composite"
  steps:
    - name: Launch WAS scan
      id: launch
      shell: bash
      env:
        TENABLE_BASE_URL: ${{ inputs.tenable_base_url }}
        CONFIG_ID: ${{ inputs.config_id }}
        TENABLE_ACCESS_KEY: ${{ env.TENABLE_ACCESS_KEY }}
        TENABLE_SECRET_KEY: ${{ env.TENABLE_SECRET_KEY }}
      run: |
        set -euo pipefail

        if [[ -z "${TENABLE_ACCESS_KEY:-}" || -z "${TENABLE_SECRET_KEY:-}" ]]; then
          echo "ERROR: TENABLE_ACCESS_KEY and TENABLE_SECRET_KEY must be provided via env."
          exit 1
        fi

        # Tenable auth header format: X-ApiKeys: accessKey=...; secretKey=...  :contentReference[oaicite:4]{index=4}
        AUTH_HEADER="X-ApiKeys: accessKey=${TENABLE_ACCESS_KEY}; secretKey=${TENABLE_SECRET_KEY}"

        # Launch scan: POST /was/v2/configs/{config_id}/scans  :contentReference[oaicite:5]{index=5}
        echo "Launching Tenable WAS scan for config_id=${CONFIG_ID} ..."
        RESP="$(curl -sS -X POST \
          "${TENABLE_BASE_URL}/was/v2/configs/${CONFIG_ID}/scans" \
          -H "${AUTH_HEADER}" \
          -H "Accept: application/json")"

        echo "Launch response: ${RESP}" | sed 's/./&/g' >/dev/null || true

        # Best-effort: scan id often returned as "id" (adjust if your response differs)
        SCAN_ID="$(echo "${RESP}" | jq -r '.id // .scan_id // .data.id // empty')"

        if [[ -z "${SCAN_ID}" || "${SCAN_ID}" == "null" ]]; then
          echo "ERROR: Could not parse scan_id from launch response."
          echo "${RESP}"
          exit 1
        fi

        echo "scan_id=${SCAN_ID}" >> "$GITHUB_OUTPUT"
        echo "Launched scan_id=${SCAN_ID}"

    - name: Wait for scan completion
      id: wait
      shell: bash
      env:
        TENABLE_BASE_URL: ${{ inputs.tenable_base_url }}
        SCAN_ID: ${{ steps.launch.outputs.scan_id }}
        POLL: ${{ inputs.poll_interval_seconds }}
        TIMEOUT_MIN: ${{ inputs.timeout_minutes }}
        TENABLE_ACCESS_KEY: ${{ env.TENABLE_ACCESS_KEY }}
        TENABLE_SECRET_KEY: ${{ env.TENABLE_SECRET_KEY }}
      run: |
        set -euo pipefail
        AUTH_HEADER="X-ApiKeys: accessKey=${TENABLE_ACCESS_KEY}; secretKey=${TENABLE_SECRET_KEY}"

        # Get scan details: GET /was/v2/scans/{scan_id}  :contentReference[oaicite:6]{index=6}
        deadline=$(( $(date +%s) + TIMEOUT_MIN*60 ))

        echo "Polling scan status every ${POLL}s (timeout ${TIMEOUT_MIN}m) ..."
        while true; do
          now=$(date +%s)
          if (( now > deadline )); then
            echo "ERROR: Timed out waiting for scan completion."
            exit 1
          fi

          RESP="$(curl -sS \
            "${TENABLE_BASE_URL}/was/v2/scans/${SCAN_ID}" \
            -H "${AUTH_HEADER}" \
            -H "Accept: application/json")"

          # Best-effort status field names (adjust if needed)
          STATUS="$(echo "${RESP}" | jq -r '.status // .state // .scan_status // .data.status // empty')"

          if [[ -z "${STATUS}" || "${STATUS}" == "null" ]]; then
            echo "WARN: Could not parse status; raw response:"
            echo "${RESP}"
            STATUS="unknown"
          fi

          echo "Scan ${SCAN_ID} status: ${STATUS}"

          # Common terminal states vary by product/config; treat these as finished:
          if [[ "${STATUS}" =~ ^(completed|complete|finished|done|canceled|cancelled|aborted|failed|error)$ ]]; then
            echo "final_status=${STATUS}" >> "$GITHUB_OUTPUT"
            break
          fi

          sleep "${POLL}"
        done

    - name: Gate on findings (optional)
      id: gate
      shell: bash
      env:
        TENABLE_BASE_URL: ${{ inputs.tenable_base_url }}
        SCAN_ID: ${{ steps.launch.outputs.scan_id }}
        FAIL_ON: ${{ inputs.fail_on_severity }}
        TENABLE_ACCESS_KEY: ${{ env.TENABLE_ACCESS_KEY }}
        TENABLE_SECRET_KEY: ${{ env.TENABLE_SECRET_KEY }}
      run: |
        set -euo pipefail
        AUTH_HEADER="X-ApiKeys: accessKey=${TENABLE_ACCESS_KEY}; secretKey=${TENABLE_SECRET_KEY}"

        if [[ "${FAIL_ON}" == "none" ]]; then
          echo "Gating disabled (fail_on_severity=none)."
          echo "critical=0" >> "$GITHUB_OUTPUT"
          echo "high=0" >> "$GITHUB_OUTPUT"
          echo "medium=0" >> "$GITHUB_OUTPUT"
          echo "low=0" >> "$GITHUB_OUTPUT"
          exit 0
        fi

