Sanchaga/bottestzscaler46

[sanchaga-splunk]

Features

List any features you're adding to this app (e.g. new actions, parameters, auth methods, etc.)

• THIS IS A BOT TEST

Bug Fixes

Describe any bugs you've fixed in this app, and how they were fixed

Manual Documentation

Have you made any changes that should be documented in manual_readme_content.md?

The following changes require documentation in manual_readme_content.md:

• New, updated, or removed REST handlers
• New, updated, or removed authentication methods, especially complex methods like OAuth
• Compatibility considerations with respect to deployment types (e.g. actions that cannot be run on cloud or an automation broker)

• I have verified that manual documentation has been updated where appropriate

Other information

---

Please refer to our Contribution Guide for any questions on submitting a pull request.

Thanks for contributing!

[github-actions]

Merging this PR will release 3.0.5 with the following release notes:

3.0.5 (2026-08-04)

Connector release changes

• Block and lookup actions now account for ZIA allowlist entries that override the advanced-threat denylist.
• Group membership updates now fetch the user immediately before writing and compare existing memberships by group ID.
• URL list actions now convert internationalized hostnames to IDNA2008 A-labels before sending them to ZIA.
• URL category actions now use incremental list updates that preserve concurrent entries and existing keyword configuration.
• The get departments action now encodes its search and pagination query parameters through the HTTP client.
• Authentication now returns a controlled error when the ZIA response omits its required session cookie.
• Unblock and unallow actions now remove only shared-list entries recorded as added by the current connector asset.
• Unexpected scalar JSON and malformed rate-limit response bodies now return controlled action errors.
• Unparseable Retry-After values now preserve the original rate-limit failure instead of being treated as success.
• URL category updates and user listing now inherit the connector's finite request timeout.

[soar-connectors-pr-review-bot]

Issue: pre-commit pipeline job failed pre-commit concluded failure. Failed step(s): Pre-commit. Log excerpt: 2026-08-04T19:16:09.1474127Z [INFO] Initializing environment for https://github.com/pre-commit/pre-commit-hooks. / 2026-08-04T19:16:09.6462018Z [INFO] Initializing environment for https://github.com/astral-sh/ruff-pre-commit. / 2026-08-04T19:16:11.4801993Z [INFO] Initializing environment for https://github.com/hukkin/mdformat. / 2026-08-04T19:16:12.1132660Z [INFO] Initializing environment for https://github.com/returntocorp/semgrep.

Pipeline: failed job

Code reference: GitHub Actions job pre-commit``

Impact: This review job runs after the connector pipeline, so a failed required pipeline job blocks a clean merge signal even if the code review also finds issues.

How to fix: Apply the reported ruff lint or formatting fix at the named file/line, then rerun pre-commit.

[soar-connectors-pr-review-bot]

Issue: New skipped_foreign summary field emitted by list-mutation actions is not declared in zscaler.json The diff adds _filter_owned_removals which returns a skipped_foreign count that is then passed into the action summary for allow_ip, allow_url, block_ip, block_url, unallow_ip, unallow_url, unblock_ip, and unblock_url. The sdk_review_inventory confirms those actions only declare action_result.summary.ignored and action_result.summary.updated as output paths in zscaler.json. skipped_foreign is absent from all eight action output sections.

Code reference: _filter_owned_removals / _amend_allowlist / _amend_denylist

Current line: filtered_endpoints, skipped_foreign = self._filter_owned_removals(action_result, "blocklist", filtered_endpoints, action)

Changed behavior: + summary["skipped_foreign"] = foreign (new summary key set via _filter_owned_removals result)

Failure scenario: trigger: Any REMOVE_FROM_LIST call where at least one entry was added by a different asset; path: allow_ip/block_ip/unallow_ip/unblock_ip/allow_url/block_url/unallow_url/unblock_url → _amend_allowlist/_amend_denylist → _filter_owned_removals → set_summary({'skipped_foreign': N}); failure: SOAR result view and playbook editor do not expose action_result.summary.skipped_foreign; downstream playbooks cannot reference it by name in conditions or downstream actions.

Impact: Undeclared summary fields are invisible to the SOAR playbook editor schema and cannot be used in playbook conditions; operators will not know the field exists.

How to fix: Add { "data_path": "action_result.summary.skipped_foreign", "data_type": "numeric", "example_values": [0] } to the output sections of the allow ip, allow url, block ip, block url, unallow ip, unallow url, unblock ip, and unblock url actions in zscaler.json.