Backmerge dev/v3.x into Aviator 26.4

.github/instructions/java.instructions.md

@@ -30,16 +30,19 @@ Always use `headerReplace(name, value)` — never `accept()`, `contentType()`, o
 
 - New/updated code should throw only fcli-domain exceptions (`Fcli*Exception`), module-domain exceptions (for example `Aviator*Exception` in Aviator modules), or picocli exceptions (`ParameterException` and related) when integrating with command parsing.
 - Avoid throwing standard Java runtime exceptions (`IllegalArgumentException`, `IllegalStateException`, `RuntimeException`, and similar) for user-facing or command-flow errors.
+- **Checked exceptions** (e.g., `IOException`, `JsonProcessingException`): Wrap in `FcliTechnicalException` to preserve the cause chain.
+- **Runtime exceptions** (e.g., `UnexpectedHttpResponseException`): Re-throw as-is unless special handling is needed (e.g., a specific error code requires a user-friendly message). Avoid unnecessary wrapping to keep stack traces short and relevant.
 
 | Scenario | Exception |
 |----------|-----------|
 | Invalid/missing user input | `FcliSimpleException` |
 | External resource not found | `FcliSimpleException` with remediation |
 | User abort | `FcliAbortedByUserException` |
-| I/O, network, JSON parse | `FcliTechnicalException` (wrap cause) |
+| Checked exception (I/O, JSON parse) | `FcliTechnicalException` (wrap cause) |
+| Runtime exception (no special handling needed) | Re-throw as-is |
 | Invariant violation, unreachable | `FcliBugException` |
 
-Messages: actionable, sentence case, no trailing periods. Preserve root cause in wrapping.
+Messages: actionable, sentence case, no trailing periods. Wrap root cause only for checked exceptions.
 
 ## Design Patterns
 

.github/workflows/bump-shared-github.yml

@@ -0,0 +1,17 @@
+name: Bump shared-github pin
+
+on:
+  schedule:
+    - cron: '0 6 * * *'   # daily
+  workflow_dispatch:
+  push:
+  repository_dispatch:
+    types:
+      - shared-github-updated
+
+permissions:
+  contents: read
+
+jobs:
+  bump:
+    uses: fortify/shared-github/.github/workflows/reusable-bump-shared-pin.yml@5ad1afec0f56a21b03f0887eea35505cb6a66554

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ env:
 
 jobs:
   check-duplicate-run:
-    uses: fortify/.github/.github/workflows/check-duplicate-run.yml@main
+    uses: fortify/shared-github/.github/workflows/reusable-check-duplicate-run.yml@5ad1afec0f56a21b03f0887eea35505cb6a66554
 
   create-release:
     name: create-release
@@ -50,10 +50,10 @@ jobs:
       patch: ${{ steps.create_prod_release.outputs.patch }}
     steps:
       - name: Check-out source code
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
       - name: PROD - Prepare GitHub release
         id: create_prod_release
-        uses: fortify/3rdparty-actions/actions/googleapis/release-please-action/v5@main
+        uses: fortify/shared-github/actions/3rdparty/googleapis/release-please-action/v5@5ad1afec0f56a21b03f0887eea35505cb6a66554
         if: contains(github.ref, 'refs/heads/rel/')
         with:
           skip-github-pull-request: true
@@ -68,8 +68,8 @@ jobs:
       contents: read
     steps:
       - name: Check-out source code
-        uses: actions/checkout@v6
-      - uses: actions/setup-java@v5
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
+      - uses: fortify/shared-github/actions/3rdparty/actions/setup-java/v5@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -124,7 +124,7 @@ jobs:
 
       - name: Archive test results
         if: env.DO_BUILD && (success() || failure())
-        uses: actions/upload-artifact@v7
+        uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           name: test-results
           path: |
@@ -137,17 +137,17 @@ jobs:
         run: java -jar build/libs/fcli.jar --version | tee /dev/stderr | grep -E '[0-9]+\.[0-9]+\.[0-9]+' >/dev/null || (echo "fcli --version doesn't output proper version number"; exit 1)
 
       - name: Publish build artifacts
-        uses: actions/upload-artifact@v7
+        uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           name: build-output
           path: build/dist/**/*
 
-      - uses: actions/upload-artifact@v7
+      - uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           name: fcli-jar
           path: build/dist/release-assets/fcli.jar
 
-      - uses: actions/upload-artifact@v7
+      - uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           name: fcli-ftest-jar
           path: build/dist/fcli-ftest.jar
@@ -173,16 +173,16 @@ jobs:
 #      CC: /opt/musl_cc/x86_64-linux-musl-native/bin/gcc
     steps:
       - name: Check-out source code
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
 
