Skip to content

test: add fuzzing for parsers and the numeric kernel #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
seonghobae merged 4 commits into from
Jul 10, 2026
Merged

test: add fuzzing for parsers and the numeric kernel #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
506ef1b
test: add fuzzing for CSV/JSON/config parsers and numeric kernel
seonghobae Jul 8, 2026
46d31e6
ci: pin GitHub Actions by SHA and pin pip in fuzz job
seonghobae Jul 8, 2026
c5853fa
docs: link fuzzing survey instead of vendoring pdf
seonghobae Jul 9, 2026
14b5989
test: align report chart accessibility expectation
seonghobae Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 0 additions & 20 deletions .Jules/palette.md
View file
Open in desktop

This file was deleted.

34 changes: 34 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,43 @@
with:
python-version: "3.12"
- uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
# `cargo test --workspace` also runs the proptest fuzz harness in
# crates/mlsirm-core/tests/proptest_neg_loglik.rs.
- run: cargo test --workspace
- run: cargo test --manifest-path crates/fast-mlsirm-py/Cargo.toml

fuzz:
# Short, bounded coverage-guided fuzzing so PR cost stays low. The
# property-based Hypothesis tests already run in the `python` job (via the
# dev extra); this job adds the Atheris coverage-guided harnesses with a
# ~60s-per-target budget. Longer campaigns can be run nightly if desired.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
with:
python-version: "3.12"
# pip is version-pinned so the toolchain used to resolve the fuzz extras
# is reproducible (OpenSSF Scorecard pinned-dependencies hardening).
- run: python -m pip install --upgrade "pip==26.1.2"
# Editable install of the repo-under-test. pip does not support

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 8: pipCommand not pinned by hash
Click Remediation section below to solve this issue
Comment thread
seonghobae marked this conversation as resolved.
# --require-hashes for editable/local installs, so the fuzz extras
# (atheris plus test-only hypothesis) are resolved from the pinned pip
# above rather than a hash-locked requirements file.
- run: python -m pip install -e .[fuzz]
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
- name: Fuzz load_factor_csv (CSV parser)
Comment thread
seonghobae marked this conversation as resolved.
Dismissed
run: |
python fuzz/atheris/fuzz_load_factor_csv.py \
-max_total_time=60 -timeout=25 fuzz/corpus/load_factor_csv
- name: Fuzz render_diagnostics_report (JSON -> HTML)
run: |
python fuzz/atheris/fuzz_render_report.py \
-max_total_time=60 -timeout=25 fuzz/corpus/render_report
- name: Fuzz config validators
run: |
python fuzz/atheris/fuzz_config.py \
-max_total_time=60 -timeout=25 fuzz/corpus/config

package:
runs-on: ubuntu-latest
steps:
Expand Down
Loading
Loading