dast

Dast 🔗

Dast scans running applications, then packages the detached evidence in a separate call. It runs on its own cadence — not inside the commit stage.

package() 🔗

Package wraps a detached scan evidence file, writes the GitHub comment, and optionally sends the Teams notification. It deliberately accepts no Service: callers persist Scan’s File on the host first, so exporting the returned Directory cannot retain or wait on a live runner tunnel.

Return Type

Directory !

Arguments

dagger -m github.com/context-and-oss/cicd/src/composites/dast@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 package --evidence file:path --commit-sha string --branch string --repo-url stringcontent_copy Copied! 

func (m *MyModule) Example(evidence *dagger.File, commitSha string, branch string, repoUrl string) *dagger.Directory  {
	return dag.
			Dast().
			Package(evidence, commitSha, branch, repoUrl)
}content_copy Copied!

@function
def example(evidence: dagger.File, commitsha: str, branch: str, repourl: str) -> dagger.Directory:
	return (
		dag.dast()
		.package(evidence, commitsha, branch, repourl)
	)content_copy Copied!

@func()
example(evidence: File, commitSha: string, branch: string, repoUrl: string): Directory {
	return dag
		.dast()
		.package(evidence, commitSha, branch, repoUrl)
}content_copy Copied!

scan() 🔗

Scan scans a running application and returns its evidence file.

One entry point, shape as a parameter (ADR-005). –app selects which of the three sources ScanWeb is given, and it is always explicit:

• url → the consumer runs the application somewhere the engine can reach, and passes –target. cicd built none of it, so the evidence states that the running code’s provenance is not attested.
• service → the consumer runs the application on the CI runner (a compose stack, a dotnet run) and passes –service=tcp://localhost:5000. cicd binds it under a fixed alias and composes the address itself. Same provenance caveat: it is the consumer’s process.
• container → cicd builds the image from –src and –dockerfile, starts it inside the engine and scans that. This is the only shape whose evidence can say the scanned code is the code this commit produced.

The application is never deployed and never published — the same ADR-001 line the commit stage holds. cicd starts a container only for –app container, and starts nothing else beside it: no database, no sidecar, no host Docker socket. An application that needs a stack around it is the consumer’s to start, which is what –app service is for.

The gate is ScanWeb’s: findings at or above –fail-on fail the run, and a readiness probe that never got a served response fails it at every threshold including NONE, because a target that was never reached produces a report of zero alerts that is otherwise byte-identical to a clean scan.

A service-shaped result must be exported immediately as a single File. The reusable workflow writes it to the runner, then passes that detached file to Package in a fresh Dagger call. Returning a Directory retains the service graph, while transporting a large File through contents can leave the CLI waiting after both calls report DONE.

Return Type

File !

Arguments

dagger -m github.com/context-and-oss/cicd/src/composites/dast@e510ca0bff49e501bdb77cbdb6b12eb0bf10c447 call \
 scan --commit-sha string --branch string --repo-url string --app string --dockerfile string --platform string --port integer --scheme string --base-path string --ready-timeout-seconds integer --mode string --api-format string --max-duration-minutes integer --fail-on stringcontent_copy Copied! 

func (m *MyModule) Example(commitSha string, branch string, repoUrl string, app string, dockerfile string, platform string, port int, scheme string, basePath string, readyTimeoutSeconds int, mode string, apiFormat string, maxDurationMinutes int, failOn string) *dagger.File  {
	return dag.
			Dast().
			Scan(commitSha, branch, repoUrl, app, dockerfile, platform, port, scheme, basePath, readyTimeoutSeconds, mode, apiFormat, maxDurationMinutes, failOn)
}content_copy Copied!

@function
def example(commitsha: str, branch: str, repourl: str, app: str, dockerfile: str, platform: str, port: int, scheme: str, basepath: str, readytimeoutseconds: int, mode: str, apiformat: str, maxdurationminutes: int, failon: str) -> dagger.File:
	return (
		dag.dast()
		.scan(commitsha, branch, repourl, app, dockerfile, platform, port, scheme, basepath, readytimeoutseconds, mode, apiformat, maxdurationminutes, failon)
	)content_copy Copied!

@func()
example(commitSha: string, branch: string, repoUrl: string, app: string, dockerfile: string, platform: string, port: number, scheme: string, basePath: string, readyTimeoutSeconds: number, mode: string, apiFormat: string, maxDurationMinutes: number, failOn: string): File {
	return dag
		.dast()
		.scan(commitSha, branch, repoUrl, app, dockerfile, platform, port, scheme, basePath, readyTimeoutSeconds, mode, apiFormat, maxDurationMinutes, failOn)
}content_copy Copied!