Add buildscript configuration and Fortify analysis workflow

[Copilot]

Fixes build failure caused by unavailable com.overzealous:remark:1.1.0 dependency and adds automated security scanning workflow.

Changes

• build.gradle: Added buildscript block with dependency substitution to replace unavailable com.overzealous:remark:1.1.0 with com.wavefront:remark:2023-07.07
• .github/workflows/fortify-analysis.yml: New workflow calling reusable Fortify SAST and Debricked SCA workflow from fortify/.github

buildscript {
    configurations.all {
        resolutionStrategy.dependencySubstitution {
            substitute module("com.overzealous:remark:1.1.0") using module("com.wavefront:remark:2023-07.07") because "not available on maven central anymore"
        }
    }
}

The workflow runs on push, PR, manual trigger, and weekly schedule (Fridays at 00:16 UTC).

Original prompt

Add buildscript configuration and Fortify analysis workflow

This PR adds two important updates:

1. Build.gradle fix: Add the required buildscript snippet at the top of build.gradle to fix dependency resolution issues with the org.kordamp.gradle.markdown plugin. The snippet substitutes the unavailable com.overzealous:remark:1.1.0 dependency with com.wavefront:remark:2023-07.07.

2. Fortify analysis workflow: Add a new GitHub Actions workflow at .github/workflows/fortify-analysis.yml that runs Fortify on Demand SAST and Debricked SCA scans. This workflow calls a reusable workflow from fortify/.github repository.

Changes needed:

• Add buildscript block at the very top of build.gradle (before the plugins block):

buildscript {
    configurations.all {
        resolutionStrategy.dependencySubstitution {
            substitute module("com.overzealous:remark:1.1.0") using module("com.wavefront:remark:2023-07.07") because "not available on maven central anymore"
        }
    }
}

• Create .github/workflows/fortify-analysis.yml with:

name: Fortify Analysis

on:
  workflow_dispatch:
  push:
  pull_request:
  schedule:
    - cron: '16 0 * * 5'

jobs:
  fortify:
    uses: fortify/.github/.github/workflows/fortify-analysis.yml@main
    secrets: inherit

This pull request was created as a result of the following prompt from Copilot chat.

Add buildscript configuration and Fortify analysis workflow

This PR adds two important updates:

1. Build.gradle fix: Add the required buildscript snippet at the top of build.gradle to fix dependency resolution issues with the org.kordamp.gradle.markdown plugin. The snippet substitutes the unavailable com.overzealous:remark:1.1.0 dependency with com.wavefront:remark:2023-07.07.

2. Fortify analysis workflow: Add a new GitHub Actions workflow at .github/workflows/fortify-analysis.yml that runs Fortify on Demand SAST and Debricked SCA scans. This workflow calls a reusable workflow from fortify/.github repository.

Changes needed:

• Add buildscript block at the very top of build.gradle (before the plugins block):

buildscript {
    configurations.all {
        resolutionStrategy.dependencySubstitution {
            substitute module("com.overzealous:remark:1.1.0") using module("com.wavefront:remark:2023-07.07") because "not available on maven central anymore"
        }
    }
}

• Create .github/workflows/fortify-analysis.yml with:

name: Fortify Analysis

on:
  workflow_dispatch:
  push:
  pull_request:
  schedule:
    - cron: '16 0 * * 5'

jobs:
  fortify:
    uses: fortify/.github/.github/workflows/fortify-analysis.yml@main
    secrets: inherit

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.