Major expansion of supported integrations

[hdm]

Adds 62 integrations (44 → 106), and builds the test and documentation infrastructure needed to trust them. Along the way it fixes a set of defects that had shipped silently — several integrations in the existing catalog could never have worked.

What's new

62 integrations, bringing the catalog to 106 (101 inbound, 3 internal, 2 outbound).

Full list

absolute adguard-home aruba-clearpass asimily bigfix bitdefender-gravityzone bmc-discovery checkmk-raw cisco-secure-endpoint cybereason cyberwatch extrahop fleet-osquery foreman forescout-counteract forescout-eyeinspect frontline-vm glpi greenbone greenbone-scan home-assistant icinga2 illumio-core infoblox itop jumpcloud kenna lansweeper librenms mikrotik-routeros nautobot netdata netdisco nozomi-networks ntopng nutanix-prism ocs-inventory open-audit opennms-horizon openwrt opnsense palo-alto-device-security phpipam pihole portainer puppetdb quest-kace redhat-insights slurpit sophos-central synology-dsm tactical-rmm tp-link-omada trellix-epo trend-vision-one truenas ubiquiti-unifi-protect ubiquiti-unifi-site-manager unraid uptycs workspace-one-uem zabbix

Test infrastructure

There was no test gate before this PR — the only CI job regenerated the catalog. Three harnesses now exist:

Harness	Scale	What it proves
tests/run.py	404 scenarios, all passing	Declarative fixtures drive the real scanner against a local server; assertions run against the serialized scan.runzero.gz
tests/run_containers.py	17 stacks, all passing	The vendor's actual software in Docker — a renamed field or changed envelope fails here instead of in production
tests/run_live.py	opt-in	Real endpoints, credentials from a gitignored .env, with per-integration match rules

The 17 containerized integrations are marked beta; the rest are alpha.

Authentication and pagination, each confirmed against the vendor's own documentation:

• carbon-black could not authenticate against a real tenant. X-Auth-Token must be <API Secret Key>/<API ID>, and the Org Key belongs only in the URL path — it was being used as the header's second component, and no API-ID parameter was declared at all. Adding one is a breaking config change, called out at the top of that README.
• ivanti_neurons sent the raw token response body as a Bearer credential instead of the access_token field inside it, and had three further aborts (None - 1 on an absent @odata.count, direct data['value'] access, no guard on a missing @odata.nextLink). Its paging bound was also len < count - 1, which silently dropped the final page of every walk.
• bitsight re-fetched page one indefinitely. Both loops passed params= while following the links.next cursor, and the HTTP helper replaces the query string rather than merging it. frontline-vm had already hit and documented this exact trap. Reverting the fix now trips the unique_ids invariant, which makes the duplicate fetch visible rather than merely changing a count.

Run-aborting bugs — Starlark has no exception handling, so the following errors interrupted main before they were addressed:

• parse_time() on an unparseable value aborts the script. Checking the return value does not help; it never returns. Values are now shape-checked with a regex first. runzero-task-sync had the same class of bug via gzip_decompress on a pre-gzip task, which silently stopped every subsequent task from ever syncing.
• networkInterfaces=[None] aborted the run in 13 integrations plus boilerplate.
• drata concatenated a string with the type builtin, so the first device carrying a compliance-check type Drata added later took down the entire import.

Documentation

Every integration README now carries ## Asset identity and ## Future — 106 of 107 (boilerplate is a template and correctly has neither).

## Asset identity is a decision record derived from the code, not aspiration: what the foreign ID is built from, whether it is stable and tenant-unique, and why the matchBehavior follows. Where the code and the governing rule disagree, the README says so rather than papering over it. Notable honest findings: ubiquiti-unifi-network uses a MAC as its foreign ID while discarding UniFi's stable per-site id; wazuh composes a recycled ordinal with a cluster-node-derived prefix that flips on rebalance; ghost keys on repository name while fetching and discarding repo_id; cyberint's domain.replace(".","-") is non-injective, so foo.example.com and foo-example.com merge.

Conventions established

• maturity — alpha / beta / stable, surfaced in docs/integrations.json.
• version — sequential integer, replacing the date-like YYMMDD00 that read confusingly next to minVersion.
• URL override — every integration accepts a base-URL parameter; SaaS endpoints keep their vendor default.
• deviceType — set only where the source carries genuine form-factor signal, using runZero's canonical vocabulary. 24 integrations were deliberately left unset because their API has no such field; an invented type is worse than none, since it overrides fingerprinting with a guess.
• Secrets — every credential parameter is "type": "secret".

Verification

python3 tests/run.py                    # 404 scenarios
python3 tests/run_containers.py         # 17 container stacks
python3 scripts/generate_integration_json.py   # idempotent; run twice, second is a no-op

Plus the platform-side compat gate, which parses every CONFIG, compiles against the engine builtins and asserts a top-level main:

RZ_CUSTOM_INTEGRATION_SCRIPTS_DIR=<this repo> go test ./runzero -run TestCompat_AllShippedIntegrationsLoad

All four are green as of this description.