CI/CD Integration with Ephemeral Deployment Model (#14)

* feat: Complete migration from Prefect to Temporal

BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal

## Major Changes
- Replace Prefect with Temporal for workflow orchestration
- Implement vertical worker architecture (rust, android)
- Replace Docker registry with MinIO for unified storage
- Refactor activities to be co-located with workflows
- Update all API endpoints for Temporal compatibility

## Infrastructure
- New: docker-compose.temporal.yaml (Temporal + MinIO + workers)
- New: workers/ directory with rust and android vertical workers
- New: backend/src/temporal/ (manager, discovery)
- New: backend/src/storage/ (S3-cached storage with MinIO)
- New: backend/toolbox/common/ (shared storage activities)
- Deleted: docker-compose.yaml (old Prefect setup)
- Deleted: backend/src/core/prefect_manager.py
- Deleted: backend/src/services/prefect_stats_monitor.py
- Deleted: Docker registry and insecure-registries requirement

## Workflows
- Migrated: security_assessment workflow to Temporal
- New: rust_test workflow (example/test workflow)
- Deleted: secret_detection_scan (Prefect-based, to be reimplemented)
- Activities now co-located with workflows for independent testing

## API Changes
- Updated: backend/src/api/workflows.py (Temporal submission)
- Updated: backend/src/api/runs.py (Temporal status/results)
- Updated: backend/src/main.py (727 lines, TemporalManager integration)
- Updated: All 16 MCP tools to use TemporalManager

## Testing
- ✅ All services healthy (Temporal, PostgreSQL, MinIO, workers, backend)
- ✅ All API endpoints functional
- ✅ End-to-end workflow test passed (72 findings from vulnerable_app)
- ✅ MinIO storage integration working (target upload/download, results)
- ✅ Worker activity discovery working (6 activities registered)
- ✅ Tarball extraction working
- ✅ SARIF report generation working

## Documentation
- ARCHITECTURE.md: Complete Temporal architecture documentation
- QUICKSTART_TEMPORAL.md: Getting started guide
- MIGRATION_DECISION.md: Why we chose Temporal over Prefect
- IMPLEMENTATION_STATUS.md: Migration progress tracking
- workers/README.md: Worker development guide

## Dependencies
- Added: temporalio>=1.6.0
- Added: boto3>=1.34.0 (MinIO S3 client)
- Removed: prefect>=3.4.18

* feat: Add Python fuzzing vertical with Atheris integration

This commit implements a complete Python fuzzing workflow using Atheris:

## Python Worker (workers/python/)
- Dockerfile with Python 3.11, Atheris, and build tools
- Generic worker.py for dynamic workflow discovery
- requirements.txt with temporalio, boto3, atheris dependencies
- Added to docker-compose.temporal.yaml with dedicated cache volume

## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/)
- Reusable module extending BaseModule
- Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py)
- Recursive search to find targets in nested directories
- Dynamically loads TestOneInput() function
- Configurable max_iterations and timeout
- Real-time stats callback support for live monitoring
- Returns findings as ModuleFinding objects

## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/)
- Temporal workflow for orchestrating fuzzing
- Downloads user code from MinIO
- Executes AtherisFuzzer module
- Uploads results to MinIO
- Cleans up cache after execution
- metadata.yaml with vertical: python for routing

## Test Project (test_projects/python_fuzz_waterfall/)
- Demonstrates stateful waterfall vulnerability
- main.py with check_secret() that leaks progress
- fuzz_target.py with Atheris TestOneInput() harness
- Complete README with usage instructions

## Backend Fixes
- Fixed parameter merging in REST API endpoints (workflows.py)
- Changed workflow parameter passing from positional args to kwargs (manager.py)
- Default parameters now properly merged with user parameters

## Testing
✅ Worker discovered AtherisFuzzingWorkflow
✅ Workflow executed end-to-end successfully
✅ Fuzz target auto-discovered in nested directories
✅ Atheris ran 100,000 iterations
✅ Results uploaded and cache cleaned

