refactor: improve fuzzers by bouskaJ · Pull Request #2173 · securesign/secure-sign-operator

bouskaJ · 2026-07-30T11:32:57Z

No description provided.

bouskaJ · 2026-07-30T11:33:12Z

/agentic_review

qodo-for-securesign · 2026-07-30T11:34:18Z

PR Summary by Qodo

Improve conversion fuzzers for v1alpha1 roundtrip tests

🧪 Tests 🐞 Bug fix 🕐 20-40 Minutes

AI Description

• Generate valid HTTP/gRPC URLs and URL paths for conversion roundtrip fuzzing.
• Constrain fuzzed objects to roundtrippable field combinations (e.g., mutually exclusive URL/Ref).
• Refactor inline fuzz logic into reusable, per-resource fuzzer helpers.

Diagram

graph TD
  T["conversion_roundtrip_test.go"] --> H["rand URL helpers"] --> F["custom fuzzer funcs"] --> R["utilconversion.FuzzTestFunc"]
  R --> C["v1<->v1alpha1 conversions"] --> V1[("v1 hub objects")] --> A["roundtrip assertions"]
  C --> V1a[("v1alpha1 spoke objects")] --> A

High-Level Assessment

The following are alternative approaches to this PR:

1. Make conversions tolerate/normalize more invalid inputs

➕ Reduces the need for tight fuzzer constraints
➕ Potentially improves robustness against malformed real-world objects
➖ Risk of masking schema/defaulter invariants that should remain strict
➖ Can expand conversion behavior surface area and complicate compatibility guarantees

2. Use structured generators / seeded corpus for edge-cases

➕ More deterministic coverage of known tricky cases (URL parsing, nil vs empty)
➕ Easier to reproduce failures than fully random fuzzing
➖ More upfront maintenance to curate and evolve generators/corpus
➖ May reduce exploration breadth vs randomized fuzzing

Recommendation: Keep the current approach: constrain fuzzing to representable, schema-valid values and explicitly clear fields that cannot exist in the opposite version. This preserves the goal of roundtrip tests (compatibility for valid objects) while still exercising important edge cases (e.g., nil vs empty restoration, URL path handling) via targeted generators.

Files changed (1) +244 / -217

Tests (1) +244 / -217

conversion_roundtrip_test.goHarden and refactor roundtrip fuzzers with valid URLs and roundtrippable fields +244/-217

Harden and refactor roundtrip fuzzers with valid URLs and roundtrippable fields

• Adds shared random generators for URL paths, HTTP URLs, and gRPC target URIs, then rewrites multiple fuzzer functions to enforce invariants required by v1 ↔ v1alpha1 conversions. Introduces per-resource status/spec cleaners (Securesign, Rekor, Fulcio, Trillian, TSA, CTlog) and refactors tests to use these helpers instead of ad-hoc inline fuzzers.

api/v1alpha1/conversion_roundtrip_test.go

codecov-commenter · 2026-07-30T11:36:05Z

Codecov Report

❌ Patch coverage is 51.20482% with 81 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.99%. Comparing base (3fa5719) to head (f0f3805).

Files with missing lines	Patch %	Lines
internal/testing/fuzzer/url.go	0.00%	64 Missing ⚠️
internal/utils/service_ref_resolver.go	76.92%	7 Missing and 8 partials ⚠️
api/v1alpha1/conversion_overrides_utils.go	92.85%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2173      +/-   ##
==========================================
- Coverage   57.12%   56.99%   -0.14%     
==========================================
  Files         286      287       +1     
  Lines       16129    16241     +112     
==========================================
+ Hits         9214     9256      +42     
- Misses       5970     6033      +63     
- Partials      945      952       +7

Flag	Coverage Δ
e2e	`69.75% <100.00%> (-0.03%)`	⬇️
unit	`35.69% <51.20%> (+0.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

qodo-for-securesign · 2026-07-30T11:40:01Z

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ADMIN_SERVER trailing colon 🐞 Bug ≡ Correctness ⭐ New

Description

Multiple call sites (the create-tree job and CTLog server config generation) build Trillian
endpoints by always concatenating host and port with ":", so when the gRPC resolver returns an empty
port for a portless user URL (e.g. dns:///custom-host), they produce malformed backend addresses
ending in a trailing colon (e.g. dns:///custom-host:) that are then used as ADMIN_SERVER and
written into CTLog config.

