Skip to content

test(quality): add fuzzing and verified build tools#92

Merged
edithatogo merged 1 commit into
masterfrom
codex/scorecard-quality
Jul 14, 2026
Merged

test(quality): add fuzzing and verified build tools#92
edithatogo merged 1 commit into
masterfrom
codex/scorecard-quality

Conversation

@edithatogo

Copy link
Copy Markdown
Owner

Summary

  • add a Go fuzz target for OSF API URL resolution and run a bounded fuzz smoke test in CI
  • replace the MkDocs install with a fully hash-locked requirements file
  • download MCPB from its immutable registry tarball, verify the published SHA-512 integrity, then install it

Validation

  • go test ./...
  • go test ./internal/osfapi -run=FuzzResolveReference -fuzz=FuzzResolveReference -fuzztime=10s
  • mkdocs build --strict
  • hash-locked documentation dependency installation
  • govulncheck ./...
  • git diff --check

@gemini-code-assist

Copy link
Copy Markdown

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

Comment thread .github/workflows/mcpb-bundles.yml Dismissed
@edithatogo

Copy link
Copy Markdown
Owner Author

All hosted checks pass, including CodeQL, Scorecard analysis, dependency review, fuzz-enabled CI, and hash-locked documentation tooling. Merge is intentionally blocked by the master ruleset until two independent code-owner approvals are recorded.

@edithatogo edithatogo force-pushed the codex/scorecard-quality branch from fb195e3 to 47a0d4e Compare July 14, 2026 08:43
@edithatogo edithatogo merged commit 28d7e2f into master Jul 14, 2026
10 checks passed
@edithatogo edithatogo deleted the codex/scorecard-quality branch July 14, 2026 08:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants