feat(ci): add Aviator remediation action with automated PR creation (SSC & FoD)

fcli-core/fcli-action/src/main/resources/com/fortify/cli/generic_action/actions/zip/create-pr.yaml

@@ -0,0 +1,127 @@
+# yaml-language-server: $schema=https://fortify.github.io/fcli/schemas/action/fcli-action-schema-dev-2.x.json
+author: Fortify
+usage:
+  header: Create a pull request or merge request on GitHub or GitLab
+  description: |
+    This action creates a pull request (GitHub) or merge request (GitLab) for an
+    existing branch. The repository platform is auto-detected from the git remote URL.
+    Only GitHub and GitLab are supported; for other platforms the branch must be
+    promoted to a PR/MR manually.
+
+    Typically used after `git-stage-commit-push` to raise a PR/MR for the pushed branch.
+
+    This action requires:
+    - Git repository with a remote pointing to GitHub or GitLab
+    - A CI token with PR/MR creation permissions (GITHUB_TOKEN/GH_TOKEN or CI_JOB_TOKEN)
+
+    Configuration via CLI options or environment variables:
+    - `--source-dir` / `SOURCE_DIR` -- Local repo directory used to detect the platform (default: '.')
+    - `--source-branch` / `SOURCE_BRANCH` -- Branch to raise the PR/MR from (required)
+    - `--base-branch` / `BASE_BRANCH` -- Target branch for the PR/MR (default: auto-detected from remote, fallback "main")
+    - `--title` / `PR_TITLE` -- PR/MR title
+    - `--body` / `PR_BODY` -- PR/MR description
+
+config:
+  output: immediate
+
+cli.options:
+  sourceDir:
+    names: --source-dir, -s
+    description: >-
+      Local repo directory used to detect the repository platform.
+      Defaults to current working directory if not specified.
+    required: false
+    default: "${#env('SOURCE_DIR')?:'.'}"
+  sourceBranch:
+    names: --source-branch
+    description: >-
+      Source branch to raise the PR/MR from.
+    required: true
+    default: "${#env('SOURCE_BRANCH')?:''}"
+  baseBranch:
+    names: --base-branch
+    description: >-
+      Target branch for the PR/MR. Auto-detected from the remote HEAD if not specified,
+      falling back to "main".
+    required: false
+    default: "${#env('BASE_BRANCH')?:''}"
+  title:
+    names: --title, -t
+    description: >-
+      PR/MR title.
+    required: false
+    default: "${#env('PR_TITLE')?:'fix: Fortify auto-remediation fixes [Generated by fcli aviator]'}"
+  body:
+    names: --body
+    description: >-
+      PR/MR description.
+    required: false
+    default: "${#env('PR_BODY')?:'This pull request contains changes applied by fcli aviator.'}"
+
+steps:
+  - if: "${#isBlank(cli.sourceBranch)}"
+    throw: "Option '--source-branch' is required. Pass the source branch from which the PR/MR is to be created."
+
+  # Compute base branch: CLI option/env var -> git remote HEAD -> "main"
+  - var.set:
+      baseBranch: "${#ifBlank(cli.baseBranch, #ifBlank(#git.defaultBranch(cli.sourceDir), 'main'))}"
+
+  # Detect repository platform from git remote URL
+  - var.set:
+      repoPlatform: ${#git.repositoryPlatform(cli.sourceDir)}
+
+  # GitHub PR creation
+  - if: "${repoPlatform=='github'}"
+    do:
+      - var.set:
+          repoOwner: "${#git.ciRepositoryOwner()}"
+          prHead: "${repoOwner}:${cli.sourceBranch}"
+      - log.debug: "Creating GitHub PR: head=${prHead}, base=${baseBranch}, title=${cli.title}"
+      - var.set:
+          pr: ${#_ci.detect().repo().createPullRequest(cli.title, prHead, baseBranch, cli.body)}
+        on.fail:
+          - log.warn:
+              msg: "Failed to create GitHub Pull Request from '${cli.sourceBranch}' to '${baseBranch}'"
+              cause: ${lastException}
+          - log.warn: "Troubleshooting: Verify branch '${cli.sourceBranch}' exists on remote and base branch '${baseBranch}' is valid"
+          - log.debug: "Failed to create GitHub PR: ${lastException.message}"
+          - throw:
+              msg: "Failed to create GitHub Pull Request from '${cli.sourceBranch}' to '${baseBranch}'"
+              cause: ${lastException}
+      - if: ${#isNotBlank(pr)} && ${#isNotBlank(pr.html_url)} && ${#isNotBlank(pr.number)}
+        do:
+          - log.info: "Created GitHub Pull Request #${pr.number}: ${pr.html_url}"
+
+      - if: ${#isBlank(pr)} || ${#isBlank(pr.html_url)}
+        do:
+          - log.warn: "PR creation returned empty or invalid response: ${pr}"
+          - throw: "GitHub PR creation did not return expected response. Check logs for details."
