* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
* Fix CoverageBot.run_task and add test cases
* Add setuptools as an explicit dependency
This is because a transitive dependency via clusterfuzz depends on it
* Appease ruff
* Use openlit <1.36.6
Openlit >=1.36.6 has a bug with langgraph instrumentation.
Also add a test to seed-gen for when openlit is enabled
* Link to issue
Add uv constraint-dependencies to prevent protobuf from being updated
beyond 3.20.3, which is required for compatibility with OSS-Fuzz
infrastructure.
This prevents dependabot from creating PRs like #453 that would break
the fuzzer runner.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Updates pyasn1 0.6.1 → 0.6.2 and urllib3 2.5.0 → 2.6.3 in fuzzer_runner.
These updates are from Dependabot PRs #448 and #449.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Run `ruff check --fix` across all components to fix I001 import sorting
violations in src/ and test/ directories.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update dependencies across all components:
- Update ruff to v0.12.0
- Add ty (Astral type checker) as dev dependency
- Standardize pyproject.toml configurations
- Regenerate uv.lock files
Components updated:
- common
- orchestrator
- fuzzer
- fuzzer_runner
- patcher
- program-model
- seed-gen
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Apply automated fixes from shellcheck and shfmt to all shell scripts:
- Quote variables to prevent word splitting and globbing
- Use $(...) instead of backticks for command substitution
- Add proper shebang and set -euo pipefail where missing
- Fix array handling and iteration patterns
- Consistent indentation (4 spaces)
- Remove unnecessary curly braces and simplify expressions
Files fixed:
- deployment/*.sh
- scripts/*.sh
- orchestrator/scripts/*.sh
- fuzzer_runner/runner.sh
- protoc.sh
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Before this commit, the fuzzer dependend on clusterfuzz, which uses
protobuf 3.20. Since fuzzer-bot depended on common subpackage as well
and also common (and the other packages) require protobuf, we had to use
protobuf 3.20 everywhere. This old dependency however means that a lot
of packages can't be used in their "newer" versions, because they depend
on newer protobuf versions.
This commit splits the fuzzer into a separate fuzzer-runner that is
executed in a separate process inside a separate venv. fuzzer-runner
executes the clusterfuzz-heavy operations (e.g. fuzzing) and isolates the
clusterfuzz dependency, so that the rest of the system can use newer
protobuf version.
* split `fuzzer-bot` in `fuzzer-runner` and `fuzzer-bot`
* have a "full" optional dependency group in `common`, including `openlit`
and `protobuf`, so that `fuzzer-runner` can use the lite version of `common`
without bringing those heavy deps
* move `FuzzConfiguration`/`BuildConfiguration` in a separate common file
that doesn't require to load all protobuf files. Again, in this way
other components can just depend on the `common` "lite" version and not
require protobuf stuff
* add `fuzzer-runner` as a separate venv inside the `fuzzer-bot` container
* add `RunnerProxy` class in fuzzer package to provide an interface to
interact with the fuzzer-runner binary.
Ronald Eytchison