        # Vulnerabilities search for scan: POST /was/v2/scans/{scan_id}/vulnerabilities/search  :contentReference[oaicite:7]{index=7}
        # NOTE: Pagination may apply; this is a "best-effort" first page summary.
        BODY='{"limit": 500, "sort": [{"field":"severity","direction":"desc"}]}'

        RESP="$(curl -sS -X POST \
          "${TENABLE_BASE_URL}/was/v2/scans/${SCAN_ID}/vulnerabilities/search" \
          -H "${AUTH_HEADER}" \
          -H "Accept: application/json" \
          -H "Content-Type: application/json" \
          -d "${BODY}")"

        # Best-effort parsing: vulnerabilities array may be in .items, .vulnerabilities, or .data.items
        ITEMS_FILTER='.items // .vulnerabilities // .data.items // []'

        # Normalize severity: some APIs use numeric severity (0-4) or strings.
        # We'll handle both.
        critical="$(echo "${RESP}" | jq -r "[${ITEMS_FILTER}[] | (.severity // .severity_label // .risk_factor // \"\")] | map(tostring | ascii_downcase) | map(select(.==\"4\" or .==\"critical\")) | length")"
        high="$(echo "${RESP}"     | jq -r "[${ITEMS_FILTER}[] | (.severity // .severity_label // .risk_factor // \"\")] | map(tostring | ascii_downcase) | map(select(.==\"3\" or .==\"high\")) | length")"
        medium="$(echo "${RESP}"   | jq -r "[${ITEMS_FILTER}[] | (.severity // .severity_label // .risk_factor // \"\")] | map(tostring | ascii_downcase) | map(select(.==\"2\" or .==\"medium\")) | length")"
        low="$(echo "${RESP}"      | jq -r "[${ITEMS_FILTER}[] | (.severity // .severity_label // .risk_factor // \"\")] | map(tostring | ascii_downcase) | map(select(.==\"1\" or .==\"low\")) | length")"

        echo "critical=${critical}" >> "$GITHUB_OUTPUT"
        echo "high=${high}"         >> "$GITHUB_OUTPUT"
        echo "medium=${medium}"     >> "$GITHUB_OUTPUT"
        echo "low=${low}"           >> "$GITHUB_OUTPUT"

        echo "Findings summary (first page): critical=${critical}, high=${high}, medium=${medium}, low=${low}"

        # Gate logic
        fail=0
        case "${FAIL_ON}" in
          low)     [[ $((critical+high+medium+low)) -gt 0 ]] && fail=1 ;;
          medium)  [[ $((critical+high+medium)) -gt 0 ]] && fail=1 ;;
          high)    [[ $((critical+high)) -gt 0 ]] && fail=1 ;;
          critical)[[ $((critical)) -gt 0 ]] && fail=1 ;;
          *) echo "WARN: Unknown fail_on_severity='${FAIL_ON}'. Not failing." ;;
        esac

        if [[ "${fail}" -eq 1 ]]; then
          echo "ERROR: Failing due to findings at/above severity '${FAIL_ON}'."
          exit 1
        fi

    - name: Export scan report (optional)
      if: ${{ inputs.export_report == 'true' }}
      shell: bash
      env:
        TENABLE_BASE_URL: ${{ inputs.tenable_base_url }}
        SCAN_ID: ${{ steps.launch.outputs.scan_id }}
        FORMAT: ${{ inputs.report_format }}
        TENABLE_ACCESS_KEY: ${{ env.TENABLE_ACCESS_KEY }}
        TENABLE_SECRET_KEY: ${{ env.TENABLE_SECRET_KEY }}
      run: |
        set -euo pipefail
        AUTH_HEADER="X-ApiKeys: accessKey=${TENABLE_ACCESS_KEY}; secretKey=${TENABLE_SECRET_KEY}"

        # Report export endpoint exists for WAS v2: GET /was/v2/scans/{scan_id}/report  :contentReference[oaicite:8]{index=8}
        # Format support varies; JSON is safest.
        echo "Exporting report (${FORMAT})..."
        mkdir -p tenable-was-report

        # Use Accept header to hint format (JSON default).
        ACCEPT="application/json"
        case "${FORMAT}" in
          json) ACCEPT="application/json" ;;
          csv)  ACCEPT="text/csv" ;;
          xml)  ACCEPT="application/xml" ;;
          html) ACCEPT="text/html" ;;
          pdf)  ACCEPT="application/pdf" ;;
        esac

        curl -sS \
          "${TENABLE_BASE_URL}/was/v2/scans/${SCAN_ID}/report" \
          -H "${AUTH_HEADER}" \
          -H "Accept: ${ACCEPT}" \
          -o "tenable-was-report/scan-${SCAN_ID}.${FORMAT}"

        echo "Saved tenable-was-report/scan-${SCAN_ID}.${FORMAT}"




# Example Usage
name: DAST (Tenable WAS)

on:
  workflow_dispatch:

jobs:
  dast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Tenable DAST
        uses: ./.github/actions/tenable-was-dast
        env:
          TENABLE_ACCESS_KEY: ${{ secrets.TENABLE_ACCESS_KEY }}
          TENABLE_SECRET_KEY: ${{ secrets.TENABLE_SECRET_KEY }}
        with:
          config_id: ${{ secrets.TENABLE_WAS_CONFIG_ID }}
          fail_on_severity: high
          timeout_minutes: 120
          export_report: true
          report_format: json

      - name: Upload report artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: tenable-was-report
          path: tenable-was-report/