+  # GitLab MR creation
+  - if: "${repoPlatform=='gitlab'}"
+    do:
+      - log.debug: "Creating GitLab Merge Request: source=${cli.sourceBranch}, target=${baseBranch}, title=${cli.title}"
+      - var.set:
+          mr: ${#_ci.detect().project().createMergeRequest(cli.title, cli.sourceBranch, baseBranch, cli.body)}
+        on.fail:
+          - log.warn:
+              msg: "Failed to create GitLab Merge Request from '${cli.sourceBranch}' to '${baseBranch}'"
+              cause: ${lastException}
+          - log.warn: "Troubleshooting: Verify branch '${cli.sourceBranch}' exists on remote and base branch '${baseBranch}' is valid"
+          - throw:
+              msg: "Failed to create GitLab Merge Request from '${cli.sourceBranch}' to '${baseBranch}'"
+              cause: ${lastException}
+      - if: ${#isNotBlank(mr)} && ${#isNotBlank(mr.web_url)} && ${#isNotBlank(mr.iid)}
+        do:
+          - log.info: "Created GitLab Merge Request !${mr.iid}: ${mr.web_url}"
+
+      - if: ${#isBlank(mr)} || ${#isBlank(mr.web_url)}
+        do:
+          - log.warn: "Merge Request creation returned empty or invalid response: ${mr}"
+          - throw: "GitLab MR creation did not return expected response. Check logs for details."
+
+  # Unsupported repository platform
+  - if: "${repoPlatform!='github' && repoPlatform!='gitlab'}"
+    do:
+      - log.warn: "PR/MR creation is not supported for repository platform '${repoPlatform}'. Branch '${cli.sourceBranch}' has been pushed; please create a PR/MR manually."
+      - throw: "PR/MR creation is not supported for repository platform '${repoPlatform}'"
+  - log.info: "create-pr completed: PR/MR created for branch '${cli.sourceBranch}' targeting '${baseBranch}'"

fcli-core/fcli-action/src/main/resources/com/fortify/cli/generic_action/actions/zip/git-push-changes.yaml

@@ -0,0 +1,128 @@
+# yaml-language-server: $schema=https://fortify.github.io/fcli/schemas/action/fcli-action-schema-dev-2.x.json
+author: Fortify
+usage:
+  header: Stage, commit and push local changes to a new branch
+  description: |
+    This action detects local file changes, creates a new branch, stages and commits
+    the changes, then pushes the branch to the remote repository. Credentials are
+    auto-detected from the CI environment (GitHub Actions, GitLab CI, Azure DevOps,
+    Bitbucket Pipelines).
+
+    This action requires:
+    - Git repository access (local clone with a configured remote)
+    - A CI token with push permissions (GITHUB_TOKEN, GH_TOKEN, CI_JOB_TOKEN,
+      SYSTEM_ACCESSTOKEN, or BITBUCKET_TOKEN)
+
+    Configuration via CLI options or environment variables:
+    - `--source-dir` / `SOURCE_DIR` -- Directory where changes are detected (default: '.')
+    - `--branch-name` / `BRANCH_NAME` -- Full branch name to use.
+    - `--commit-message` / `COMMIT_MESSAGE` -- Commit message
+    - `--author-name` / `GIT_AUTHOR_NAME` -- Commit author name (default: "fcli-aviator[bot]")
+    - `--author-email` / `GIT_AUTHOR_EMAIL` -- Commit author email
+
+config:
+  output: immediate
+
+# NOTE: When updating any options, commit-and-create-pr action may also need to be updated
+cli.options:
+  sourceDir:
+    names: --source-dir, -s
+    description: >-
+      Directory where changes are detected.
+      Defaults to current working directory if not specified.
