ci: add ClusterFuzzLite fuzzing for OpenSSF FuzzingID

- Add .clusterfuzzlite/ config (project.yaml, Dockerfile, build.sh)
- Add fuzz/ with cargo-fuzz targets:
  - fuzz_sql_policy: Tests PolicyEngine SQL parsing
  - fuzz_integrity: Tests manifest JSON deserialization
- Add cflite_pr.yml: 5-min fuzzing on PRs
- Add cflite_batch.yml: 30-min weekly batch fuzzing

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Jonathan D.A. Jewell

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite Dockerfile for Rust fuzzing
+
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+
+COPY . $SRC/project-wharf
+WORKDIR $SRC/project-wharf
+
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,21 @@
+#!/bin/bash -eu
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite build script for Rust fuzzing
+
+cd $SRC/project-wharf
+
+# Install nightly for fuzzing
+rustup install nightly
+rustup default nightly
+
+# Build fuzz targets
+cargo +nightly fuzz build
+
+# Copy fuzz targets to output
+for target in fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_*; do
+    if [ -f "$target" ] && [ -x "$target" ]; then
+        cp "$target" $OUT/
+    fi
+done

.clusterfuzzlite/project.yaml

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite project configuration
+
+language: rust

.github/workflows/cflite_batch.yml

@@ -0,0 +1,37 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite batch fuzzing workflow
+# Runs extended fuzzing on a weekly schedule
+
+name: ClusterFuzzLite batch fuzzing
+
+on:
+  schedule:
+    - cron: '0 0 * * 0'  # Weekly on Sunday at midnight UTC
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  BatchFuzzing:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Build Fuzzers
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: rust
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run Fuzzers
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 1800
+          mode: batch
+          sanitizer: address

.github/workflows/cflite_pr.yml

@@ -0,0 +1,36 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+#
+# ClusterFuzzLite PR fuzzing workflow
+# Runs quick fuzzing on pull requests
+
+name: ClusterFuzzLite PR fuzzing
+
+on:
+  pull_request:
+    branches: [main, master, develop]
+
+permissions: read-all
+
+jobs:
+  PR:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Build Fuzzers
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: rust
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+
+      - name: Run Fuzzers
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 300
+          mode: code-change
+          sanitizer: address

fuzz/Cargo.toml

@@ -0,0 +1,31 @@
+# SPDX-License-Identifier: PMPL-1.0
+# SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+
+[package]
+name = "project-wharf-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2021"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+
+[dependencies.wharf-core]
+path = "../crates/wharf-core"
+
+[[bin]]
+name = "fuzz_sql_policy"
+path = "fuzz_targets/fuzz_sql_policy.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "fuzz_integrity"
+path = "fuzz_targets/fuzz_integrity.rs"
+test = false
+doc = false
+bench = false

fuzz/fuzz_targets/fuzz_integrity.rs

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: PMPL-1.0
+// SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+//
+//! Fuzz target for integrity manifest parsing
+//! Tests handling of arbitrary manifest JSON input
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use wharf_core::integrity::Manifest;
+
+fuzz_target!(|data: &[u8]| {
+    // Try to interpret fuzzer input as JSON manifest
+    if let Ok(json_str) = std::str::from_utf8(data) {
+        // Attempt to deserialize - should handle any input gracefully
+        let _: Result<Manifest, _> = serde_json::from_str(json_str);
+    }
+});

fuzz/fuzz_targets/fuzz_sql_policy.rs

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: PMPL-1.0
+// SPDX-FileCopyrightText: 2025 Jonathan D. A. Jewell <hyperpolymath>
+//
+//! Fuzz target for SQL policy engine
+//! Tests the PolicyEngine's ability to handle arbitrary SQL input
+
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use wharf_core::db_policy::{PolicyConfig, PolicyEngine, TableZone};
+
+fuzz_target!(|data: &[u8]| {
+    // Try to interpret fuzzer input as UTF-8 SQL
+    if let Ok(sql) = std::str::from_utf8(data) {
+        // Create a basic policy config for testing
+        let config = PolicyConfig {
+            mutable_tables: vec!["wp_comments".to_string(), "wp_posts".to_string()],
+            immutable_tables: vec!["wp_users".to_string(), "wp_options".to_string()],
+            hybrid_tables: vec![],
+            default_zone: TableZone::Mutable,
+        };
+
+        let engine = PolicyEngine::new(config);
+
+        // Fuzz the evaluate function - it should handle any input gracefully
+        let _ = engine.evaluate(sql);
+    }
+});