test(graph-rs): add the fuzz package manifest by vitali87 · Pull Request #3445 · vitali87/code-graph-rag

vitali87 · 2026-10-24T23:15:37Z

Summary

Cargo.toml and Cargo.lock for rust/cgr_graph_rs/fuzz, naming the four targets. The package is a workspace of its own, so the crate's build and tests never compile it.
With this, cargo +nightly fuzz run <target> works from rust/cgr_graph_rs. Debug assertions belong on (--debug-assertions), as OSS-Fuzz builds Rust targets, so an integer overflow is a crash.
The lock pins the crate's own versions of rusqlite and cc.

Demo

No user-visible change: fuzz targets only. Nothing in the package, CI or the wheel builds rust/cgr_graph_rs/fuzz.

Type of Change

CI/CD or tooling

Related Issues

None.

Test plan

Run on the whole stack, since the package builds once its manifest lands in the last PR:

Red: each property in these targets goes red under a one-line change to the library. The property's comment names the change and the input that aborts; each was run against the mutated library, and the property it documents is the one that fired.
Green: the unmutated library runs each target with no abort, for 10 minutes from the seed corpus after the shorter runs that built it.
Negative tests: every check here is a negative test by construction. It aborts on output the library must not produce, and its mutant shows the abort happens.
Coverage: a minimized seed corpus runs every API call and every property check in each target (cargo fuzz coverage).
cargo +nightly-2025-07-16 check --bins passes, as well as the current nightly.

Files changed

rust/cgr_graph_rs/fuzz/Cargo.toml
rust/cgr_graph_rs/fuzz/Cargo.lock

Diff stats

+243 additions, -0 deletions (243 LOC)

Dependencies

This PR depends on: pr-3

Dependency graph

Merge in this order:

pr-1: test(graph-rs): add the fuzz input decoder and the Cypher and JSON fuzz targets
└── pr-2: test(graph-rs): add the graph procedures fuzz target
    └── pr-3: test(graph-rs): add the bulk writer and walk fuzz target
        └── pr-4: test(graph-rs): add the fuzz package manifest  <-- this PR

Summary by CodeRabbit

Tests
- Added fuzz-testing coverage for query parsing, JSON strings, graph algorithms, and SQLite-backed graph operations.
- Expanded automated fuzz testing to include the Rust extension alongside existing Python coverage, helping detect unexpected behavior across a wider range of inputs.
Documentation
- Added guidance for running the Rust fuzz checks locally.
User Impact
- No user-facing features or behavior changes are included in this update.

greptile-apps · 2026-10-24T23:15:42Z

TREX

Tested 1 flow, found no issues.

What we tested

Pass · Run named Rust fuzz targets locally · View ↗

coderabbitai · 2026-10-24T23:15:44Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Last reviewed commit: 005298e

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: vitali87/code-graph-rag
Branch: pr-split/claude-cgr-graph-rs-fuzz/pr-4
File: .coderabbit.yaml
Commit: 005298e
Layers: Repository YAML
Review profile: QUIET
Plan: Advanced
Run ID: e6d774cf-a0b5-4253-92db-8fb5783193fc

Commits

Reviewing files that changed from the base of the PR and between 9856a4e and 005298e.

Files selected for processing: 7

.clusterfuzzlite/Dockerfile
.clusterfuzzlite/build.sh
.github/SECURITY.md
.github/workflows/cflite_batch.yml
.github/workflows/cflite_pr.yml
AGENTS.md
CONTRIBUTING.md

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

This change adds four Rust cargo-fuzz targets and configures ClusterFuzzLite to build and run Rust targets alongside the existing Python harnesses. It also updates fuzzing policy, contributor guidance, and toolchain instructions.

