chore: Documentation updates & fixes

doc-resources/action/_root/readme.md

@@ -26,6 +26,7 @@ The standard workflow provided by this GitHub Action allows for running a Static
 {{include:action/generic/fod/nocomments.snippet-fod-login.md}}
 {{include:action/generic/fod/nocomments.snippet-fod-release.md}}
 {{include:action/generic/nocomments.snippet-setup.md}}
+{{include:action/package/nocomments.snippet-sc-client-version.md}}
 {{include:action/package/nocomments.snippet-package-extra-opts.md}}
 {{include:action/fod-sast-scan/nocomments.snippet-fod-sast-scan.md}}
 {{include:action/generic/nocomments.snippet-do-wait.md}}
@@ -44,6 +45,7 @@ The standard workflow provided by this GitHub Action allows for running a Static
 {{include:action/generic/fod/nocomments.env-fod-login.md}}
 {{include:action/generic/fod/nocomments.env-fod-release.md}}
 {{include:action/fod-sast-scan/nocomments.env-setup.md}}
+{{include:action/package/nocomments.env-sc-client-version.md}}
 {{include:action/package/nocomments.env-package-extra-opts.md}}
 {{include:action/fod-sast-scan/nocomments.env-fod-sast-scan.md}}
 {{include:action/generic/nocomments.env-do-wait.md}}
@@ -75,6 +77,7 @@ The standard workflow provided by this GitHub Action allows for running a static
 {{include:action/generic/debricked/nocomments.snippet-debricked-token.md}}
 {{include:action/generic/ssc/nocomments.snippet-ssc-appversion.md}}
 {{include:action/generic/nocomments.snippet-setup.md}}
+{{include:action/package/nocomments.snippet-sc-client-version.md}}
 {{include:action/package/nocomments.snippet-package-extra-opts.md}}
 {{include:action/sc-sast-scan/nocomments.snippet-sc-sast-scan.md}}
 {{include:action/generic/nocomments.snippet-do-wait.md}}
@@ -94,6 +97,7 @@ The standard workflow provided by this GitHub Action allows for running a static
 {{include:action/generic/debricked/nocomments.env-debricked-token.md}}
 {{include:action/generic/ssc/nocomments.env-ssc-appversion.md}}
 {{include:action/sc-sast-scan/nocomments.env-setup.md}}
+{{include:action/package/nocomments.env-sc-client-version.md}}
 {{include:action/package/nocomments.env-package-extra-opts.md}}
 {{include:action/sc-sast-scan/nocomments.env-sc-sast-scan.md}}
 {{include:action/generic/nocomments.env-do-wait.md}}

doc-resources/action/fod-sast-scan/readme.md

@@ -24,6 +24,7 @@ The sample workflow below demonstrates how to configure the action for running a
 {{include:action/generic/fod/nocomments.snippet-fod-login.md}}
 {{include:action/generic/fod/nocomments.snippet-fod-release.md}}
 {{include:action/generic/nocomments.snippet-setup.md}}
+{{include:action/package/nocomments.snippet-sc-client-version.md}}
 {{include:action/package/nocomments.snippet-package-extra-opts.md}}
 {{include:action/fod-sast-scan/nocomments.snippet-fod-sast-scan.md}}
           # DO_DEBRICKED_SCAN: true
@@ -40,6 +41,7 @@ The sample workflow below demonstrates how to configure the action for running a
 {{include:action/generic/fod/nocomments.env-fod-login.md}}
 {{include:action/generic/fod/nocomments.env-fod-release.md}}
 {{include:action/fod-sast-scan/nocomments.env-setup.md}}
+{{include:action/package/nocomments.env-sc-client-version.md}}
 {{include:action/package/nocomments.env-package-extra-opts.md}}
 {{include:action/fod-sast-scan/nocomments.env-fod-sast-scan.md}}
 |DO_DEBRICKED_SCAN|Configure the static scan to also run an open-source scan. Depending on FoD configuration, this may be either a Debricked or a Sonatype scan. Effectively, this adds dependency data to the scan payload, and enables the open-source scan setting in the FoD scan configuration. Note that any existing FoD scan configuration will not be updated, so if the scan has already been configured in FoD, an open-source scan will only be performed if previously enabled in the existing scan configuration.|