Code

internal/action/tree/action.go[225]
+	trillUrl = fmt.Sprintf("%s:%s", trillHost, trillPort)

Relevance

●●● Strong
PR #2114 tests allow gRPC targets without port returning empty port; new fmt.Sprintf host:port risks
trailing colon.
PR-#2114

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The cited code paths set Trillian connection strings via fmt.Sprintf("%s:%s", host, port) and pass
the result directly into downstream consumers: the create-tree job wires that concatenated value
into the job’s ADMIN_SERVER, and the CTLog server config derives trillianUrl the same way and
feeds it into CTLog configuration generation. ResolveInternalGrpcService is documented/observed to
return (address, "") when the user supplies a URL with a hostname but no explicit port (it returns
early once userAddress != ""), and because gRPC resolution can legally yield an empty port in that
scenario, the unconditional concatenation deterministically produces a trailing-colon endpoint,
demonstrating how the malformed value is created and propagated.

internal/action/tree/action.go[219-226]
internal/action/tree/action.go[381-404]
internal/utils/service_ref_resolver.go[108-118]
internal/controller/ctlog/actions/server_config.go[80-85]
internal/controller/ctlog/actions/server_config.go[155-157]
internal/controller/ctlog/utils/ctlog_config.go[146-151]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The create-tree action (`internal/action/tree/action.go`) and CTLog server config generation (`internal/controller/ctlog/actions/server_config.go`) build Trillian endpoints with `fmt.Sprintf("%s:%s", host, port)` without guarding against an empty port, which can produce malformed addresses like `dns:///custom-host:` when the user supplies a portless URL and the resolver returns an empty `port`.

## Issue Context
`ResolveInternalGrpcService` can return an empty `port` when the user provides a URL without a trailing `:port` (it returns early for a non-empty `userAddress`, yielding `(address, "")`), and gRPC resolution can legally result in an empty port in this case. The malformed concatenated endpoint is then propagated into critical configuration: the create-tree job receives it as `ADMIN_SERVER`, and CTLog server config writes it as the Trillian backend address used for CTLog config generation. Fixes should ensure callers don’t emit trailing-colon endpoints by either rejecting empty ports at call sites or adjusting `ResolveInternalGrpcService` to fall back to a resolved/default port when the user omits it.

## Fix Focus Areas
- internal/action/tree/action.go[219-226]
- internal/action/tree/action.go[381-404]
- internal/controller/ctlog/actions/server_config.go[80-85]
- internal/utils/service_ref_resolver.go[108-134]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Double-port Trillian URL~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

trillianServiceFuzzerFuncs sets TrillianService.Address to a dns:///...:port string and also always
sets TrillianService.Port, so Convert_v1alpha1_TrillianService_To_v1_ServiceReference appends a
second port and produces malformed URLs like "dns:///svc.ns.svc:1234:5678". This violates the
fuzzer’s own constraints and reduces the correctness/usefulness of conversion fuzz coverage for
Trillian service references.

Code

api/v1alpha1/conversion_roundtrip_test.go[R122-128]

+		func(s *TrillianService, c randfill.Continue) {
+			c.FillNoCustom(s)
+			s.Address = randGrpcUrl(c)
+
+			// port is always set (defaulter)
+			s.Port = ptr.To(int32(c.Intn(65534) + 1))
+		},

Relevance

●●● Strong
Team previously accepted fixing malformed duplicated URL paths (#1723); similar double-port issue
discussed in service-ref work (#2114).
PR-#1723
PR-#2114

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The fuzzer assigns Address = randGrpcUrl(c) which includes a :<port> suffix, and also sets
Port. The conversion logic appends :<port> again whenever Port != nil, producing a double-port
URL string.
api/v1alpha1/conversion_roundtrip_test.go[55-59]
api/v1alpha1/conversion_roundtrip_test.go[113-128]
api/v1alpha1/conversion_overrides.go[95-101]
api/v1alpha1/common.go[51-62]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`trillianServiceFuzzerFuncs` generates a `v1alpha1.TrillianService` where `Address` already includes a port (`dns:///...:port`) and `Port` is also set. The production conversion code appends `Port` to `Address` when `Port != nil`, yielding malformed `ServiceReference.URL` values containing two port segments.

