feat: pull backend zap scan out of dev deployment

Our security people want to be able to receive a scan for other
environments, so here we go

Author: trev-dev

.github/workflows/deploy-to-openshift-backend-dev.yml

@@ -209,22 +209,6 @@ jobs:
 
   zap:
     name: Run Zap Scan
-    permissions:
-      contents: read
-    needs: openshift-ci-cd
-    runs-on: ubuntu-24.04
-    environment: dev
-    steps:
-      - name: Check out repository with branch [${{ env.BRANCH }}]
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ env.BRANCH }}
-          persist-credentials: false
-      - name: ZAP Scan
-        uses: zaproxy/action-full-scan@v0.13.0
-        with:
-          target: "https://${{ secrets.SITE_URL }}/api"
-          artifact_name: ccof_backend_zap
-          fail_action: true              # fail the job if alerts found
-          allow_issue_writing: false     # don't open/update a GitHub Issue
-          rules_file_name: .zap/rules-backend.tsv
+    uses: bcgov/EDUC-CCOF/.github/workflows/zap-scan-node.yml
+    with:
+      env: 'dev'

.github/workflows/zap-scan-node.yaml

@@ -0,0 +1,51 @@
+name: Zap Scan Node
+
+env:
+  BRANCH: ${{ github.ref_name }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      env:
+        description: 'The openshift environment to scan'
+        default: 'dev'
+        options:
+        - 'dev'
+        - 'qa'
+        - 'uat'
+        - 'efx'
+        - 'prod'
+  workflow_call:
+    inputs:
+      env:
+        description: 'The openshift environment to scan'
+        default: 'dev'
+        options:
+        - 'dev'
+        - 'qa'
+        - 'uat'
+        - 'efx'
+        - 'prod'
+
+jobs:
+  zap:
+    name: Run Zap Scan
+    permissions:
+      contents: read
+    needs: openshift-ci-cd
+    runs-on: ubuntu-24.04
+    environment: ${{ inputs.env }}
+    steps:
+      - name: Check out repository with branch [${{ env.BRANCH }}]
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.BRANCH }}
+          persist-credentials: false
+      - name: ZAP Scan
+        uses: zaproxy/action-full-scan@v0.13.0
+        with:
+          target: "https://${{ secrets.SITE_URL }}/api"
+          artifact_name: ccof_backend_${{ inputs.env }}
+          fail_action: true              # fail the job if alerts found
+          allow_issue_writing: false     # don't open/update a GitHub Issue
+          rules_file_name: .zap/rules-backend.tsv