doc-resources/action/package/nocomments.env-sc-client-version.md

@@ -0,0 +1 @@
+| SC_CLIENT_VERSION | By default, this action uses ScanCentral Client {{var:sc-client-version}} for packaging. This environment variable allows for overriding the ScanCentral Client version used for packaging. |

doc-resources/action/package/nocomments.snippet-sc-client-version.md

@@ -0,0 +1 @@
+          # SC_CLIENT_VERSION: 24.2

doc-resources/action/sc-sast-scan/readme.md

@@ -28,6 +28,7 @@ The sample workflow below demonstrates how to configure the action for running a
 {{include:action/generic/debricked/nocomments.snippet-debricked-token.md}}
 {{include:action/generic/ssc/nocomments.snippet-ssc-appversion.md}}
 {{include:action/generic/nocomments.snippet-setup.md}}
+{{include:action/package/nocomments.snippet-sc-client-version.md}}
 {{include:action/package/nocomments.snippet-package-extra-opts.md}}
 {{include:action/sc-sast-scan/nocomments.snippet-sc-sast-scan.md}}
           # DO_DEBRICKED_SCAN: true
@@ -45,6 +46,7 @@ The sample workflow below demonstrates how to configure the action for running a
 {{include:action/generic/ssc/nocomments.env-ssc-appversion.md}}
 {{include:action/sc-sast-scan/nocomments.env-setup.md}}
 |DO_DEBRICKED_SCAN|If set to `true`, this GitHub Action will also run a Debricked Software Composition Analysis scan and publish the results to SSC. Note that this requires the [Fortify SSC Parser Plugin for Debricked results](https://github.com/fortify/fortify-ssc-parser-debricked-cyclonedx) to be installed on Fortify SSC, to allow for SSC to accept and process the Debricked scan results submitted by this action.|
+{{include:action/package/nocomments.env-sc-client-version.md}}
 {{include:action/package/nocomments.env-package-extra-opts.md}}
 {{include:action/sc-sast-scan/nocomments.env-sc-sast-scan.md}}
 {{include:action/generic/nocomments.env-do-wait.md}}

doc-resources/template-values.md

@@ -11,7 +11,10 @@ https://github.com/fortify/github-action
 v1
 
 # fcli-doc-base-url
-https://fortify.github.io/fcli/v2.9.0/
+https://fortify.github.io/fcli/v2.9.1/
+
+# sc-client-version
+24.4.0
 
 # sc-client-doc-base-url
-https://www.microfocus.com/documentation/fortify-software-security-center/2420/SC_SAST_Help_24.2.0/index.htm
+https://www.microfocus.com/documentation/fortify-software-security-center/2440/SC_SAST_Help_24.4.0/index.htm