-      - uses: fortify/3rdparty-actions/actions/graalvm/setup-graalvm/v1@main
+      - uses: fortify/shared-github/actions/3rdparty/graalvm/setup-graalvm/v1@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           distribution: ${{ env.graal_distribution }}
           java-version: ${{ env.graal_java_version }}
           native-image-musl: true
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v8
+      - uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           name: build-output
@@ -198,7 +198,7 @@ jobs:
         run: native-image ${{ env.native_image_opts }} --static --libc=musl -Djansi.disable=true --initialize-at-build-time=com.fortify.cli.common.util.JAnsiConfig -H:ExcludeResources="org/fusesource/jansi/internal/native/.*" -jar ./artifacts/release-assets/fcli.jar fcli
 
       - name: Compress native fcli
-        uses: fortify/3rdparty-actions/actions/crazy-max/ghaction-upx/v4@main
+        uses: fortify/shared-github/actions/3rdparty/crazy-max/ghaction-upx/v4@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           files: fcli
 
@@ -211,7 +211,7 @@ jobs:
       - name: Package native fcli
         run: tar -zcvf artifacts/release-assets/fcli-linux.tgz fcli -C ./artifacts fcli_completion
 
-      - uses: actions/upload-artifact@v7
+      - uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts/**/fcli-linux.tgz
           name: fcli-linux
@@ -222,15 +222,15 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Check-out source code
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
 
-      - uses: fortify/3rdparty-actions/actions/graalvm/setup-graalvm/v1@main
+      - uses: fortify/shared-github/actions/3rdparty/graalvm/setup-graalvm/v1@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           distribution: ${{ env.graal_distribution }}
           java-version: ${{ env.graal_java_version }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v8
+      - uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           name: build-output
@@ -244,7 +244,7 @@ jobs:
       # Disabled for now, as compressed binaries crash on macOS Ventura or above
       #- name: Compress native fcli
         #- name: Compress native fcli
-        #  uses: fortify/3rdparty-actions/actions/svenstaro/upx-action/v2@main
+        #  uses: fortify/shared-github/actions/3rdparty/svenstaro/upx-action/v2@5ad1afec0f56a21b03f0887eea35505cb6a66554
         #  with:
         #    files: fcli
 
@@ -254,7 +254,7 @@ jobs:
       - name: Package native fcli
         run: tar -zcvf ./artifacts/release-assets/fcli-mac.tgz fcli -C ./artifacts fcli_completion
 
-      - uses: actions/upload-artifact@v7
+      - uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts/**/fcli-mac.tgz
           name: fcli-mac
@@ -264,13 +264,13 @@ jobs:
     needs: build
     runs-on: windows-2022
     steps:
-      - uses: fortify/3rdparty-actions/actions/graalvm/setup-graalvm/v1@main
+      - uses: fortify/shared-github/actions/3rdparty/graalvm/setup-graalvm/v1@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           distribution: ${{ env.graal_distribution }}
           java-version: ${{ env.graal_java_version }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v8
+      - uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           name: build-output
@@ -287,7 +287,7 @@ jobs:
 # We don't compress the Windows binary for now as this is incompatible with current Graal version.
 # See https://github.com/fortify/fcli/issues/148
 ##      - name: Compress native fcli
-##        uses: fortify/3rdparty-actions/actions/svenstaro/upx-action/v2@main
+##        uses: fortify/shared-github/actions/3rdparty/svenstaro/upx-action/v2@5ad1afec0f56a21b03f0887eea35505cb6a66554
 ##        with:
 ##          files: fcli.exe
 
@@ -300,7 +300,7 @@ jobs:
       - name: Package native fcli
         run: 7z a artifacts\release-assets\fcli-windows.zip fcli*.exe
 
-      - uses: actions/upload-artifact@v7
+      - uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts/**/fcli-windows.zip
           name: fcli-windows
@@ -310,7 +310,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           merge-multiple: true
@@ -329,7 +329,7 @@ jobs:
         env:
           SIGN_PASSPHRASE: ${{ secrets.SIGN_PASSPHRASE }}
           SIGN_KEY: ${{ secrets.SIGN_KEY }}
-      - uses: actions/upload-artifact@v7
+      - uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           name: combined-artifacts
@@ -346,7 +346,7 @@ jobs:
       #  - The workflow_run trigger executes the workflow file from the default branch, whereas this approach
       #    allows for running the workflow file from the same branch as the ci workflow.
       - name: Check-out source code
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
       - run: | 
           # Use branch output from build job if available, otherwise fall back to GITHUB_REF
           if [ -n "${BUILD_BRANCH}" ]; then
@@ -372,17 +372,17 @@ jobs:
       id-token: write
     steps:
       - name: Check-out source code
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
 
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           name: combined-artifacts
 
