Wave-32 C07: sustained fuzz cadence soft job - #266
Conversation
Add fuzz-cadence SSOT, soft nightly 120s campaigns with crash artifact triage, and SelfCheck without slowing PR fuzz-smoke. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a scheduled and manually dispatched soft fuzzing workflow, documents fuzz cadence and crash triage, introduces a PowerShell SelfCheck for configuration anchors, and runs that SelfCheck from a Rust test. ChangesFuzz cadence
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant SelfCheck
participant FuzzTargets
GitHubActions->>SelfCheck: Run -SelfCheck for pull_request
SelfCheck->>SelfCheck: Validate docs and workflow anchors
GitHubActions->>FuzzTargets: Run both targets for 120 seconds on scheduled or manual runs
FuzzTargets-->>GitHubActions: Upload crash artifacts on failure
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fuzz-cadence.yml:
- Line 30: Disable credential persistence for both checkout steps in jobs
fuzz-selfcheck and fuzz-sustained by adding with.persist-credentials: false to
the checkout actions at .github/workflows/fuzz-cadence.yml lines 30-30 and
48-48.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9e3fb455-e97d-44f8-9c83-45768a4476cd
📒 Files selected for processing (6)
.github/workflows/fuzz-cadence.ymlCONTRIBUTING.mddocs/ops/fuzz-cadence.mddocs/ops/test-pyramid.mdscripts/fuzz-cadence-check.ps1tests/fuzz_cadence.rs
📜 Review details
⏰ Context from checks skipped due to timeout. (7)
- GitHub Check: semgrep-cloud-platform/scan
- GitHub Check: sl-daemon · pinned builder image offline build
- GitHub Check: clean-host smoke · Windows unsigned portable install
- GitHub Check: sl-daemon build · windows-latest
- GitHub Check: cargo audit
- GitHub Check: visual contract · WCAG AA
- GitHub Check: soft loom · loom_model
🧰 Additional context used
📓 Path-based instructions (2)
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Perform feature work in a git worktree under.claude/worktrees/, never directly onmain; use branches named<type>/<topic>where<type>isfeat,fix,chore,ci, ordocs.
Do not directly commit tomain; submit changes through a PR.
Do not usegit reset --hard,git stash, orgit cleanin worktrees.
Do not use--no-verifyor bypass hooks without operator approval.
Do not add AI attribution to commit or PR metadata.
Validate changes with the repository's required build, test, lint, and formatting commands:cargo build --all-targets --locked,cargo test --all-features --locked,cargo clippy --all-targets --all-features, andcargo fmt --all --check.
Files:
tests/fuzz_cadence.rsdocs/ops/test-pyramid.mdCONTRIBUTING.mddocs/ops/fuzz-cadence.mdscripts/fuzz-cadence-check.ps1
**/*.rs
📄 CodeRabbit inference engine (AGENTS.md)
Fix Clippy warnings; do not use
#[allow]unless accompanied by a tracking-issue comment.
Files:
tests/fuzz_cadence.rs
🪛 LanguageTool
docs/ops/fuzz-cadence.md
[uncategorized] ~9-~9: The official name of this software platform is spelled with a capital “H”.
Context: ...yramid layer),
fuzz/, [.github/workflows/ci.yml](../../.github/workfl...
(GITHUB)
[uncategorized] ~10-~10: The official name of this software platform is spelled with a capital “H”.
Context: ...thub/workflows/ci.yml)
(fuzz-smoke), [.github/workflows/fuzz-cadence.yml](../../.git...
(GITHUB)
[uncategorized] ~67-~67: The official name of this software platform is spelled with a capital “H”.
Context: ...
| Soft sustained fuzz CI | done | .github/workflows/fuzz-cadence.yml (`continue-...
(GITHUB)
[uncategorized] ~68-~68: The official name of this software platform is spelled with a capital “H”.
Context: ...
| PR fuzz-smoke (10 s) | done | .github/workflows/ci.yml (unchanged; stays blo...
(GITHUB)
🪛 PSScriptAnalyzer (1.25.0)
scripts/fuzz-cadence-check.ps1
[warning] 53-53: The cmdlet 'Test-DocContains' uses a plural noun. A singular noun should be used instead.