fod-export/README.md

@@ -65,9 +65,9 @@ This section lists the environment variables that can be specified in the `env:`
 | **FOD_URL** | Fortify on Demand URL, for example https://ams.fortify.com. Note: Using GitHub Secrets to define this URL may cause links back to FoD to be rendered incorrectly, for example in GitHub Action workflow summaries. It is highly recommended to either hard-code the URL in your workflow, or to use [GitHub Variables](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/store-information-in-variables) instead of GitHub Secrets. |
 | **FOD_CLIENT_ID**<br>**FOD_CLIENT_SECRET** | Required when authenticating with an API key: FoD Client ID (API key) and Secret (API secret). |
 | **FOD_TENANT**<br/>**FOD_USER**<br/>**FOD_PASSWORD** | Required when authenticating with user credentials: FoD tenant, user and password. It's recommended to use a Personal Access Token instead of an actual user password. |
-| FOD_LOGIN_EXTRA_OPTS<br/>EXTRA_FOD_LOGIN_OPTS | Extra FoD login options, for example for disabling SSL checks or changing connection time-outs; see [`fcli fod session login` documentation](https://fortify.github.io/fcli/v2.9.0//manpage/fcli-fod-session-login.html) . Note that `EXTRA_FOD_LOGIN_OPTS` is deprecated; please use `FOD_LOGIN_EXTRA_OPTS`.|
+| FOD_LOGIN_EXTRA_OPTS<br/>EXTRA_FOD_LOGIN_OPTS | Extra FoD login options, for example for disabling SSL checks or changing connection time-outs; see [`fcli fod session login` documentation](https://fortify.github.io/fcli/v2.9.1//manpage/fcli-fod-session-login.html) . Note that `EXTRA_FOD_LOGIN_OPTS` is deprecated; please use `FOD_LOGIN_EXTRA_OPTS`.|
 | FOD_RELEASE | Fortify on Demand release to use with this action. This can be specified either as a numeric release id, `<app-name>:<release-name>` (for non-microservices applications) or `<app-name>:<microservice-name>:<release-name>` (for microservices applications). Default value is based on repository and branch name, for example `myOrg/myRepo:myBranch`. Note that you'll need to explicitly configure `FOD_RELEASE` for microservices applications, as the default value lacks a microservice name. |
-| EXPORT_ACTION<br/>EXPORT_EXTRA_OPTS | This GitHub Action will will export scan results to the GitHub Security Code Scanning dashboard using the fcli-provided [FoD `github-sast-report`](https://fortify.github.io/fcli/v2.9.0/fod-actions.html#_github_sast_report) action or, if specified, the custom fcli action specified through `EXPORT_ACTION`. Extra options for the fcli action can be passed through the `EXPORT_EXTRA_OPTS` environment variable, for example to to allow an unsigned custom action to be used. Please see the [FoD Fcli Actions](#fod-fcli-actions) section below for more details. |
+| EXPORT_ACTION<br/>EXPORT_EXTRA_OPTS | This GitHub Action will will export scan results to the GitHub Security Code Scanning dashboard using the fcli-provided [FoD `github-sast-report`](https://fortify.github.io/fcli/v2.9.1/fod-actions.html#_github_sast_report) action or, if specified, the custom fcli action specified through `EXPORT_ACTION`. Extra options for the fcli action can be passed through the `EXPORT_EXTRA_OPTS` environment variable, for example to to allow an unsigned custom action to be used. Please see the [FoD Fcli Actions](#fod-fcli-actions) section below for more details. |
 | TOOL_DEFINITIONS | Fortify tool definitions are used by this GitHub Action to determine available versions, download location and other details of various Fortify-related tools, as required for action execution. By default, the Fortify-provided tool definitions hosted at https://github.com/fortify/tool-definitions/releases/tag/v1 will be used.<br/><br/>This environment variable allows for overriding the default tool definitions, pointing to either a URL or local (workspace) file. For example, if GitHub workflows are not allowed to download tools from their public internet locations, customers may host the tool installation bundles on an internal server, together with a customized tool definitions bundle that lists the alternative download URLs. |
 
 
@@ -82,7 +82,7 @@ This section lists the environment variables that can be specified in the `env:`
 
 As indicated in the [Action environment variable inputs](#action-environment-variable-inputs) section above, this GitHub Action utilizes one or more fcli actions to perform certain activities. These fcli-provided actions are used as building blocks that can be re-used across different CI/CD platforms to provide consistent behavior across those platforms. This GitHub Action also provides the ability to override the default built-in fcli actions with custom fcli actions, allowing for rich customization capabilities. For example, such custom fcli actions could define different default values for some action options, perform some additional activities, and/or provide fully customized behavior.
 
-For more information on fcli actions and custom action development, please see the [fcli action documentation](https://fortify.github.io/fcli/v2.9.0/#_actions). Such custom actions may be hosted either on the local file system (for example stored in your source code repository) or some remote location; the `*_ACTION` environment variables may point to either a local file or URL. To easily share custom actions across multiple pipelines, you may want to consider hosting these in a dedicated source code repository that's accessible by all pipelines. This provides an easy hosting location, and allows for easy maintenance of such custom actions.
+For more information on fcli actions and custom action development, please see the [fcli action documentation](https://fortify.github.io/fcli/v2.9.1/#_actions). Such custom actions may be hosted either on the local file system (for example stored in your source code repository) or some remote location; the `*_ACTION` environment variables may point to either a local file or URL. To easily share custom actions across multiple pipelines, you may want to consider hosting these in a dedicated source code repository that's accessible by all pipelines. This provides an easy hosting location, and allows for easy maintenance of such custom actions.
 
 <!-- END-INCLUDE:action/generic/fcli-actions.md -->