feat: add fuzzing support with Atheris and Docker configuration

[danielmarv]

Description:
This pull request introduces integration with ClusterFuzzLite to enable continuous fuzz testing for the Python SDK. It adds configuration files, Docker setup, build scripts, and several fuzz targets covering key parsing, transaction deserialization, contract parameter encoding, and entity ID parsing. The changes ensure that fuzzing is automated in CI for both pull requests and main branch pushes.

Key changes include:

ClusterFuzzLite Integration:

• Added .github/workflows/clusterfuzzlite.yml to run ClusterFuzzLite in CI for PRs and pushes to main, building and running fuzzers with address sanitizer enabled.
• Introduced .clusterfuzzlite/Dockerfile and .clusterfuzzlite/build.sh to define the Docker environment and build process for Python fuzzers, including setup for Atheris and PyInstaller. [1] [2]
• Added .clusterfuzzlite/project.yaml to specify Python as the fuzzing language.

Fuzz Targets:

• Added four Atheris-based fuzz targets for critical SDK components:
  • .clusterfuzzlite/keys_fuzzer.py: Fuzzes PrivateKey and PublicKey parsing from strings and bytes.
  • .clusterfuzzlite/transaction_from_bytes_fuzzer.py: Fuzzes Transaction.from_bytes deserialization and re-serialization.
  • .clusterfuzzlite/contract_params_fuzzer.py: Fuzzes ContractFunctionParameters ABI encoding with various input types.
  • .clusterfuzzlite/entity_id_fuzzer.py: Fuzzes entity ID parsing for AccountId, TokenId, and ContractId.

Dependency Management:

• Added a new fuzz dependency group in pyproject.toml for Atheris and PyInstaller, used exclusively in the fuzzing Docker build.

Related issue(s):

Fixes #

Notes for reviewer:

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

Walkthrough

Adds ClusterFuzzLite fuzzing infrastructure consisting of a Docker build environment, automated build script, four Atheris-based fuzz targets for SDK components (contracts, entity IDs, keys, transactions), project configuration, and GitHub Actions CI/CD workflow for regular fuzzing execution.

Changes

Cohort / File(s)	Summary
ClusterFuzzLite Infrastructure .clusterfuzzlite/Dockerfile, .clusterfuzzlite/project.yaml	Docker image for Python fuzzing with protobuf compiler; project language configuration.
Build Automation .clusterfuzzlite/build.sh	Build script orchestrating dependency installation, protobuf code generation, SDK installation, fuzzer discovery, PyInstaller packaging, and wrapper script generation with sanitizer configuration.
Fuzz Targets .clusterfuzzlite/contract_params_fuzzer.py, .clusterfuzzlite/entity_id_fuzzer.py, .clusterfuzzlite/keys_fuzzer.py, .clusterfuzzlite/transaction_from_bytes_fuzzer.py	Atheris fuzz targets exercising SDK parsing/encoding methods: contract parameter encoding, entity ID string parsing, key deserialization, and transaction bytecode deserialization. All suppress exceptions to enable continuous fuzzing.
Dependency Configuration pyproject.toml	Added optional fuzz dependency group with atheris>=2.3.0 and pyinstaller>=6.0.0.
CI/CD Integration .github/workflows/clusterfuzzlite.yml	GitHub Actions workflow triggering on pull requests and pushes to main, running fuzzing in code-change mode for PRs and artifact build mode for main with ASAN sanitizer.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding fuzzing support with Atheris and Docker configuration, which accurately reflects the core purpose of the PR.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, detailing the ClusterFuzzLite integration, fuzz targets, and dependency changes introduced in the PR.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fuzzle-sdk-br

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}