chore: import upstream snapshot with attribution

2026-07-13 13:08:55 +08:00
commit 7a0da7932b
2985 changed files with 1049377 additions and 0 deletions
@@ -0,0 +1,82 @@
+name: Fuzzing Tests
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
+  workflow_dispatch:  # Allow manual triggering
+  pull_request:
+    paths:
+      - 'tests/fuzz/**'
+      - 'src/local_deep_research/security/**'
+      - 'src/local_deep_research/utilities/**'
+
+# No concurrency group — intentionally omitted.
+# Previous attempt (#3554, reverted #3599) used cancel-in-progress which
+# killed in-progress PR runs before they produced useful results.
+# Future iteration could safely add concurrency for scheduled/push-only
+# triggers (where head_ref is empty and runs get unique groups).
+
+permissions: {}
+
+jobs:
+  fuzz-tests:
+    name: Hypothesis Fuzz Tests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: '3.12'
+
+      - name: Cache PDM dependencies
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: |
+            ~/.cache/pdm
+            .venv
+          key: pdm-${{ runner.os }}-${{ hashFiles('pdm.lock') }}
+          restore-keys: |
+            pdm-${{ runner.os }}-
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip==25.0
+          pip install pdm==2.26.2
+          # Retry pdm install up to 3 times with backoff
+          for i in 1 2 3; do
+            pdm install --dev --no-editable && break
+            echo "Attempt $i failed, retrying in $((i * 10)) seconds..."
+            sleep $((i * 10))
+          done || exit 1
+
+      - name: Run fuzz tests
+        run: |
+          pdm run pytest tests/fuzz/ -v --tb=short \
+            --hypothesis-show-statistics \
+            --hypothesis-seed=0
+        env:
+          HYPOTHESIS_PROFILE: ci
+
+      - name: Run extended fuzz tests (scheduled only)
+        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        run: |
+          # Run with more examples for scheduled/manual runs
+          pdm run pytest tests/fuzz/ -v --tb=short \
+            --hypothesis-show-statistics \
+            -x  # Stop on first failure for investigation
+        env:
+          HYPOTHESIS_PROFILE: extended