### Issue Context
- `randGrpcUrl` currently includes a port.
- `Convert_v1alpha1_TrillianService_To_v1_ServiceReference` appends `Port` to `Address`.
- The fuzzer should generate values consistent with this conversion contract (i.e., `Address` should not already include a `:<port>` suffix when `Port` is set).

### Fix Focus Areas
- api/v1alpha1/conversion_roundtrip_test.go[55-59]
- api/v1alpha1/conversion_roundtrip_test.go[113-129]

### Suggested fix
- Introduce a helper that generates a gRPC target *without* the port (e.g., `dns:///svc-%d.ns.svc`) and use it for `TrillianService.Address` while keeping `TrillianService.Port` set.
 - Keep `randGrpcUrl` (with port) for `v1.ServiceReference.URL` fuzzing if desired.
- Alternatively, if you want `Address` to always include the port, then set `s.Port = nil` in the `TrillianService` fuzzer (but this contradicts the “defaulter always sets port” comment).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

3. Schemeless host URLs allowed 🐞 Bug ≡ Correctness ⭐ New

Description

The new TUF ServiceReference XValidation regexes allow URLs like //host:8080/path (hostname
present but scheme empty), but ResolveExternalServiceUrl treats any URL with a hostname as
complete and returns it unchanged, so TUF jobs can receive a schemeless URI string.

Code

api/v1/tuf_types.go[67]

+	//+kubebuilder:validation:XValidation:rule="!has(self.url) || size(self.url) == 0 || self.url.matches('^([a-zA-Z][a-zA-Z0-9+.-]*://[^/].*|//.+)$')",message="url must follow the pattern scheme://host[:port][/path] or //[:port][/path]"

Relevance

● Weak
PR #2126 intentionally added schemeless // URLs in CRD + conversion tests; pattern appears by
design.
PR-#2126

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The CRD/type validation now permits schemeless //... forms broadly. The resolver returns any
schemeless URL that still has a hostname without adding a scheme, and the TUF init job forwards the
resolved string as --*-uri arguments.
api/v1/tuf_types.go[61-76]
internal/utils/service_ref_resolver.go[50-58]
internal/utils/service_ref_resolver.go[73-85]
internal/controller/tuf/utils/tuf_init_job.go[24-61]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The updated XValidation patterns for TUF component URLs accept schemeless URLs with hostnames (e.g. `//host:8080/path`). The resolver (`ResolveExternalServiceUrl`) returns such URLs as-is when `Hostname() != ""`, meaning downstream code can receive a URL string with no scheme.

## Issue Context
The intended schemeless form for overrides appears to be hostless (port/path only) so the operator can merge the discovered scheme/host; permitting `//host...` bypasses that merge.

## Fix Focus Areas
- api/v1/tuf_types.go[63-75]
- internal/utils/service_ref_resolver.go[50-58]
- internal/utils/service_ref_resolver.go[73-85]
- config/crd/bases/rhtas.redhat.com_tufs.yaml[990-992]
- config/crd/bases/rhtas.redhat.com_securesigns.yaml[10732-10733]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. ~~Misleading fuzzer comment~~ ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The comment immediately above securesignStatusFuzzerFuncs incorrectly describes TrillianStatus
fuzzing, which is misleading for future maintenance of these fuzz constraints. This mismatch was
introduced by the refactor.

Code

api/v1alpha1/conversion_roundtrip_test.go[R313-316]

+// trillianStatusFuzzerFuncs clears v1alpha1 TrillianStatus fields that only exist in the
+// full spec types but not in the slim v1 status types (TrillianDBStatus, TrillianServiceStatus).
+func securesignStatusFuzzerFuncs(_ runtimeserializer.CodecFactory) []interface{} {
	return []interface{}{
-		func(s *rhtasv1.CTlog, c randfill.Continue) {

Relevance

●● Moderate
No direct history on fixing comment/function mismatches; team often accepts small maintenance
cleanups (e.g., formatting cleanup in #1436).
PR-#1436

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The function name and the comment subject do not match; the comment references TrillianStatus while
the function fuzzes SecuresignStatus URL fields.

api/v1alpha1/conversion_roundtrip_test.go[313-323]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The comment above `securesignStatusFuzzerFuncs` incorrectly refers to `trillianStatusFuzzerFuncs` and describes Trillian status fields.

### Issue Context
This appears to be a copy/paste artifact from the adjacent Trillian fuzzer.

### Fix Focus Areas
- api/v1alpha1/conversion_roundtrip_test.go[313-316]

### Suggested fix
Update the comment block to describe what `securesignStatusFuzzerFuncs` actually constrains (Securesign status URL fields and TSA path handling), or remove the misleading lines.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

Previous review results

Review updated until commit f0f3805

Results up to commit b272ef4 ⚖️ Balanced

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. ~~Double-port Trillian URL~~ ✓ Resolved 🐞 Bug ≡ Correctness

Description

trillianServiceFuzzerFuncs sets TrillianService.Address to a dns:///...:port string and also always
sets TrillianService.Port, so Convert_v1alpha1_TrillianService_To_v1_ServiceReference appends a
second port and produces malformed URLs like "dns:///svc.ns.svc:1234:5678". This violates the
fuzzer’s own constraints and reduces the correctness/usefulness of conversion fuzz coverage for
Trillian service references.

Code

api/v1alpha1/conversion_roundtrip_test.go[R122-128]

+		func(s *TrillianService, c randfill.Continue) {
+			c.FillNoCustom(s)
+			s.Address = randGrpcUrl(c)
+
+			// port is always set (defaulter)
+			s.Port = ptr.To(int32(c.Intn(65534) + 1))
+		},

Relevance

●●● Strong
Team previously accepted fixing malformed duplicated URL paths (#1723); similar double-port issue
discussed in service-ref work (#2114).
PR-#1723
PR-#2114

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The fuzzer assigns Address = randGrpcUrl(c) which includes a :<port> suffix, and also sets
Port. The conversion logic appends :<port> again whenever Port != nil, producing a double-port
URL string.
api/v1alpha1/conversion_roundtrip_test.go[55-59]
api/v1alpha1/conversion_roundtrip_test.go[113-128]
api/v1alpha1/conversion_overrides.go[95-101]
api/v1alpha1/common.go[51-62]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`trillianServiceFuzzerFuncs` generates a `v1alpha1.TrillianService` where `Address` already includes a port (`dns:///...:port`) and `Port` is also set. The production conversion code appends `Port` to `Address` when `Port != nil`, yielding malformed `ServiceReference.URL` values containing two port segments.

### Issue Context
- `randGrpcUrl` currently includes a port.
- `Convert_v1alpha1_TrillianService_To_v1_ServiceReference` appends `Port` to `Address`.
- The fuzzer should generate values consistent with this conversion contract (i.e., `Address` should not already include a `:<port>` suffix when `Port` is set).

### Fix Focus Areas
- api/v1alpha1/conversion_roundtrip_test.go[55-59]
- api/v1alpha1/conversion_roundtrip_test.go[113-129]

### Suggested fix
- Introduce a helper that generates a gRPC target *without* the port (e.g., `dns:///svc-%d.ns.svc`) and use it for `TrillianService.Address` while keeping `TrillianService.Port` set.
 - Keep `randGrpcUrl` (with port) for `v1.ServiceReference.URL` fuzzing if desired.
- Alternatively, if you want `Address` to always include the port, then set `s.Port = nil` in the `TrillianService` fuzzer (but this contradicts the “defaulter always sets port” comment).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. ~~Misleading fuzzer comment~~ ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The comment immediately above securesignStatusFuzzerFuncs incorrectly describes TrillianStatus
fuzzing, which is misleading for future maintenance of these fuzz constraints. This mismatch was
introduced by the refactor.

Code

api/v1alpha1/conversion_roundtrip_test.go[R313-316]

+// trillianStatusFuzzerFuncs clears v1alpha1 TrillianStatus fields that only exist in the
+// full spec types but not in the slim v1 status types (TrillianDBStatus, TrillianServiceStatus).
+func securesignStatusFuzzerFuncs(_ runtimeserializer.CodecFactory) []interface{} {
	return []interface{}{
-		func(s *rhtasv1.CTlog, c randfill.Continue) {

Relevance

●● Moderate
No direct history on fixing comment/function mismatches; team often accepts small maintenance
cleanups (e.g., formatting cleanup in #1436).
PR-#1436

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The function name and the comment subject do not match; the comment references TrillianStatus while
the function fuzzes SecuresignStatus URL fields.

api/v1alpha1/conversion_roundtrip_test.go[313-323]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The comment above `securesignStatusFuzzerFuncs` incorrectly refers to `trillianStatusFuzzerFuncs` and describes Trillian status fields.

### Issue Context
This appears to be a copy/paste artifact from the adjacent Trillian fuzzer.

### Fix Focus Areas
- api/v1alpha1/conversion_roundtrip_test.go[313-316]

### Suggested fix
Update the comment block to describe what `securesignStatusFuzzerFuncs` actually constrains (Securesign status URL fields and TSA path handling), or remove the misleading lines.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

serviceReferenceToAddressPort, splitURLPath, and buildURL dropped userinfo/query/fragment and mis-bracketed IPv6 hosts. Rebuilt on url.URL mutation and JoinPath instead of hand-assembled strings. Anchored the gRPC target port regex to end-of-string so it can't match a port in the resolver authority instead of the target. Added internal/testing/fuzzer with wider URL/host/port generators so round-trip fuzz tests exercise these paths. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

buildURL now produces //[:port][/path] when address is empty, preserving port and prefix through the v1alpha1↔v1 round-trip. Previously it dropped both, losing user configuration on upgrade. Relax TUF CEL validation to accept schemeless authority URIs alongside scheme://host URLs. Extract shared mergeURLs helper so both ResolveInternalServiceUrl and ResolveExternalServiceUrl merge user port/path overrides with the autodiscovered host. Switch tree action to ResolveInternalGrpcService for Trillian, matching the gRPC protocol Trillian actually uses. Remove unused objectMetaFuzzerFuncs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

osmman · 2026-08-03T16:58:49Z

/agentic_review

qodo-for-securesign · 2026-08-03T17:07:24Z

 	if err != nil {
 		return i.Error(ctx, fmt.Errorf("could not resolve trillian service: %w", err), instance)
 	}
+	trillUrl = fmt.Sprintf("%s:%s", trillHost, trillPort)


1. Admin_server trailing colon 🐞 Bug ≡ Correctness

Multiple call sites (the create-tree job and CTLog server config generation) build Trillian endpoints by always concatenating host and port with ":", so when the gRPC resolver returns an empty port for a portless user URL (e.g. dns:///custom-host), they produce malformed backend addresses ending in a trailing colon (e.g. dns:///custom-host:) that are then used as ADMIN_SERVER and written into CTLog config.

Agent Prompt

## Issue description The create-tree action (`internal/action/tree/action.go`) and CTLog server config generation (`internal/controller/ctlog/actions/server_config.go`) build Trillian endpoints with `fmt.Sprintf("%s:%s", host, port)` without guarding against an empty port, which can produce malformed addresses like `dns:///custom-host:` when the user supplies a portless URL and the resolver returns an empty `port`. ## Issue Context `ResolveInternalGrpcService` can return an empty `port` when the user provides a URL without a trailing `:port` (it returns early for a non-empty `userAddress`, yielding `(address, "")`), and gRPC resolution can legally result in an empty port in this case. The malformed concatenated endpoint is then propagated into critical configuration: the create-tree job receives it as `ADMIN_SERVER`, and CTLog server config writes it as the Trillian backend address used for CTLog config generation. Fixes should ensure callers don’t emit trailing-colon endpoints by either rejecting empty ports at call sites or adjusting `ResolveInternalGrpcService` to fall back to a resolved/default port when the user omits it. ## Fix Focus Areas - internal/action/tree/action.go[219-226] - internal/action/tree/action.go[381-404] - internal/controller/ctlog/actions/server_config.go[80-85] - internal/utils/service_ref_resolver.go[108-134]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