Changes: Rust fuzzing integration

Layer / File(s)	Summary
Fuzz package and targets `rust/cgr_graph_rs/fuzz/Cargo.toml`	The manifest defines a standalone package, its dependencies, release debug information, and four fuzz-target binaries.
Rust fuzz build and smoke tests `.clusterfuzzlite/Dockerfile`, `.clusterfuzzlite/build.sh`	The Docker image installs the Rust fuzz toolchain and `cargo-fuzz`. The build script compiles each Rust target, copies its binary, and smoke-tests it.
ClusterFuzzLite workflows and documentation `.github/workflows/cflite_batch.yml`, `.github/workflows/cflite_pr.yml`, `.github/SECURITY.md`, `AGENTS.md`, `CONTRIBUTING.md`	The workflows add Rust to their language selection and pass the selected language to build and run actions. The documentation describes the Rust targets, local usage, and toolchain instructions.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Sequence Diagram(s)

sequenceDiagram
  participant ClusterFuzzLite
  participant BuildScript
  participant CargoFuzz
  participant FuzzTarget
  ClusterFuzzLite->>BuildScript: Select Rust language
  BuildScript->>CargoFuzz: Build fuzz targets
  CargoFuzz-->>BuildScript: Target binaries
  BuildScript->>FuzzTarget: Run smoke test
  FuzzTarget-->>BuildScript: Exit status and output

Possibly related PRs

vitali87/code-graph-rag#3442: Adds fuzz-target implementations that this package manifest declares.
vitali87/code-graph-rag#3444: Adds the sqlite_graph target declared by this package manifest.
vitali87/code-graph-rag#3443: Adds the graph_algorithms target declared by this package manifest.

Suggested reviewers: claude

Merge Risk: Minimal · up to 00529

The change enables Rust fuzzing alongside the existing Python jobs. No merge-blocking issue was identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly identifies the primary change: adding the Rust graph fuzz package manifest. It follows the repository's Conventional Commits format.
Description check		The description includes the required summary, demo, change type, related issues, and test plan sections. It explains the tooling-only scope and reported validation. The checklist section is missing, …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required summary, demo, change type, related issues, and test plan sections. It explains the tooling-only scope and reported validation. The checklist section is missing, but the description is otherwise sufficiently complete.

Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-24T23:15:49Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T23:17:13.653593Z	`e18ca08`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

greptile-apps · 2026-10-24T23:17:41Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking issue was found.

Summary

Adds a separate Cargo package for four Rust fuzz targets and runs them through ClusterFuzzLite.

Contributors can run four Rust fuzz targets by name.
ClusterFuzzLite runs Rust fuzz targets beside Python fuzzers.

No new issue met the reporting bar. No previous review threads were supplied. The previous-review ancestry checks did not pass, so this review covered the full PR diff.

_{Reviews (2) · Last reviewed commit: "Merge pull request #3494 from vitali87/c..." · Reviewed by Greptile}

vitali87 · 2026-10-27T19:00:13Z

CodeQL Analyze (python) failed on 3a146c8 for a reason outside this PR (fixed by re-run)

The analysis itself finished. The job then failed while uploading its SARIF results, because GitHub returned API rate limit exceeded for installation (request ID 3C00:1E1E94:22CAC9:2547CE:6AE0F482, 18:59:14 UTC). The repo's Actions queue was working through a backlog of about 85 runs, and that backlog used up the token's hourly API quota. This PR only touches rust/cgr_graph_rs/fuzz/, which the Python analysis doesn't cover. No code fix applies.

Update: once the backlog cleared, I re-ran the failed job once at 20:02 UTC and it passed (attempt 2).

Generated by Claude Code

…zLite

…ew dependencies

…-fuzz-cflite

…ew dependencies

…-fuzz-cflite # Conflicts: # rust/cgr_graph_rs/fuzz/Cargo.lock

ci(fuzz): build and run the graph-rs cargo-fuzz targets in ClusterFuzzLite

sonarqubecloud · 2026-10-28T18:10:26Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

vitali87 · 2026-10-28T19:52:01Z

@greptile review

Generated by Claude Code

github-project-automation Bot added this to @vitali87's graph code Oct 24, 2026

vitali87 added this pull request to stack #3446 October 24, 2026 23:15

This was referenced Oct 24, 2026

test(graph-rs): add the fuzz input decoder and the Cypher and JSON fuzz targets #3442

