[vitali87]

Summary

• ClusterFuzzLite now builds and runs the four cargo-fuzz targets in rust/cgr_graph_rs/fuzz (cypher_parse, json_string, graph_algorithms, sqlite_graph). Each workflow (cflite_pr.yml and cflite_batch.yml) gets a language: [python, rust] matrix, and each language runs as its own job with the existing budgets. Until now no build or workflow touched these targets. This is the runner half of the Codex P1 thread on test(graph-rs): add the graph procedures fuzz target #3443; test(graph-rs): add the fuzz package manifest #3445 added the package manifest.
• Why a separate job. The bad-build check holds every target in $OUT to the job's language.
  • Under python, it checks the <target>.pkg that PyInstaller writes, which a native binary doesn't have. All four Rust targets fail that check: <target>.pkg ... cannot open, 4 of 4 broken.
  • Under rust, a Python wrapper script would fail instead, because its sanitizer runtime comes in through LD_PRELOAD.
  • The action has no input for a second .clusterfuzzlite directory. So both jobs build from one image, and build.sh builds only the job's language, branching on $FUZZING_LANGUAGE.
• Image changes.
  • The image gains the nightly and the cargo-fuzz release that base-builder-rust pins: nightly-2025-09-05 and 0.13.2. OSS-Fuzz's compile passes -Zsanitizer through RUSTFLAGS, which only a nightly accepts, and OSS-Fuzz pairs that nightly with this image's clang 22.
  • The stable toolchain also gets rust-src. A rust compile copies the default toolchain's std sources and stops if they are missing.
• Build flags. Targets build with cargo fuzz build -O --debug-assertions, with clang as the linker (as in base-builder-rust). The toolchain is selected through RUSTUP_TOOLCHAIN rather than +toolchain, so OSS-Fuzz's cargo wrapper still recognises fuzz build for a coverage build. Each target is smoke-tested with -runs=1, as the Python targets are.

Demo

No user-visible change: this only changes the fuzzing CI.

Type of Change

• Bug fix
• New feature
• Performance improvement
• Refactoring (no functional changes)
• Documentation
• CI/CD or tooling
• Dependencies

Related Issues

Follow-up to the Codex review thread on #3443. Stacked on #3445, so its base is pr-split/claude-cgr-graph-rs-fuzz/pr-4.

Test Plan

• Unit tests pass (make test-parallel or uv run pytest -n auto -m "not integration")
• New tests added
• Integration tests pass (make test-integration, requires Docker)
• Manual testing (described below)

The ClusterFuzzLite workflows only trigger for pull requests into main, so they won't run here until the stack retargets this PR. I reproduced their steps locally with Docker on 90743ad, using the OSS-Fuzz images:

• Image. I built .clusterfuzzlite/Dockerfile with one local-only extra layer that trusts this sandbox's TLS-intercepting proxy CA. That layer is not committed. The new layer installs the nightly and cargo-fuzz 0.13.2 and adds about 90 seconds to the image build.
• Rust job.
  • compile with FUZZING_LANGUAGE=rust SANITIZER=address: built all 4 targets (3m 45s) and passed all 4 smoke tests.
  • test_all.py, the bad-build check, in base-runner with FUZZING_LANGUAGE=rust: exit 0, 4 targets checked.
  • run_fuzzer for 15 to 20 seconds per target found no crashes:
    • cypher_parse: 294k runs
    • json_string: 292k runs
    • graph_algorithms: 57k runs
    • sqlite_graph: 5k runs
• Python job. compile with FUZZING_LANGUAGE=python froze and smoke-tested the 3 Python harnesses as before, and test_all.py with FUZZING_LANGUAGE=python exited 0. I ran this check on the previous stack tip. Nothing in the Python branch of build.sh or the image differs on this tip.
• Same targets under python. test_all.py with FUZZING_LANGUAGE=python over the Rust targets exits 1 with Broken fuzz targets 4. This is the failure the split job avoids.
• Repo checks.
  • test_build_tls_trust.py, test_rust_extension_packaging.py, test_fuzz_harnesses.py and test_dependabot_config.py: 163 passed.
  • actionlint on both workflows: clean.
  • shellcheck on build.sh: two info-level SC2086 notes on the unchanged Python lines, which split words on purpose.
  • bash -n: passed.
• Not verified. I haven't seen a real ClusterFuzzLite Actions run. The first one comes after the retarget to main. Check job names change to Fuzz (python, address) and Fuzz (rust, address); All Checks Pass doesn't depend on them.

Checklist

• PR title follows Conventional Commits format
• A breaking change has ! in the title and its release notes in changes/breaking/<PR number>.md (see Breaking changes)
• All pre-commit checks pass (make pre-commit)
• No hardcoded strings in non-config/non-constants files
• No # type: ignore, cast(), Any, or object type hints
• New comments and docstrings explain why, not what (see Comment Policy)

I didn't run the full make pre-commit locally. The hooks that apply to these files are YAML, whitespace and end-of-file. The YAML parses and there is no trailing whitespace.

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 2

• ^feat/.*
• ^fix/.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: vitali87/code-graph-rag
• Branch: ccr-848af959-z1irhb-fuzz-cflite
• File: .coderabbit.yaml
• Commit: c920c76
• Layers: Repository YAML
• Review profile: QUIET
• Plan: Advanced
• Run ID: e1d9189b-2fc1-4cf0-96a2-b98c02878ac7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-28T06:21:35.853923Z	90743ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no blocking defects were found.

Summary

Adds the four Rust cargo-fuzz targets to ClusterFuzzLite while keeping Python and Rust in separate jobs.

• ClusterFuzzLite runs the Rust graph fuzz targets alongside the Python harnesses.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[PR or daily workflow] --> B{Language matrix}
  B --> C[Python job]
  B --> D[Rust job]
  C --> E[Build and smoke-test Python harnesses]
  D --> F[Build and smoke-test cargo-fuzz targets]
  E --> G[Run Python fuzzers]
  F --> H[Run Rust fuzzers]

Loading

_{Reviews (1) · Last reviewed commit: "ci(fuzz): build and run the graph-rs car..." · Reviewed by Greptile}