qodo-for-securesign · 2026-08-03T17:07:33Z

Code review by qodo was updated up to the latest commit f0f3805

bouskaJ force-pushed the fuzzer-improvements branch from b272ef4 to 67bd0a0 Compare July 30, 2026 11:56

github-actions Bot added the needs-rebase label Jul 30, 2026

bouskaJ force-pushed the fuzzer-improvements branch from 67bd0a0 to 3c67099 Compare July 30, 2026 15:02

bouskaJ requested a review from osmman July 30, 2026 15:03

github-actions Bot removed the needs-rebase label Jul 30, 2026

osmman reviewed Jul 31, 2026

View reviewed changes

Comment thread api/v1alpha1/conversion_roundtrip_test.go Outdated

osmman reviewed Jul 31, 2026

View reviewed changes

Comment thread api/v1alpha1/conversion_roundtrip_test.go Outdated

osmman reviewed Jul 31, 2026

View reviewed changes

Comment thread api/v1alpha1/conversion_roundtrip_test.go Outdated

bouskaJ force-pushed the fuzzer-improvements branch from 3c67099 to c971e11 Compare July 31, 2026 09:24

bouskaJ requested a review from osmman July 31, 2026 09:25

osmman reviewed Jul 31, 2026

View reviewed changes

Comment thread api/v1alpha1/conversion_roundtrip_test.go Outdated

osmman reviewed Jul 31, 2026

View reviewed changes

Comment thread api/v1alpha1/conversion_roundtrip_test.go Outdated

osmman reviewed Jul 31, 2026

View reviewed changes

Comment thread api/v1alpha1/conversion_roundtrip_test.go

refactor: improve fuzzers

534becf

bouskaJ force-pushed the fuzzer-improvements branch from c971e11 to 534becf Compare July 31, 2026 10:55

bouskaJ requested a review from osmman July 31, 2026 10:57

bouskaJ and others added 3 commits July 31, 2026 16:41

fix: allow path/port without host

505710a

osmman force-pushed the fuzzer-improvements branch from b0d5a41 to f0f3805 Compare August 3, 2026 16:43

qodo-for-securesign Bot reviewed Aug 3, 2026

View reviewed changes

osmman merged commit 9ed7a4b into main Aug 3, 2026
28 of 34 checks passed

osmman deleted the fuzzer-improvements branch August 3, 2026 18:05

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor: improve fuzzers - #2173

refactor: improve fuzzers#2173
osmman merged 4 commits into
mainfrom
fuzzer-improvements

bouskaJ commented Jul 30, 2026

Uh oh!

bouskaJ commented Jul 30, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 30, 2026

Uh oh!

codecov-commenter commented Jul 30, 2026 •

edited

Loading

Uh oh!

qodo-for-securesign Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

osmman commented Aug 3, 2026

Uh oh!

qodo-for-securesign Bot Aug 3, 2026

Uh oh!

qodo-for-securesign Bot commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

bouskaJ commented Jul 30, 2026

Uh oh!

bouskaJ commented Jul 30, 2026

Uh oh!

qodo-for-securesign Bot commented Jul 30, 2026

PR Summary by Qodo

Uh oh!

codecov-commenter commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

qodo-for-securesign Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Previous review results

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

osmman commented Aug 3, 2026

Uh oh!

qodo-for-securesign Bot Aug 3, 2026

Choose a reason for hiding this comment

Uh oh!

qodo-for-securesign Bot commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov-commenter commented Jul 30, 2026 •

edited

Loading

qodo-for-securesign Bot commented Jul 30, 2026 •

edited

Loading