https://www.zaproxy.org/
A GitHub Action for running the OWASP ZAP API scan to perform Dynamic Application Security Testing (DAST).
https://github.com/marketplace/actions/owasp-zap-api-scan
https://github.com/analysis-tools-dev/dynamic-analysis
https://github.com/analysis-tools-dev/static-analysis