Add CI enforcement for fuzz env policies

Author: berisher

.github/workflows/ci.yml

@@ -84,6 +84,21 @@ jobs:
       - name: Run clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
+  fuzz-contracts:
+    name: Fuzz Contracts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f
+        with:
+          toolchain: nightly-2026-04-16
+
+      - name: Run fuzz helper tests
+        run: cargo test --manifest-path fuzz/Cargo.toml
+
   coverage:
     name: Code Coverage
     runs-on: ubuntu-latest
@@ -97,7 +112,7 @@ jobs:
           toolchain: nightly
 
       - name: Install tarpaulin
-        run: cargo install cargo-tarpaulin
+        run: cargo install cargo-tarpaulin --locked --version 0.34.1
 
       - name: Generate coverage
         run: cargo tarpaulin

.github/workflows/fuzz-python-env-comparison.yml

@@ -27,6 +27,7 @@ permissions:
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1
+  FUZZ_SEED: "424242"
 
 jobs:
   compare-python-env:
@@ -88,6 +89,16 @@ jobs:
           fi
           printf 'duration=%s\n' "$duration" >> "$GITHUB_OUTPUT"
 
+      - name: Record comparison metadata
+        run: |
+          mkdir -p fuzz/artifacts/python-env-reports
+          {
+            echo "policy=${{ matrix.env_policy }}"
+            echo "duration=${{ steps.duration.outputs.duration }}"
+            echo "seed=$FUZZ_SEED"
+            echo "sha=${{ github.sha }}"
+          } > "fuzz/artifacts/python-env-reports/${{ matrix.name }}-metadata.txt"
+
       - name: Report effective Python environment
         env:
           PICKLE_FUZZ_PYTHON_ENV_POLICY: ${{ matrix.env_policy }}
@@ -101,10 +112,12 @@ jobs:
           FUZZ_DURATION: ${{ steps.duration.outputs.duration }}
           PICKLE_FUZZ_PYTHON_ENV_POLICY: ${{ matrix.env_policy }}
         run: |
+          set -o pipefail
           cargo fuzz run validate_with_python -- \
+            -seed="$FUZZ_SEED" \
             -max_total_time="$FUZZ_DURATION" \
             -print_final_stats=1 \
-            -verbosity=1
+            -verbosity=1 | tee "fuzz/artifacts/python-env-reports/${{ matrix.name }}-fuzz.log"
         continue-on-error: true
 
       - name: Check for crashes
@@ -140,5 +153,8 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: fuzz-python-env-report-${{ matrix.name }}
-          path: fuzz/artifacts/python-env-reports/${{ matrix.name }}.txt
+          path: |
+            fuzz/artifacts/python-env-reports/${{ matrix.name }}.txt
+            fuzz/artifacts/python-env-reports/${{ matrix.name }}-metadata.txt
+            fuzz/artifacts/python-env-reports/${{ matrix.name }}-fuzz.log
           if-no-files-found: error

.github/workflows/security.yml

@@ -23,11 +23,14 @@ jobs:
           toolchain: stable
 
       - name: Install cargo-audit
-        run: cargo install cargo-audit
+        run: cargo install cargo-audit --locked --version 0.22.1
 
       - name: Run security audit
         run: cargo audit
 
+      - name: Run fuzz crate security audit
+        run: cd fuzz && cargo audit
+
   deny:
     name: License and Dependency Check
     runs-on: ubuntu-latest
@@ -41,7 +44,7 @@ jobs:
           toolchain: stable
 
       - name: Install cargo-deny
-        run: cargo install cargo-deny
+        run: cargo install cargo-deny --locked --version 0.19.4
 
       - name: Check licenses
         run: cargo deny check licenses
@@ -65,7 +68,7 @@ jobs:
           toolchain: stable
 
       - name: Install cargo-outdated
-        run: cargo install cargo-outdated
+        run: cargo install cargo-outdated --locked --version 0.19.0
 
