Tool & CI updates #867
Tool & CI updates #867
Conversation
…tool installations
…m existing installation
|
@copilot please check code in this PR; are there any inconsistencies, does the code follow fcli code style and conventions (also considering information in the copilot instructions file), is there anything that could be improved? |
|
@copilot Please have a look at existing commit messages containing lines with |
…tify-setup action
Co-authored-by: rsenden <8635138+rsenden@users.noreply.github.com>
Co-authored-by: rsenden <8635138+rsenden@users.noreply.github.com>
Co-authored-by: rsenden <8635138+rsenden@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This substantial PR introduces centralized tool management capabilities to fcli, enabling standardized tool setup across CI/CD platforms. The key architectural shift moves tool management logic into fcli itself, allowing external integrations (GitHub Actions, Azure DevOps, etc.) to become thin wrappers.
Key changes:
- New
fcli tool setupcommand for unified tool installation/registration with auto-detection - New
fcli tool envcommands for platform-specific environment configuration (shell, PowerShell, GitHub, GitLab, ADO) - New
fcli tool * registercommands to register pre-installed tools - New
fcli tool * getcommands for version metadata retrieval - Enhanced install commands with
--copy-if-matchingfor bootstrap optimization - Action schema version bump to 2.5.0
Reviewed changes
Copilot reviewed 131 out of 131 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
| gradle.properties | Bumps action schema version to 2.5.0 for structural changes |
| ToolRegisterSpec.groovy | New comprehensive functional tests for tool registration (457 lines) |
| ToolFoDUploaderSpec.groovy | Updated tests to accept SKIPPED_EXISTING alongside INSTALLED |
| ToolFcliSpec.groovy | New tests for --copy-from functionality across scenarios |
| MCPToolFcliRunnerRecordsTest.java | Replaced wildcard import with explicit imports |
| ToolMessages.properties | Extensive new documentation for setup/env/register commands |
| Tool*.java (various) | Refactored from String toolName to Tool enum pattern across all tools |
| ToolSetupCommand.java | New high-level command orchestrating tool detection and installation |
| ToolEnv*.java (various) | New commands generating platform-specific environment configs |
| Tool.java | New enum centralizing tool metadata (names, binaries, env prefixes) |
| ToolVersionDetector.java | New utility for detecting versions from binaries/manifests/filenames |
| ToolRegistrationHelper.java | New helper managing tool registration with path resolution |
| ToolInstaller.java | Enhanced with copy-if-matching support and action tracking |
| ToolInstallationsResolver.java | New resolver consolidating installation+definition lookups |
| AbstractTool*.java (various) | Updated abstract commands to use Tool enum instead of String |
| ToolDefinitionRootDescriptor.java | Added version normalization logic |
| debricked-scan.yaml | Updated to use new fcli tool setup command |
| ci.yaml | Updated action invocations and environment detection |
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
| * @param maxDepth Maximum directory depth to search | ||
| * @param streamProcessor Function to process the stream of matching paths | ||
| * @return Result from the stream processor function | ||
| * @throws IOException if directory traversal fails |
There was a problem hiding this comment.
Javadoc for processMatchingFileStream claims to throw IOException but this is impossible.
| * @throws IOException if directory traversal fails |
| * @param maxDepth Maximum directory depth to search | ||
| * @param streamProcessor Function to process the stream of matching paths | ||
| * @return Result from the stream processor function | ||
| * @throws IOException if directory traversal fails |
There was a problem hiding this comment.
Javadoc for processMatchingFileStream claims to throw IOException but this is impossible.
| * @param maxDepth Maximum directory depth to search | ||
| * @param streamProcessor Function to process the stream of matching paths | ||
| * @return Result from the stream processor function | ||
| * @throws IOException if directory traversal fails |
There was a problem hiding this comment.
Javadoc for processMatchingDirStream claims to throw IOException but this is impossible.
| * @throws IOException if directory traversal fails |
| * @param maxDepth Maximum directory depth to search | ||
| * @param streamProcessor Function to process the stream of matching paths | ||
| * @return Result from the stream processor function | ||
| * @throws IOException if directory traversal fails |
There was a problem hiding this comment.
Javadoc for processMatchingDirStream claims to throw IOException but this is impossible.
| * @param pathFilter Predicate to filter paths (e.g., Files::isRegularFile, Files::isDirectory) | ||
| * @param streamProcessor Function to process the stream of matching paths | ||
| * @return Result from the stream processor function | ||
| * @throws IOException if directory traversal fails |
There was a problem hiding this comment.
Javadoc for processMatchingStream claims to throw IOException but this is impossible.
|
|
||
| @Command(name = OutputHelperMixins.Get.CMD_NAME) | ||
| public class ToolDebrickedCliGetCommand extends AbstractToolGetCommand { | ||
| @Getter @Mixin private OutputHelperMixins.Get outputHelper; |
There was a problem hiding this comment.
