Automated Weekly Security Audits (n8n + GitHub Actions)

Problem

Requested by the engineering manager: production had no recurring security scanning in place, and the product runs on a sprawl of microservices, each with its own dedicated service — multiplying the surface area any manual review would need to cover.

Architecture

A GitHub Actions workflow runs weekly (cron: '0 0 * * 0', plus manual workflow_dispatch) against the target app, combining SCA (pnpm audit), SAST (Semgrep), and DAST (Nuclei + OWASP ZAP Baseline). Each scanner step runs with continue-on-error so one failing tool doesn't block the run, and raw JSON reports are uploaded as workflow artifacts before being POSTed to an n8n webhook.

Execution

n8n reformats the raw scan output into an OWASP-standard report using OpenAI, converts it to PDF via an existing internal tool, and delivers it to Rocket.Chat — turning four disconnected JSON dumps into one readable report with no manual step in between. The two open hard problems: DAST currently only scans headers, not authenticated routes, and the microservice sprawl means scan coverage has to keep expanding as new services ship.

Impact

Production now gets a standing weekly security scan with a report delivered automatically, where none existed before.