Suggested fix: Singularized correction of 'Test-DocContains'
(PSUseSingularNouns)
🪛 YAMLlint (1.37.1)
.github/workflows/fuzz-cadence.yml
[error] 1-1: wrong new line character: expected \n
(new-lines)
[warning] 7-7: truthy value should be one of [false, true]
(truthy)
🪛 zizmor (1.26.1)
.github/workflows/fuzz-cadence.yml
[warning] 30-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 48-48: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[info] 49-49: action functionality is already included by the runner (superfluous-actions): use rustup and/or cargo in a script step
(superfluous-actions)
🔇 Additional comments (5)
docs/ops/fuzz-cadence.md (1)
1-91: LGTM!docs/ops/test-pyramid.md (1)
137-140: LGTM!CONTRIBUTING.md (1)
33-36: LGTM!scripts/fuzz-cadence-check.ps1 (1)
1-147: LGTM!tests/fuzz_cadence.rs (1)
1-43: LGTM!
| timeout-minutes: 5 | ||
| continue-on-error: true | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Disable credential persistence in checkout steps.
Both checkout steps rely on the default behavior that leaves the GITHUB_TOKEN in the local .git/config. Since this workflow does not push changes, it is a security best practice to explicitly disable this to prevent potential credential leakage.
.github/workflows/fuzz-cadence.yml#L30-L30: Addwith:andpersist-credentials: falseto the checkout step in thefuzz-selfcheckjob..github/workflows/fuzz-cadence.yml#L48-L48: Addwith:andpersist-credentials: falseto the checkout step in thefuzz-sustainedjob.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 30-30: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/fuzz-cadence.yml#L30-L30(this comment).github/workflows/fuzz-cadence.yml#L48-L48
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/fuzz-cadence.yml at line 30, Disable credential
persistence for both checkout steps in jobs fuzz-selfcheck and fuzz-sustained by
adding with.persist-credentials: false to the checkout actions at
.github/workflows/fuzz-cadence.yml lines 30-30 and 48-48.
Source: Linters/SAST tools
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
WARNING: permissions: contents: read likely breaks the crash-artifact upload
Setting permissions: at workflow scope overrides the default GITHUB_TOKEN grants and leaves the token with only contents: read. actions/upload-artifact@v7 (v4) needs actions: read to query the run/API, and sibling uploads in ci.yml work precisely because they set no permissions: block (so they inherit defaults). Because the upload step is if: failure() inside a continue-on-error: true job, a permission failure here is silent — crashing fuzz runs won't produce the triage artifacts this PR exists to capture. Add actions: read (and id-token: write if OIDC upload is used) to the permissions block.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| let script = repo_root().join("scripts/fuzz-cadence-check.ps1"); | ||
| assert!(script.is_file(), "expected fuzz cadence check script at {}", script.display()); | ||
|
|
||
| let output = Command::new("pwsh") |
There was a problem hiding this comment.
SUGGESTION: Test hard-depends on pwsh, breaking cargo test without PowerShell
This integration test spawns pwsh unconditionally. It passes on GitHub-hosted runners (pwsh is preinstalled, so cargo test --all-features in ci.yml is fine), but panics with "failed to spawn pwsh" on contributor machines/CI images lacking PowerShell — breaking the local test loop the custom rules require (cargo test --workspace must pass). Consider checking for pwsh and skipping gracefully, or gating the test behind an availability guard, and document the requirement.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| #> | ||
| [CmdletBinding()] | ||
| param( | ||
| [switch]$SelfCheck |
There was a problem hiding this comment.
SUGGESTION: -SelfCheck switch is declared but never used for branching
The [switch]$SelfCheck parameter and its .PARAMETER/.EXAMPLE docs imply it changes behavior, but the script runs identical checks regardless of the flag (the only effect is an extra "Mode: SelfCheck" log line). Either honor the switch or drop the param and simplify the docs to avoid a misleading API.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
| $selfPath = Join-Path $repoRoot "scripts/fuzz-cadence-check.ps1" | ||
| $okfTarget = Join-Path $repoRoot "fuzz/fuzz_targets/okf_roundtrip.rs" | ||
| $jsonlTarget = Join-Path $repoRoot "fuzz/fuzz_targets/jsonl_ingest.rs" | ||
| $okfCorpus = Join-Path $repoRoot "fuzz/corpus/okf_roundtrip/minimal.json" |
There was a problem hiding this comment.
SUGGESTION: SelfCheck pins specific corpus seed filenames
$okfCorpus/$jsonlCorpus assert exact files (minimal.json, two_sessions.jsonl). These exist today, but renaming or adding seeds will break the SelfCheck (and the Rust test + CI) with a cryptic "Missing ... corpus seed" error. Prefer asserting the corpus directory exists and contains at least one seed, which survives seed renames.
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: 4 Issues Found | Recommendation: Address before merge (soft CI only; non-blocking) Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (6 files)
Note: A separate Fix these issues in Kilo Cloud Reviewed by hy3:free · Input: 97K · Output: 18.7K · Cached: 348K |
1 participant
Summary
Test plan
Made with Cursor