0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 02:54:26 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 5.5 a598b67d75 feat(fuzz): fuzz the bootstrap YAML reader against PyYAML weekly

OpenSSF Scorecard reports no fuzzer integration (code scanning alert
507, issue #853). tests/fuzz/_yaml_bootstrap.py is an atheris harness
that feeds arbitrary input to utils.yaml_bootstrap.load_block and fails
whenever the reader accepts a document that load_yaml_str parses
differently or rejects. That is the contract the module's docstring
states, and the existing property test only samples it. The leading
underscore keeps unittest discovery from importing it, because atheris
is only installed with the fuzz extra.

cron-security-fuzz.yml runs the harness for 15 minutes every Sunday and
on demand, on ubuntu-latest, and uploads crashing inputs as the
fuzz-crashes artifact. atheris 3.1.0 ships x86_64 manylinux wheels for
CPython 3.12 to 3.14 only, so it lives in its own `fuzz` extra and
stays out of every other install path. tests/fuzz/ is not part of
`make test`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-17 18:46:26 +02:00

1.0 KiB

Raw Permalink Blame History

Tests 🧪

All automated tests for Infinito.Nexus live here.

Directory	Type	Guide
`unit/`	Unit tests (isolated, no I/O)	unit.md
`integration/`	Integration tests (real component boundaries)	integration.md
`external/`	Opt-in live third-party checks, excluded from `make test`	external.md
`e2e/`	End-to-end Playwright tests	playwright.md
`regression/`	Regression guard rules	regression.md
`lint/`	Structural lint checks	lint.md
`fuzz/`	Coverage-guided atheris harnesses, run weekly in CI, excluded from `make test`	workflows.md

Run each suite via the make targets documented in the linked guides.

1.0 KiB Raw Permalink Blame History

Tests 🧪

1.0 KiB

Raw Permalink Blame History