       - name: PROD - Prepare release PR
         if: contains(github.ref, 'refs/heads/rel/')
-        uses: fortify/3rdparty-actions/actions/googleapis/release-please-action/v5@main
+        uses: fortify/shared-github/actions/3rdparty/googleapis/release-please-action/v5@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           skip-github-release: true
           target-branch: ${{ github.ref_name }}
@@ -399,7 +399,7 @@ jobs:
           RELEASE_BRANCH: ${{ needs.build.outputs.branch }}
 
       - name: DEV - Update ${{ needs.build.outputs.release_tag }} tag
-        uses: fortify/.github/.github/actions/update-tag@main
+        uses: fortify/shared-github/actions/fortify/update-tag@5ad1afec0f56a21b03f0887eea35505cb6a66554
         if: needs.build.outputs.do_dev_release
         with:
           tag_name: ${{ needs.build.outputs.release_tag }}
@@ -432,16 +432,16 @@ jobs:
       contents: write
     steps:
       - name: Check-out source code
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
 
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./artifacts
           name: combined-artifacts
 
       - name: PROD - Publish ${{ matrix.semantic_version }} tag
-        uses: fortify/.github/.github/actions/update-tag@main
+        uses: fortify/shared-github/actions/fortify/update-tag@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           tag_name: ${{ matrix.semantic_version }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -488,12 +488,12 @@ jobs:
       contents: write
     steps:
       - name: Check-out existing docs from gh-pages branch
-        uses: actions/checkout@v6
+        uses: fortify/shared-github/actions/3rdparty/actions/checkout/v6@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           ref: gh-pages
 
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           path: ./tmp
           name: build-output

.github/workflows/fortify-analysis.yml

@@ -15,12 +15,12 @@ permissions:
 
 jobs:
   check-duplicate-run:
-    uses: fortify/.github/.github/workflows/check-duplicate-run.yml@main
+    uses: fortify/shared-github/.github/workflows/reusable-check-duplicate-run.yml@5ad1afec0f56a21b03f0887eea35505cb6a66554
 
   FoD-Scan:
     needs: check-duplicate-run
     if: needs.check-duplicate-run.outputs.should_skip != 'true'
-    uses: fortify/.github/.github/workflows/fortify-analysis.yml@main
+    uses: fortify/shared-github/.github/workflows/reusable-fortify-analysis.yml@5ad1afec0f56a21b03f0887eea35505cb6a66554
     with:
       java-version: '17'
     secrets: inherit

.github/workflows/update-repo-docs.yml

@@ -12,4 +12,5 @@ jobs:
   update-repo-docs:
     permissions:
       contents: write
-    uses: fortify/shared-doc-resources/.github/workflows/update-repo-docs.yml@main
+      pull-requests: write
+    uses: fortify/shared-github/.github/workflows/reusable-update-repo-docs.yml@5ad1afec0f56a21b03f0887eea35505cb6a66554

.github/workflows/verify-release.yml

@@ -44,21 +44,21 @@ jobs:
     steps:
       # Java is required for running the functional tests
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: fortify/shared-github/actions/3rdparty/actions/setup-java/v5@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           distribution: 'temurin'
           java-version: '17'
 
       - name: Download release artifact
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           run-id: ${{ inputs.runId }}
           name: ${{ matrix.type == 'jar' && 'fcli-jar' || matrix.os == 'ubuntu-latest' && 'fcli-linux' || matrix.os == 'windows-latest' && 'fcli-windows' || 'fcli-mac' }}
           path: ./artifacts
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download fcli-ftest.jar
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           run-id: ${{ inputs.runId }}
           name: fcli-ftest-jar
@@ -93,7 +93,7 @@ jobs:
 
       - name: Publish test logs
         if: failure()
-        uses: actions/upload-artifact@v7
+        uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           name: test-log-${{ matrix.os }}-${{ matrix.type }}
           path: test-*.log
@@ -111,21 +111,21 @@ jobs:
     steps:
       # Java is required for running the functional tests
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: fortify/shared-github/actions/3rdparty/actions/setup-java/v5@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           distribution: 'temurin'
           java-version: '17'
 
       - name: Download fcli-linux.tgz
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           run-id: ${{ inputs.runId }}
           name: fcli-linux
           path: ./artifacts
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download fcli-ftest.jar
-        uses: actions/download-artifact@v8
+        uses: fortify/shared-github/actions/3rdparty/actions/download-artifact/v8@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           run-id: ${{ inputs.runId }}
           name: fcli-ftest-jar
@@ -164,7 +164,7 @@ jobs:
 
       - name: Publish test logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: fortify/shared-github/actions/3rdparty/actions/upload-artifact/v7@5ad1afec0f56a21b03f0887eea35505cb6a66554
         with:
           name: test-log-${{ matrix.type }}
           path: test-*.log

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.23.3"
+  ".": "3.26.1"
 }