feat(oracle-fusion): add risk management integration

[BillLeoutsakosvl346]

Summary

• Add one Oracle Fusion Risk Management block with 115 documented actions across compliance records, assessment responses, supporting records, Advanced Controls incidents, access simulation, and assignment groups.
• Stack on feat(oracle-fusion): add shared integration foundation #7427 and reuse its integration-user credentials, secured client, exact identifiers, JSON mutations, and bounded pagination. Product contracts and selectors stay in this integration.
• Exclude unsupported risk updates and issue creation, control execution, test-plan creation, ambiguous role checks/mass edits, flexfields, approvals, and access provisioning. Licensed and enabled Oracle features, REST privileges, and record access are required; no live tenant validation is claimed.

Type of Change

• New integration

Testing

• Focused contract, block, and selector tests added. Automated validation runs only on GitHub through an explicit test-build.yml dispatch because this PR targets the foundation branch.
• Independent integration reviewer approved the combined foundation and child behavior, including the final credential catalog correction. No unresolved integration-specific findings remain.
• GitHub validation passed for 82f1721be24205768e40676eacce0fcdc9227b40: lint, audits, workspace type checks, all test shards, and app build. Greptile reviewed that same commit at 5/5; there are no unresolved review threads. No local tests, builds, lint, type checks, or audits were run.
• Regenerated tool metadata, documentation/catalog, and the docs manifest. Reusable Fusion service-account credentials are configured in the block using the existing NetSuite/Snowflake catalog convention. The shared OAuth-only setup/catalog mapping does not cover service-account-only integrations.

Checklist

• Self-reviewed the integration and foundation-relative scope
• Added focused tests
• GitHub validation passing
• Greptile 5/5 with no unresolved review threads
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 5, 2026 11:59pm UTC

[BillLeoutsakosvl346]

GitHub validation for the initial implementation commit: https://github.com/simstudioai/sim/actions/runs/33999177719. This is an explicit dispatch because the PR targets the foundation branch. Independent source review has no unresolved integration-specific findings; automated results are pending.

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@greptile-apps Please review this integration against its foundation base. The file count comes from the established one-tool-per-action layout and generated artifacts.

[greptile-apps]

Greptile Summary

The latest commit corrects how Oracle Fusion Risk Management is represented in the setup catalog while preserving its reusable service-account credential inside the workflow block.

• Classifies the integration as API-key-backed in the generated deployment catalog.
• Removes the OAuth catalog mapping that would incorrectly require a deploy-time OAuth client.
• Retains the block-level Oracle Fusion service-account selector and advanced credential-ID input.
• Adds a focused contract assertion and clarifies the credential setup documentation.

Confidence Score: 5/5

The current commit appears safe to merge; the setup-catalog correction follows an established integration pattern without disrupting block-level credential selection.

No new actionable failures or repository-rule violations remain. The catalog now avoids requiring a deploy-time OAuth client, while the block continues to select the reusable Oracle Fusion service-account credential through its own configured input.

Important Files Changed

Filename	Overview
apps/sim/blocks/blocks/oracle_fusion_risk_management.ts	Reclassifies the block as API-key-backed while retaining its reusable service-account credential input.
apps/sim/blocks/blocks/oracle_fusion_risk_management.test.ts	Verifies the API-key auth mode and preserved service-account input contract.
packages/deployment-config/src/integrations.json	Changes the setup-catalog entry from OAuth to API-key authentication and removes its OAuth service ID.
packages/deployment-config/src/service-account-providers.generated.ts	Removes the catalog-derived Oracle Fusion service-account mapping now that the integration is not OAuth-classified.
apps/sim/lib/integrations/credential-display.test.ts	Updates expected catalog credential associations to reflect block-local credential selection.
apps/docs/content/docs/integrations/oracle_fusion_risk_management.mdx	Clarifies that users create or select the reusable Oracle Fusion connection from the block.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Catalog[Integration catalog] -->|authType: api-key| Setup[Setup catalog]
  Setup -->|No OAuth client required| Block[Oracle Fusion Risk Management block]
  Block -->|oauth-input, service-account| Credential[Reusable Oracle Fusion credential]
  Credential --> Executor[Risk Management operations]

Loading

_{Reviews (5): Last reviewed commit: "fix(oracle-fusion): follow service-accou..." | Re-trigger Greptile}

[BillLeoutsakosvl346]

@greptile-apps Please review the current commit. It completes the service type and existing registry inventory expectations and applies CI style corrections. Simulation filtering retains the same strict contract. All 44 focused integration tests passed in the first GitHub run; full validation is being rerun.

[BillLeoutsakosvl346]

@greptile-apps Please review the latest commit. This round applies the remaining CI layout/import suggestions and adds the generated docs-manifest entry. The previous candidate passed the application build and both test shards; a fresh full CI dispatch is running.

[BillLeoutsakosvl346]

@greptile-apps The current commit contains only the final CI layout and import-order suggestions. Please refresh the review for the current SHA; full CI is running again.

[BillLeoutsakosvl346]

@greptile-apps Please review the current commit. GitHub exposed that the setup catalog requires a real OAuth client for OAuth-classified entries. This integration now follows the existing NetSuite/Snowflake API-key catalog convention while retaining its reusable Fusion service-account credential in the block. No shared setup logic changed. Catalog-driven credential association/setup links remain outside the supported shared model. All 45 audits, lint, type checks, build, and two test shards passed in the prior run; the setup failure is addressed and full CI is rerunning.