Add parser tests, fuzzing, request-gate tests and CodeQL

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  # No pip ecosystem entry by design: Strata is standard-library-only in
+  # the engine and in the tests (see CONTRIBUTING.md), so there is no
+  # requirements.txt / pyproject.toml to keep current. Only the CI
+  # tooling itself -- the GitHub Actions used in the workflows -- has
+  # versions worth Dependabot's attention.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly as well as on push: CodeQL's query packs are updated
+    # independently of this repo, so new checks reach unchanged code.
+    - cron: '17 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # engine/ parses untrusted forensic input (images, filesystems,
+        # registry hives, archives, ...) byte by byte, and web/ is the
+        # local HTTP UI that talks to it -- both are exactly the kind of
+        # code CodeQL is worth running against. No compiled languages
+        # here, so build-mode is always "none".
+        include:
+          - { language: python, build-mode: none }
+          - { language: javascript-typescript, build-mode: none }
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+          paths-ignore: |
+            docs/**
+            **/*.md
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'

.github/workflows/fuzz.yml

@@ -0,0 +1,60 @@
+name: Fuzz
+
+# Mutation fuzzing of the evidence parsers (tests/fuzz.py).  Kept out of the
+# main CI workflow on purpose: it runs against a time budget rather than to
+# completion, and a finding is something to triage, not a reason to block an
+# unrelated PR.  Findings are uploaded as an artifact with their inputs, and
+# each can be replayed locally with `python3 tests/fuzz.py --replay <file>`.
+
+on:
+  pull_request:
+    paths:
+      - 'engine/**'
+      - 'tests/fuzz.py'
+      - 'tests/imagebuild_*.py'
+  schedule:
+    - cron: '41 4 * * 2'
+  workflow_dispatch:
+    inputs:
+      minutes:
+        description: 'Time budget in minutes'
+        default: '20'
+      target:
+        description: 'Target (all, fat16, ntfs, ext4, hive, ewf, ...)'
+        default: 'all'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: fuzz-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fuzz:
+    name: Fuzz parsers
+    runs-on: ubuntu-latest
+    # A PR gets a short pass over whatever it touched; the weekly run and a
+    # manual dispatch get long enough to find the less shallow problems.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
+    timeout-minutes: 75
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+      - name: Run the fuzzer
+        env:
+          MINUTES: ${{ github.event_name == 'pull_request' && '3' || github.event.inputs.minutes || '45' }}
+          TARGET: ${{ github.event.inputs.target || 'all' }}
+        run: |
+          python tests/fuzz.py --minutes "$MINUTES" --target "$TARGET" \
+            --seed "${{ github.run_id }}" --out fuzz-findings
+      - name: Upload findings
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: fuzz-findings
+          path: fuzz-findings/
+          if-no-files-found: ignore
+          retention-days: 30

.gitignore

@@ -25,6 +25,7 @@
 /exports/
 /reports/
 *-report.html
+/fuzz-findings/
 
 # Python
 __pycache__/