From 60c5cd9c0b07d4fa58875d50392d996a71959429 Mon Sep 17 00:00:00 2001
From: samialabri <sami.alabri@gmail.com>
Date: Sat, 17 Oct 2026 01:01:44 +0900
Subject: [PATCH] CI: pinned actions, cargo deny, fuzz smoke; build-android.sh
 works on Linux

- deny.toml: allow-wildcard-paths for the workspace's own path crates; ignore two
  unmaintained notices for uniffi 0.28's build-time deps (bincode, paste).
- build-android.sh ran uniffi-bindgen on libkv_ffi.dylib, which doesn't exist on the
  Linux CI runner; pick .so there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 57 +++++++++++++++++++++++++++++++++++-----
 deny.toml                |  9 +++++++
 scripts/build-android.sh |  5 ++--
 3 files changed, 63 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 83051e7..359f1ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,58 @@
 name: ci
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
-        with: { components: "clippy,rustfmt" }
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
+        with: { toolchain: stable, components: "clippy, rustfmt" }
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
       - run: cargo fmt --all --check
       - run: cargo clippy --workspace --all-targets -- -D warnings
       - run: cargo test --workspace
-      - uses: EmbarkStudios/cargo-deny-action@v2
+
+  deny:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with: { command: check, arguments: --all-features }
+
+  # Builds every fuzz target and runs each for a minute from the checked-in seeds (fuzz/README.md).
+  fuzz:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: { persist-credentials: false }
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master, 2026-10
+        with: { toolchain: nightly }
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with: { workspaces: fuzz }
+      - run: cargo install cargo-fuzz --locked
+      - name: Fuzz smoke run
+        working-directory: fuzz
+        run: |
+          for t in $(cargo +nightly fuzz list); do
+            mkdir -p "$RUNNER_TEMP/corpus/$t"
+            cargo +nightly fuzz run "$t" "$RUNNER_TEMP/corpus/$t" "seeds/$t" -- -max_total_time=60 -max_len=4096
+          done
+      - if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with: { name: fuzz-artifacts, path: fuzz/artifacts }
diff --git a/deny.toml b/deny.toml
index e990c9c..527e66c 100644
--- a/deny.toml
+++ b/deny.toml
@@ -2,6 +2,13 @@
 [advisories]
 version = 2
 yanked = "deny"
+ignore = [
+  # Unmaintained (no known vulnerability), build-time only: pulled in by uniffi 0.28's proc-macros and
+  # bindgen, never linked into the shipped library's runtime paths. Goes away with a uniffi upgrade,
+  # which regenerates the Swift/Kotlin bindings (tracked in fuzz/README.md "Dependency policy").
+  { id = "RUSTSEC-2025-0141", reason = "bincode 1.x via uniffi_macros 0.28 (build-time)" },
+  { id = "RUSTSEC-2024-0436", reason = "paste via uniffi_core/uniffi_bindgen 0.28 (proc-macro)" },
+]
 
 [licenses]
 version = 2
@@ -13,6 +20,8 @@ confidence-threshold = 0.9
 [bans]
 multiple-versions = "warn"
 wildcards = "deny"
+# The workspace's own crates are path dependencies without a version; they are never published.
+allow-wildcard-paths = true
 
 [sources]
 unknown-registry = "deny"
diff --git a/scripts/build-android.sh b/scripts/build-android.sh
index 9213120..eec3b78 100755
--- a/scripts/build-android.sh
+++ b/scripts/build-android.sh
@@ -5,6 +5,7 @@ cd "$(dirname "$0")/.."
 OUT=../kestrove-android/core-ffi/src/main
 rustup target add aarch64-linux-android armv7-linux-androideabi x86_64-linux-android
 cargo ndk -t arm64-v8a -t armeabi-v7a -t x86_64 -o "$OUT/jniLibs" build -p kv-ffi --release
-cargo build -p kv-ffi
-cargo run -p kv-ffi --bin uniffi-bindgen -- generate --library target/debug/libkv_ffi.dylib --language kotlin --out-dir "$OUT/java"
+cargo build -p kv-ffi   # host library for library-mode bindgen (.so on Linux CI, .dylib on macOS)
+case "$(uname -s)" in Darwin) HOST_LIB=libkv_ffi.dylib ;; *) HOST_LIB=libkv_ffi.so ;; esac
+cargo run -p kv-ffi --bin uniffi-bindgen -- generate --library "target/debug/$HOST_LIB" --language kotlin --out-dir "$OUT/java"
 echo "✅ Android libs + bindings written to $OUT"