ci: run the redaction fuzz targets on a weekly schedule

[KARTIKrocks]

User description

Summary

FuzzRedact was never run by any workflow: under go test a fuzz target only replays its seed corpus, so the guard on the literal lexer read as covered and did nothing beyond its seeds.

• New Fuzz workflow runs FuzzRedact and a new FuzzIsMultiStatement weekly (Monday 03:00 UTC) and on workflow_dispatch, with a fuzztime input defaulting to 10m. Each target is its own matrix job. A crasher is uploaded as an artifact; committing it under analyzer/testdata/fuzz/<target>/ makes make test replay it from then on.
• FuzzIsMultiStatement covers the fail-closed side of the lexer, the one that keeps a smuggled statement away from the EXPLAIN transaction: with no byte that can open a literal or comment, a ; followed by more text must be reported.
• CONTRIBUTING.md documents the local fuzz command and how to commit a crasher; CHANGELOG.md has an Added entry.

Closes #83

Type of change

• Bug fix
• New detection rule
• New integration / parser
• Feature / enhancement
• Docs only
• Refactor / chore

Checklist

• make ci passes (fmt-check, vet, lint, vuln, test-race, lint-docs) across all modules
• Added/updated tests (and, where practical, a failure-mode check)
• Updated docs under website/docs/ with a version marker for anything new (n/a: no public API or documented behaviour change)
• Updated AGENTS.md / .sqlguard.example.yml if a convention or config key changed (n/a: no convention changed)
• Added an entry under ## [Unreleased] in CHANGELOG.md
• No new third-party deps in analyzer / middleware / reporter
• Findings stay redaction-safe (no raw literals leak into a Result)

Notes for reviewers

• Both targets ran locally with no crashes: FuzzRedact for 90s (about 17M executions) and FuzzIsMultiStatement for 60s (about 14M). The workflow itself has not run on GitHub yet; trigger it once from the Actions tab after merge.
• FuzzIsMultiStatement only asserts its property on input with no quote, $, comment or * bytes. The $$ and backslash dual-reading cases stay pinned by TestIsMultiStatementNeedsBothReadings and the seeds; fuzzing them would need an independent second lexer to compare against.
• FuzzRedact checks span well-formedness, not that no literal byte survives in the output; that needs an oracle that knows where the literals are.
• Not done: persisting the fuzz corpus between runs, and opening an issue automatically when a scheduled run fails.

---

CodeAnt-AI Description

Run scheduled fuzz tests for SQL redaction and statement detection

What Changed

• A weekly workflow fuzzes SQL redaction and multi-statement detection, with an option to run it manually.
• Fuzz failures upload crash cases so they can be added to the test suite and replayed in future test runs.
• Contributors can run the fuzz tests locally and find instructions for saving crash cases.

Impact

✅ Earlier detection of SQL redaction crashes
✅ Earlier detection of multi-statement handling errors
✅ Reproducible fuzz failures in future tests

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	0a7d98c	Oct 14, 2026 · 06:19	06:22

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: KARTIKrocks/sqlguard/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 882d129b-4019-4c11-bda9-167ddc4c8962

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit: b8919661
Scan Time: 2026-10-14 06:25:26 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
SAST	✅ PASSED	No security issues
SCA (Dependencies)	✅ PASSED	Rating S: No vulnerabilities

View Full Results

[codeant-ai]

CodeAnt PR Risk: Medium Risk

• The PR needs attention before merging because the new fuzz workflow may be rejected as invalid.
• The workflow_dispatch input is missing a type, which may prevent both manual and scheduled fuzz runs from executing.

Assessed commit: 0a7d98c041fe