Merged

test(graph-rs): add the bulk writer and walk fuzz target #3444

Merged

vitali87 force-pushed the pr-split/claude-cgr-graph-rs-fuzz/pr-4 branch from 9c35560 to 3a146c8 Compare October 27, 2026 16:54

test(graph-rs): add the fuzz package manifest

68c854d

vitali87 force-pushed the pr-split/claude-cgr-graph-rs-fuzz/pr-4 branch from 3a146c8 to 68c854d Compare October 28, 2026 05:59

ci(fuzz): build and run the graph-rs cargo-fuzz targets in ClusterFuz…

90743ad

…zLite

vitali87 mentioned this pull request Oct 28, 2026

ci(fuzz): build and run the graph-rs cargo-fuzz targets in ClusterFuzzLite #3494

Merged

7 of 17 tasks

claude added 2 commits October 28, 2026 08:06

test(graph-rs): lock the fuzz package to cgr_graph_rs 0.1.2 and its n…

c0dfe9c

…ew dependencies

Merge pr-split/claude-cgr-graph-rs-fuzz/pr-4 into ccr-848af959-z1irhb…

4fdf6ae

…-fuzz-cflite

Base automatically changed from pr-split/claude-cgr-graph-rs-fuzz/pr-3 to main October 28, 2026 15:29

vitali87 and others added 2 commits October 28, 2026 19:29

test(graph-rs): add the fuzz package manifest

b081ebd

test(graph-rs): lock the fuzz package to cgr_graph_rs 0.1.2 and its n…

86a3418

…ew dependencies

vitali87 force-pushed the pr-split/claude-cgr-graph-rs-fuzz/pr-4 branch from c0dfe9c to 86a3418 Compare October 28, 2026 15:29

vitali87 added 3 commits October 28, 2026 15:34

test(graph-rs): lock the fuzz package to cgr_graph_rs 0.1.3

9856a4e

Merge pr-split/claude-cgr-graph-rs-fuzz/pr-4 into ccr-848af959-z1irhb…

c920c76

…-fuzz-cflite # Conflicts: # rust/cgr_graph_rs/fuzz/Cargo.lock

Merge pull request #3494 from vitali87/ccr-848af959-z1irhb-fuzz-cflite

005298e

ci(fuzz): build and run the graph-rs cargo-fuzz targets in ClusterFuzzLite

vitali87 merged commit 3dd3d62 into main Oct 29, 2026
63 of 64 checks passed

vitali87 deleted the pr-split/claude-cgr-graph-rs-fuzz/pr-4 branch October 29, 2026 18:31

github-project-automation Bot moved this to Done in @vitali87's graph code Oct 29, 2026

Navigation Menu

Repository navigation

test(graph-rs): add the fuzz package manifest - #3445

test(graph-rs): add the fuzz package manifest#3445
vitali87 merged 9 commits into
mainfrom
pr-split/claude-cgr-graph-rs-fuzz/pr-4

vitali87 commented Oct 24, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

greptile-apps Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Reviews paused

Sequence Diagram(s)

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

vitali87 commented Oct 27, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Oct 28, 2026

Uh oh!

vitali87 commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

vitali87 commented Oct 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Demo

Type of Change

Related Issues

Test plan

Files changed

Diff stats

Dependencies

Dependency graph

Summary by CodeRabbit

Uh oh!

greptile-apps Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TREX

What we tested

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Sequence Diagram(s)

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

greptile-apps Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

vitali87 commented Oct 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Oct 28, 2026

Quality Gate passed

Uh oh!

vitali87 commented Oct 28, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vitali87 commented Oct 24, 2026 •

edited by coderabbitai Bot

Loading

greptile-apps Bot commented Oct 24, 2026 •

edited

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

greptile-apps Bot commented Oct 24, 2026 •

edited

Loading

vitali87 commented Oct 27, 2026 •

edited

Loading