This method overrides AbstractOutputCommand.getOutputHelper; it is advisable to add an Override annotation.
|
|
||
| @Command(name = OutputHelperMixins.Get.CMD_NAME) | ||
| public class ToolFoDUploaderGetCommand extends AbstractToolGetCommand { | ||
| @Getter @Mixin private OutputHelperMixins.Get outputHelper; |
There was a problem hiding this comment.
This method overrides AbstractOutputCommand.getOutputHelper; it is advisable to add an Override annotation.
|
|
||
| @Command(name = OutputHelperMixins.Get.CMD_NAME) | ||
| public class ToolFcliGetCommand extends AbstractToolGetCommand { | ||
| @Getter @Mixin private OutputHelperMixins.Get outputHelper; |
There was a problem hiding this comment.
This method overrides AbstractOutputCommand.getOutputHelper; it is advisable to add an Override annotation.
|
|
||
| @Command(name = OutputHelperMixins.Get.CMD_NAME) | ||
| public class ToolSCClientGetCommand extends AbstractToolGetCommand { | ||
| @Getter @Mixin private OutputHelperMixins.Get outputHelper; |
There was a problem hiding this comment.
This method overrides AbstractOutputCommand.getOutputHelper; it is advisable to add an Override annotation.
|
|
||
| @Command(name = OutputHelperMixins.Get.CMD_NAME) | ||
| public class ToolVulnExporterGetCommand extends AbstractToolGetCommand { | ||
| @Getter @Mixin private OutputHelperMixins.Get outputHelper; |
There was a problem hiding this comment.
This method overrides AbstractOutputCommand.getOutputHelper; it is advisable to add an Override annotation.
Co-authored-by: rsenden <8635138+rsenden@users.noreply.github.com>
…bjectMapper() Co-authored-by: rsenden <8635138+rsenden@users.noreply.github.com>
Fix ToolInstallationDescriptor.getGlobalBinPath() and standardize ObjectMapper usage
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| private static final InputStream getToolDefinitionsInputStream() throws IOException { | ||
| return Files.exists(DEFINITIONS_STATE_ZIP) | ||
| ? Files.newInputStream(DEFINITIONS_STATE_ZIP) | ||
| return Files.exists(DEFINITIONS_STATE_ZIP) ? Files.newInputStream(DEFINITIONS_STATE_ZIP) |
Check failure
Code scanning / Fortify on Demand
Unreleased Resource: Streams High
HIGH-LEVEL GOALS
sourceanalyzeras pre-installed tool, allowing local translation/scan to be triggered from fcliciactionPURPOSE / RATIONALE
Centralize Setup Logic in Fcli
fcli tool env initcommand provides unified API that GitHub Actions, Azure DevOps, GitLab, Jenkins, and shell scripts can consume, eliminating platform-specific tool management code duplicationPre-installed Tool Detection & Registration
fcli tool <tool> registercommand auto-detects pre-installed tools via environment variables (SC_CLIENT_HOME), PATH scanning, and fcli metadata, enabling offline/restricted environments without downloadssourceanalyzerto be registered and used with fcli, for example in the fcliciactionUnified Environment Variable Generation
fcli tool envcommand family (shell, powershell, github, gitlab, ado) generates platform-appropriate environment configurations, eliminating manual PATH/HOME variable management$RUNNER_TOOL_CACHE, Azure DevOps$AGENT_TOOLSDIRECTORY, etc.) automatically detected and used for persistent tool installations across pipeline runsReusable Bootstrap Components
@fortify/setupnpm module - Zero-dependency TypeScript library provides fcli bootstrap logic (download, verify, cache) for JavaScript-based integrations, enabling standardized fcli setup across GitHub Actions, Azure DevOps tasks, and custom scriptsv3,v3.6,v3.6.1) enable flexible version pinning without hardcoding patch versions; by default, CI/CD integrations like GitHub Action will always bootstrap latest fcli v3.x.y for runningfcli tool env *commandsALSO SEE
@fortify/setupNPM module, providing re-usable code and CLI for bootstrapping fcli and running selectedfcli toolcommands:fortify/github-action/setup@feat/fcli-ci; new simplifiedsetupaction utilizing@fortify/setup:TODO
@fortify/setupmodule (no code duplication, re-use code from fcli-common where possible, short methods, any weird Copilot-generated code, ...)@fortify/setupon bootstrapping and usage; provide samples, instructions for various use cases (setting up fcli & other tools in custom CI integrations/pipelines, Dockerfile, ...)fclifcli tool env *commands as well@fortify/setup@fortify/setup(both library and CLI?) and run those tests in its build process@fortify/setup1.0.0 -> finalize GitHub Action v3 -> create/update other CI integrations (GitLab, Azure Devops, ...)TBD
@fortify/setup, new GitHub Action, ...@fortify/setup, ...?Changelog Entries
After careful review, upon squash merge of this PR, use these commit message lines for changelog generation: