feat(integrations): add Oracle Fusion Cloud HCM

[BillLeoutsakosvl346]

Summary

Adds a strictly read-only Oracle Fusion Cloud HCM integration using Oracle's versioned 11.13.18.05 REST resources and Basic authentication over TLS.

The block exposes 18 actions:

• Workers: list/get workers
• Assignments and reporting: list/get assignments, managers, and direct reports
• Absence management: list/get absences and list absence types
• Workforce structures: jobs, job families, departments, locations, positions, business units, legal employers, grades, and person types

It also adds four server-side selectors for workers, assignments, absences, and absence types, plus eight templates and seven grounded integration skills.

Security and data handling

• Accepts only canonical https://<environment>.fa.<region>.oraclecloud.com / .fa.ocs.oraclecloud.com origins
• Rejects custom ports, userinfo, paths, vanity domains, IP literals, and private/reserved DNS destinations
• Uses DNS validation and pinned-IP secure fetch with redirects disabled
• Keeps tenant URL, username, and masked password user-only and server-side
• Caps list pages at 100 records, search at 200 characters, responses at 10 MiB, and requests at 30 seconds
• Retries only idempotent GETs for 429/503/504, at most twice
• Preserves Oracle int64 IDs as exact strings and validates selector/tool IDs as positive signed-int64 decimal strings
• Requests fixed provider-owned field lists and projects explicit output allowlists
• Excludes photos, street addresses, phones, comments, absence reasons, medical/maternity data, attachments, entitlements, payroll details, budgets, costs, flexfields, and raw HR bodies

No mutation tools, triggers, OAuth configuration, API routes, dependencies, lockfile changes, database changes, or new icon artwork are included. The block reuses the existing red Oracle oval (NetSuiteIcon).

Oracle references

• REST API index
• Quick Start and authentication
• Authorization and data roles
• Collection querying
• Collection pagination
• Public worker assignments
• Absences

Verification

• Focused internal client/validation/operation/dispatch and selector tests: 69 passing
• TypeScript typecheck
• Tool metadata, integration catalog, deployment config, docs, and docs manifest freshness checks
• Fork-dependent coverage, client-boundary, and tool-request-boundary checks
• Canvas sentences: 18/18 operations
• Bare-icon check
• Repository lint and format checks
• Memory-load review: one page, at most 100 rows, 10 MiB response ceiling, sequential request flow, three total transport attempts

A fresh independent reviewer ran .agents/skills/validate-integration/SKILL.md, reopened current Oracle documentation, checked repository precedents, and completed a fix/revalidation loop. Final result: no unresolved Critical, Warning, or Suggestion findings.

The generated integration MDX retains the shared generator's existing trailing-space/EOF convention (also present in existing integration pages). docs:check is green; this is not integration-specific.

V1 limitations

• Basic authentication only; OAuth/JWT/SAML are deferred
• Single-page reads only; callers explicitly continue with offset/limit
• No live tenant was available, so provider transport/schema behavior is covered with mocks and fixtures grounded in Oracle documentation
• Oracle tenant roles and data-security profiles remain administrator-managed

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 2, 2026 10:45pm UTC

[greptile-apps]

Greptile Summary

Adds a read-only Oracle Fusion Cloud HCM integration with guarded server-side transport, explicit output projection, selectors, documentation, and generated tool metadata.

• Exposes 18 operations covering workers, assignments, reporting relationships, absences, and workforce structures.
• Restricts Oracle requests through canonical tenant validation, DNS checks, pinned-IP fetching, bounded responses, timeouts, and limited retries.
• Adds workflow block configuration, four selectors, API contracts, integration registration, documentation, and deployment metadata.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/internal/oracle-fusion-hcm/client.ts	Implements tenant validation, guarded transport, retries, response limits, and exact-token JSON parsing; the previously reported precision concern was withdrawn.
apps/sim/lib/internal/oracle-fusion-hcm/operations.ts	Defines bounded read-only Oracle resource operations and projects responses through explicit output schemas.
apps/sim/lib/internal/oracle-fusion-hcm/validation.test.ts	Covers tenant, identifier, paging, search, and date validation boundaries.
apps/sim/blocks/blocks/oracle_fusion_hcm.ts	Registers the 18 Oracle HCM actions and their operation-specific workflow inputs and outputs.
apps/sim/lib/selectors/server/providers/oracle-fusion-hcm.ts	Provides server-side worker, assignment, absence, and absence-type selection.
apps/sim/tools/oracle_fusion_hcm/definitions.ts	Declares Oracle tool parameters and credential handling; no follow-up-eligible finding was accepted.

Sequence Diagram

sequenceDiagram
  participant User as Workflow user
  participant Block as Oracle HCM block
  participant Tool as Server-side tool dispatcher
  participant Client as Guarded Oracle client
  participant Oracle as Oracle Fusion HCM
  User->>Block: Configure read operation and credentials
  Block->>Tool: Execute validated tool input
  Tool->>Client: Dispatch read-only operation
  Client->>Client: Validate tenant and resolve DNS
  Client->>Oracle: Pinned-IP HTTPS GET with Basic auth
  Oracle-->>Client: Bounded JSON response
  Client->>Client: Preserve IDs and project allowlisted fields
  Client-->>Tool: Sanitized operation result
  Tool-->>Block: Structured output

Loading

_{Reviews (5): Last reviewed commit: "refactor(integrations): align Oracle HCM..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 31 files

_{Re-trigger cubic}

[BillLeoutsakosvl346]

@greptile-apps @cubic-dev-ai please re-review the latest commit (20724c1), including the fixes and dispositions on the prior review threads.

[cubic-dev-ai]

@greptile-apps @cubic-dev-ai please re-review the latest commit (20724c1), including the fixes and dispositions on the prior review threads.

@BillLeoutsakosvl346 Incremental reviews are turned off for this repository. Comment @cubic review to run a full review.

[cubic-dev-ai]

All reported issues were addressed across 44 files

_{Fix all with cubic | Re-trigger cubic}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 45 files

_{Fix all with cubic | Re-trigger cubic}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 45 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[BillLeoutsakosvl346]

@greptile

[BillLeoutsakosvl346]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@BillLeoutsakosvl346 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 33 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}