feat: add security fuzz tests and harden input sinks

[scottbrown]

Summary

Adds native Go fuzz tests that harden gitgrab against path traversal and command/argument injection at its untrusted-input boundaries, split into a lightweight CI tier and a heavyweight ad-hoc tier.

While building the tests I found the type-safety validators (IsValid()) were defined but never called — untrusted GitHub API data and CLI flags flowed straight into filepath.Join and exec.Command("git", "clone", ...). Fuzz tests that only asserted current behavior wouldn't harden anything, so this PR closes the holes first, then fuzzes the invariants.

Hardening (gitgrab.go)

• Name validators → strict allowlists matching GitHub's real rules; reject ./.., path separators, leading/trailing -, and control/whitespace characters.
• URL validators → reject leading - (git option injection) and embedded whitespace/control chars (command splitting).
• New pure choke-point helpers, all fuzzable and wired into CloneRepo/FetchAllRepos:
  • resolveRepoPath — validates the repo name and confirms the joined path stays directly within the target dir.
  • buildCloneURL — validates every untrusted component before constructing/returning a clone URL.
  • parseRepos — strict JSON decode of API responses (rejects trailing garbage).
• git clone -- URL PATH separator so a --prefixed value can't be interpreted as a flag.

Fuzz targets (fuzz_test.go)

Six targets asserting security invariants (not fixed outputs), each with a malicious seed corpus (traversal, command substitution, ext::sh, --upload-pack=, NUL bytes, oversized inputs):

FuzzParseCloneMethod, FuzzRepositoryNameValidation, FuzzOrganizationNameValidation, FuzzResolveRepoPath, FuzzBuildCloneURL, FuzzParseRepos.

Two tiers

• Lightweight / CI — task fuzz-ci (short burst per target, default FUZZTIME=15s), wired into a new fuzz job in .github/workflows/ci.yml. Seed corpora also run under task test on every push/PR.
• Heavyweight / ad hoc — task fuzz (default 5m/target, e.g. task fuzz FUZZTIME=30m).

Both tiers auto-discover every Fuzz* target (grep in the internal fuzz-run task), since go test -fuzz fuzzes one target per invocation.

Testing

• go build, go vet, task test all pass.
• Heavyweight fuzz run: millions of executions per target, zero crashers, no crash corpus persisted.
• Existing unit tests unchanged and passing.

🤖 Generated with Claude Code