test(fuzz): add honest runtime harnesses

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,4 @@
+FROM gcr.io/oss-fuzz-base/base-builder:v1
+COPY . $SRC/ci-workflows
+WORKDIR $SRC/ci-workflows
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,5 @@
+#!/bin/bash -eu
+
+"$CXX" $CXXFLAGS -std=c++17 \
+  "$SRC/ci-workflows/tests/fixtures/fuzzing/checksum_fuzzer.cpp" \
+  -o "$OUT/checksum_fuzzer" $LIB_FUZZING_ENGINE

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: c++

.github/workflows/runtime-fixtures-fuzzing.yml

@@ -0,0 +1,78 @@
+name: runtime-fixtures-fuzzing
+
+on:
+  pull_request:
+    paths:
+      - '.clusterfuzzlite/**'
+      - 'tests/fixtures/fuzzing/**'
+      - 'tests/fixtures/rust/fuzz/**'
+      - '.github/workflows/fuzzing.yml'
+      - '.github/workflows/clusterfuzzlite.yml'
+      - '.github/workflows/runtime-fixtures-fuzzing.yml'
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  cargo-fuzz:
+    permissions:
+      contents: read # cargo-fuzz compiles the checked-out fixture tree
+    uses: ./.github/workflows/fuzzing.yml
+    with:
+      runner: ubuntu-latest
+      working_directory: tests/fixtures/rust
+      rust_toolchain: nightly
+      install_command: cargo install cargo-fuzz --locked
+      fuzz_command: cargo fuzz run checksum -- -runs=1000
+      timeout_minutes: 20
+
+  clusterfuzzlite:
+    permissions:
+      actions: read # ClusterFuzzLite discovers prior corpus/build runs
+      contents: read # build the checked-out C++ harness
+      security-events: write # upload the real SARIF result requested below
+    uses: ./.github/workflows/clusterfuzzlite.yml
+    with:
+      runner: ubuntu-latest
+      mode: code-change
+      language: c++
+      sanitizer_matrix: '["address"]'
+      fuzz_seconds: 60
+      output_sarif: true
+      timeout_minutes: 25
+
+  evidence:
+    name: fuzz runtime evidence
+    if: ${{ always() }}
+    needs: [cargo-fuzz, clusterfuzzlite]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Require both real callers
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          set -euo pipefail
+          python3 -I <<'PY'
+          import json
+          import os
+          import sys
+
+          results = json.loads(os.environ["RESULTS"])
+          expected = {"cargo-fuzz", "clusterfuzzlite"}
+          if set(results) != expected:
+              raise SystemExit(f"unexpected callers: {sorted(results)}")
+          failed = {
+              name: payload.get("result")
+              for name, payload in results.items()
+              if payload.get("result") != "success"
+          }
+          if failed:
+              raise SystemExit(f"fuzz runtime evidence rejected: {failed}")
+          print("fuzz runtime evidence accepted: cargo-fuzz + ClusterFuzzLite")
+          PY

.gitignore

@@ -16,6 +16,8 @@ __pycache__/
 /.serena/
 # Serena MCP local project config (developer tooling, not part of the published catalog)
 tests/fixtures/rust/target/
+tests/fixtures/rust/fuzz/artifacts/
+tests/fixtures/rust/fuzz/corpus/
 tests/fixtures/terraform/.terraform/
 tests/fixtures/terraform/.terraform.lock.hcl
 .venv/

docs/generated/workflow-inventory.md

@@ -51,6 +51,7 @@
 | `.github/workflows/release-supply-chain.yml` | `artifact-attestations`, `sbom-generation`, `slsa-build-provenance`, `release-supply-chain` | ga |
 | `.github/workflows/release.yml` | internal | internal |
 | `.github/workflows/runtime-fixtures-event-write.yml` | internal | internal |
+| `.github/workflows/runtime-fixtures-fuzzing.yml` | internal | internal |
 | `.github/workflows/runtime-fixtures-languages.yml` | internal | internal |
 | `.github/workflows/runtime-fixtures.yml` | internal | internal |
 | `.github/workflows/rust-ci.yml` | `rust-ci` | ga |

scripts/_workflow_yaml.py

@@ -28,6 +28,7 @@
     "runtime-fixtures.yml",
     "runtime-fixtures-languages.yml",
     "runtime-fixtures-event-write.yml",
+    "runtime-fixtures-fuzzing.yml",
     "scorecard.yml",
 }
 

tests/fixtures/fuzzing/checksum_fuzzer.cpp

@@ -0,0 +1,13 @@
+#include <cstddef>
+#include <cstdint>
+
+extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t* data,
+                                      std::size_t size) {
+  std::uint8_t checksum = 0;
+  for (std::size_t index = 0; index < size; ++index) {
+    checksum = static_cast<std::uint8_t>(checksum + data[index]);
+  }
+  volatile std::uint8_t observed = checksum;
+  (void)observed;
+  return 0;
+}

tests/fixtures/rust/fuzz/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "ciwf-fixture-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+ciwf-fixture = { path = ".." }
+
+[[bin]]
+name = "checksum"
+path = "fuzz_targets/checksum.rs"
+test = false
+doc = false
+bench = false

tests/fixtures/rust/fuzz/fuzz_targets/checksum.rs

@@ -0,0 +1,9 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    if let Ok(text) = std::str::from_utf8(data) {
+        let _ = ciwf_fixture::checksum(text);
+    }
+});