ci: harden Scorecard and add fuzz smoke - #105
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![chatgpt-codex-connector[bot]](https://cdn.github.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1c9d07ff34
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| run: cargo install cargo-fuzz --locked | ||
|
|
||
| - name: Run bounded fuzz smoke | ||
| run: cargo fuzz run json_repair --fuzz-dir fuzz --sanitizer none -- -runs=1000 |
There was a problem hiding this comment.
In this repo, rust-toolchain.toml pins channel = "1.96", and rustup's documented override order puts a rust-toolchain.toml file ahead of the default toolchain set by the previous action; cargo-fuzz's README says it needs nightly because it uses unstable flags. As a result, this scheduled/manual smoke still invokes cargo under 1.96 and will fail before fuzzing; use cargo +nightly fuzz ... or set RUSTUP_TOOLCHAIN=nightly for the fuzz steps.
Useful? React with 👍 / 👎.
|
Dependency limit exceeded — report not shown. This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report. Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard. Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account. |
|
@Mergifyio refresh |
|
@Mergifyio refresh |
☑️ Command
|
✅ Pull request refreshed |
1 participant
Summary
Validation