// Chalti hui app par hamla karke dekhta hai (dynamic testing).
// SAST code padhta hai, Trivy packages dekhta hai - ye dono wo nahi pakadte
// jo sirf running app me dikhta hai: missing security headers, khuli
// directory listing, cookie flags, etc.
def call() {
    sh '''
        set +e
        CID=$(docker run -d --name "dast-$BUILD_NUMBER" "$FULL_IMAGE")
        trap "docker rm -f $CID >/dev/null 2>&1" EXIT
        sleep 6

        mkdir -p zap-report && chmod 777 zap-report

        # ZAP app ke hi network namespace me chalta hai - to 127.0.0.1 par
        # app seedha mil jaata hai, koi extra network banane ki zarurat nahi.
        docker run --rm \
          --network "container:$CID" \
          -v "$PWD/zap-report":/zap/wrk:rw \
          "$IMG_ZAP" zap-baseline.py \
            -t "http://127.0.0.1:${APP_PORT}" \
            -r zap-report.html -J zap-report.json \
            -I -m 2
        RC=$?
        echo "  zap exit: $RC  (0=clean, 1=FAIL mila, 2=warning only)"
        exit $RC
    '''
    archiveArtifacts artifacts: 'zap-report/zap-report.*', allowEmptyArchive: true
}