+    required: false
+    default: "${#env('SOURCE_DIR')?:'.'}"
+  branchName:
+    names: --branch-name
+    description: >-
+      Full branch name to use.
+    required: true
+    default: "${#env('BRANCH_NAME')?:''}"
+  commitMessage:
+    names: --commit-message, -m
+    description: >-
+      Git commit message.
+    required: false
+    default: "${#env('COMMIT_MESSAGE')?:'fix: apply automated fixes [generated by fcli aviator]'}"
+  authorName:
+    names: --author-name
+    description: >-
+      Git author name for the commit.
+    required: false
+    default: "${#env('GIT_AUTHOR_NAME')?:'fcli-aviator[bot]'}"
+  authorEmail:
+    names: --author-email
+    description: >-
+      Git author email for the commit.
+    required: false
+    default: "${#env('GIT_AUTHOR_EMAIL')?:'fcli-aviator@opentext.com'}"
+
+steps:
+  - log.debug: "Action configuration: sourceDir=${cli.sourceDir}, branchName=${cli.branchName}, author=${cli.authorName} <${cli.authorEmail}>"
+
+  # Validate git repository
+  - var.set:
+      gitRepoInfo: ${#git.localRepo(cli.sourceDir)}
+  - if: ${#isBlank(gitRepoInfo)}
+    throw: "Source directory '${cli.sourceDir}' is not a git repository."
+  - if: "${#isBlank(gitRepoInfo.repository.remoteUrl)}"
+    throw: "Git repository has no remote URL configured. A remote is required for push."
+  - log.info: "Git repository: remote=${gitRepoInfo.repository.remoteUrl}, branch=${gitRepoInfo.branch.short?:'detached HEAD'}"
+
+  # Check for changes
+  - var.set:
+      hasChanges: ${#git.hasChanges(cli.sourceDir)}
+  - if: ${!hasChanges}
+    do:
+      - log.info: "No changes detected in ${cli.sourceDir}, skipping commit and push."
+      - exit: 0
+  - log.info: "Changes detected in ${cli.sourceDir}, proceeding."
+
+  # Create and checkout branch
+  - var.set:
+      branchName: "${#git.checkoutNewBranch(cli.sourceDir, cli.branchName)}"
+    on.fail:
+      - log.warn:
+          msg: "Failed to create/checkout branch"
+          cause: ${lastException}
+      - throw: ${lastException}
+  - log.info: "Created branch: ${branchName}"
+
+  # Stage all changes
+  - var.set:
+      staged: ${#git.addAll(cli.sourceDir)}
+    on.fail:
+      - log.warn:
+          msg: "Failed to stage changes in ${cli.sourceDir}"
+          cause: ${lastException}
+      - throw: ${lastException}
+  - log.debug: "All changes staged successfully"
+
+  # Commit
+  - var.set:
+      commitSha: "${#git.commit(cli.sourceDir, cli.commitMessage, cli.authorName, cli.authorEmail)}"
+    on.fail:
+      - log.warn:
+          msg: "Failed to commit staged changes"
+          cause: ${lastException}
+      - throw: ${lastException}
+  - log.info: "Committed changes: ${commitSha}"
+  - log.debug: "Remote URL: ${gitRepoInfo.repository.remoteUrl}"
+
+  # Push
+  - var.set:
+      pushedRef: ${#git.push(cli.sourceDir, branchName)}
+    on.fail:
+      - var.set:
+          remoteUrl: "${gitRepoInfo.repository.remoteUrl?:'unknown'}"
+          exceptionMsg: "${lastException.message}"
+      - log.warn:
+          msg: "Failed to push branch '${branchName}' to remote '${remoteUrl}': ${exceptionMsg}"
+          cause: ${lastException}
+      - if: "${exceptionMsg.contains('No credentials available')}"
+        log.warn: "DIAGNOSIS: Push failed due to missing credentials. Set one of: GITHUB_TOKEN/GH_TOKEN, CI_JOB_TOKEN, SYSTEM_ACCESSTOKEN, or BITBUCKET_TOKEN"
+      - throw:
+          msg: "Failed to push branch '${branchName}' to remote"
+          cause: ${lastException}
+  - log.info: "Pushed branch to remote: ${pushedRef}"
+  - log.info: "git-push-changes completed: branch=${branchName}, commit=${commitSha}"