Add fuzzing to CI

[Dreamsorcerer]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.25%. Comparing base (77c5108) to head (c90edb3).
⚠️ Report is 9 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #12887      +/-   ##
==========================================
- Coverage   98.99%   98.25%   -0.75%     
==========================================
  Files         132      131       -1     
  Lines       49454    49702     +248     
  Branches     2572     2619      +47     
==========================================
- Hits        48959    48835     -124     
- Misses        371      733     +362     
- Partials      124      134      +10     

Flag	Coverage Δ
Autobahn	?
CI-GHA	98.27% <ø> (-0.64%)	⬇️
OS-Linux	98.04% <ø> (-0.64%)	⬇️
OS-Windows	96.46% <ø> (-0.59%)	⬇️
OS-macOS	97.35% <ø> (-0.59%)	⬇️
Py-3.10	97.54% <ø> (-0.59%)	⬇️
Py-3.11	97.80% <ø> (-0.59%)	⬇️
Py-3.12	97.88% <ø> (-0.59%)	⬇️
Py-3.13	97.86% <ø> (-0.59%)	⬇️
Py-3.14	97.25% <ø> (-1.23%)	⬇️
Py-3.14t	96.98% <ø> (-0.59%)	⬇️
Py-pypy-3.11	?
VM-macos	97.35% <ø> (-0.59%)	⬇️
VM-ubuntu	98.04% <ø> (-0.64%)	⬇️
VM-windows	96.46% <ø> (-0.59%)	⬇️
cython-coverage	38.15% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 84 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing fuzz (c90edb3) with master (203c1c5)²}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on master (8aac7bf) during the generation of this report, so 203c1c5 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[Dreamsorcerer]

@DavidKorczynski Could you check over this PR and confirm how to complete the integration with oss-fuzz repo?

[soccerlover29]

Tested the fuzz branch locally with the OSS-Fuzz base-builder-python image: two bugs in fuzzers/multipart.py crash the fuzzer (StreamReader never imported -> NameError; HeadersDictProxy passed a plain dict instead of CIMultiDict -> AttributeError: 'dict' object has no attribute 'getall'). Full details in my comment on oss-fuzz issue #15791. Fix PR targeting this branch is coming shortly.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported undefined CIMultiDict symbol is now imported at module scope before the multipart fuzz target uses it.

_{Reviews (4): Last reviewed commit: "Update http_parser.py" | Re-trigger Greptile}

[Dreamsorcerer]

Looks like this needs to be merged with fuzzers only first, so oss-fuzz can update their end, then we can add the CI runs after that.

[DavidKorczynski]

@DavidKorczynski Could you check over this PR and confirm how to complete the integration with oss-fuzz repo?

From an OSS-Fuzz perspective this looks reasonable. It may be easier to first fix the broken OSS-Fuzz builds -- you can see logs here https://oss-fuzz-build-logs.storage.googleapis.com/index.html#aiohttp

If you'd like, I'm happy to push a PR on the OSS-Fuzz side to fix things, which may resolve the CI failures here. Let me know if you'd like me to do that. Once that is done, I suspect it will be easier to get this PR over the line and the CIFuzz signals green.

Did you confirm this work locally with OSS-Fuzz's helper.py and build_fuzzers and check_build commands?

[Dreamsorcerer]

@DavidKorczynski Could you check over this PR and confirm how to complete the integration with oss-fuzz repo?

From an OSS-Fuzz perspective this looks reasonable. It may be easier to first fix the broken OSS-Fuzz builds -- you can see logs here https://oss-fuzz-build-logs.storage.googleapis.com/index.html#aiohttp

If you'd like, I'm happy to push a PR on the OSS-Fuzz side to fix things, which may resolve the CI failures here. Let me know if you'd like me to do that. Once that is done, I suspect it will be easier to get this PR over the line and the CIFuzz signals green.

Did you confirm this work locally with OSS-Fuzz's helper.py and build_fuzzers and check_build commands?

Thanks, I iterated a little with someone's bot on google/oss-fuzz#15990
I think I need to skip the CI part in this PR and merge the fuzzers, and then that PR can be merged, and then I can add the CI part back in here.

Do you think it'll be possible to get this atheris PR merged and released soon?
google/atheris#110
Or, should I just ignore the mypy errors for now and get this merged?