       - name: Check for outdated dependencies
         run: cargo outdated --exit-code 1

fuzz/examples/report_python_env.rs

@@ -14,13 +14,22 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use pickle_fuzzer_fuzz::python_env::{spawn_python_command, PythonEnvPolicy};
+use pickle_fuzzer_fuzz::python_env::{
+    spawn_python_command, PythonEnvPolicy, REPORTED_PYTHON_ENV_KEYS,
+};
 use std::process::ExitCode;
 
 fn main() -> ExitCode {
     let policy = PythonEnvPolicy::from_env_var();
-    let script =
-        "import os\nfor key, value in sorted(os.environ.items()):\n    print(f\"{key}={value}\")\n";
+    let keys = REPORTED_PYTHON_ENV_KEYS
+        .iter()
+        .map(|key| format!("{key:?}"))
+        .collect::<Vec<_>>()
+        .join(", ");
+
+    let script = format!(
+        "import os\nfor key in [{keys}]:\n    value = os.environ.get(key)\n    print(f\"{{key}}={{value if value is not None else '<unset>'}}\")\n"
+    );
 
     let output = match spawn_python_command(policy).arg("-c").arg(script).output() {
         Ok(output) => output,

fuzz/src/python_env.rs

@@ -19,6 +19,19 @@ use std::ffi::OsString;
 use std::process::Command;
 
 pub const PYTHON_ENV_POLICY_VAR: &str = "PICKLE_FUZZ_PYTHON_ENV_POLICY";
+pub const REPORTED_PYTHON_ENV_KEYS: &[&str] = &[
+    "pythonLocation",
+    "Python_ROOT_DIR",
+    "Python2_ROOT_DIR",
+    "Python3_ROOT_DIR",
+    "PKG_CONFIG_PATH",
+    "LD_LIBRARY_PATH",
+    "PATH",
+    "PYTHONHOME",
+    "PYTHONPATH",
+    "VIRTUAL_ENV",
+    "CONDA_PREFIX",
+];
 
 const STRIP_SETUP_PYTHON_REMOVALS: &[&str] = &[
     "pythonLocation",
@@ -148,6 +161,7 @@ mod tests {
         );
     }
 
+    #[cfg(unix)]
     #[test]
     fn resolve_non_utf8_values_fall_back_to_safe_default() {
         use std::os::unix::ffi::OsStringExt;

fuzz/tests/python_env_contract.rs

@@ -129,4 +129,13 @@ fn workflow_and_docs_stay_in_sync_with_supported_policies() {
             "workflow path filters must include {path}"
         );
     }
+
+    let main_workflow =
+        std::fs::read_to_string(repo_root().join(".github/workflows/fuzz.yml"))
+            .expect("main fuzz workflow should exist");
+    let policy_count = main_workflow.matches("PICKLE_FUZZ_PYTHON_ENV_POLICY: strip_setup_python").count();
+    assert_eq!(
+        policy_count, 2,
+        "main fuzz workflow should set strip_setup_python for both validate_with_python entry points"
+    );
 }

plans/fuzz-and-security-ci.md

@@ -16,6 +16,8 @@ on the branch.
   policy variants on `ubuntu-latest`.
 - The main fuzz workflow uses the targeted policy without broad leak
   suppression.
+- The fuzz helper contract tests run in regular PR CI.
+- Security CI covers both `Cargo.lock` and `fuzz/Cargo.lock`.
 - `cargo clippy --all-targets --all-features -- -D warnings` passes on the
   stable toolchain used by GitHub CI.
 
@@ -45,8 +47,8 @@ GitHub evidence already observed on PR `#24`:
 ## Notes
 
 - The comparison workflow is diagnostic. It verifies the effective Python child
-  environment used by the fuzz target and uploads both the env report and fuzz
-  artifacts for each policy.
+  environment used by the fuzz target, records policy/duration/seed metadata,
+  and uploads both the env report and fuzz artifacts for each policy.
 - The current branch default remains `strip_setup_python` for scheduled and
   custom `validate_with_python` runs because it is the least invasive CI-only
   change under active observation.