Permission issue while Ajax scanning with root user about action-baseline HOT 2 CLOSED

I've found a workaround which we use in the ZAP test scans.
We create the files we know are required using the root user and give write access to everyone, then we run ZAP using the zap user.
Example: https://github.com/zapbot/zap-mgmt-scripts/blob/master/.github/workflows/zap-vs-ssti.yml#L42-L46
I think this workaround will work here too...

from action-baseline.

Seems like this is a prominent problem. @thc202 @psiinon I think in order to fix this we need to create a dedicated docker for action scan and in that docker file we should not use ZAP user.

Because the reason for this problem is Github action cannot persist file if a docker uses any user other than root. So shall I create another docker file for action? wdyt

from action-baseline.