* chore: Complete Temporal migration with updated CLI/SDK/docs

This commit includes all remaining Temporal migration changes:

## CLI Updates (cli/)
- Updated workflow execution commands for Temporal
- Enhanced error handling and exceptions
- Updated dependencies in uv.lock

## SDK Updates (sdk/)
- Client methods updated for Temporal workflows
- Updated models for new workflow execution
- Updated dependencies in uv.lock

## Documentation Updates (docs/)
- Architecture documentation for Temporal
- Workflow concept documentation
- Resource management documentation (new)
- Debugging guide (new)
- Updated tutorials and how-to guides
- Troubleshooting updates

## README Updates
- Main README with Temporal instructions
- Backend README
- CLI README
- SDK README

## Other
- Updated IMPLEMENTATION_STATUS.md
- Removed old vulnerable_app.tar.gz

These changes complete the Temporal migration and ensure the
CLI/SDK work correctly with the new backend.

* fix: Use positional args instead of kwargs for Temporal workflows

The Temporal Python SDK's start_workflow() method doesn't accept
a 'kwargs' parameter. Workflows must receive parameters as positional
arguments via the 'args' parameter.

Changed from:
  args=workflow_args  # Positional arguments

This fixes the error:
  TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs'

Workflows now correctly receive parameters in order:
- security_assessment: [target_id, scanner_config, analyzer_config, reporter_config]
- atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds]
- rust_test: [target_id, test_message]

* fix: Filter metadata-only parameters from workflow arguments

SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5.
The issue was that target_path and volume_mode from default_parameters
were being passed to the workflow, when they should only be used by
the system for configuration.

Now filters out metadata-only parameters (target_path, volume_mode)
before passing arguments to workflow execution.

* refactor: Remove Prefect leftovers and volume mounting legacy

Complete cleanup of Prefect migration artifacts:

Backend:
- Delete registry.py and workflow_discovery.py (Prefect-specific files)
- Remove Docker validation from setup.py (no longer needed)
- Remove ResourceLimits and VolumeMount models
- Remove target_path and volume_mode from WorkflowSubmission
- Remove supported_volume_modes from API and discovery
- Clean up metadata.yaml files (remove volume/path fields)
- Simplify parameter filtering in manager.py

SDK:
- Remove volume_mode parameter from client methods
- Remove ResourceLimits and VolumeMount models
- Remove Prefect error patterns from docker_logs.py
- Clean up WorkflowSubmission and WorkflowMetadata models

CLI:
- Remove Volume Modes display from workflow info

All removed features are Prefect-specific or Docker volume mounting
artifacts. Temporal workflows use MinIO storage exclusively.

* feat: Add comprehensive test suite and benchmark infrastructure

- Add 68 unit tests for fuzzer, scanner, and analyzer modules
- Implement pytest-based test infrastructure with fixtures
- Add 6 performance benchmarks with category-specific thresholds
- Configure GitHub Actions for automated testing and benchmarking
- Add test and benchmark documentation

Test coverage:
- AtherisFuzzer: 8 tests
- CargoFuzzer: 14 tests
- FileScanner: 22 tests
- SecurityAnalyzer: 24 tests

All tests passing (68/68)
All benchmarks passing (6/6)

* fix: Resolve all ruff linting violations across codebase

Fixed 27 ruff violations in 12 files:
- Removed unused imports (Depends, Dict, Any, Optional, etc.)
- Fixed undefined workflow_info variable in workflows.py
- Removed dead code with undefined variables in atheris_fuzzer.py
- Changed f-string to regular string where no placeholders used

All files now pass ruff checks for CI/CD compliance.

* fix: Configure CI for unit tests only

- Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility
- Commented out integration-tests job (no integration tests yet)
- Updated test-summary to only depend on lint and unit-tests

CI will now run successfully with 68 unit tests. Integration tests can be added later.

* feat: Add CI/CD integration with ephemeral deployment model

Implements comprehensive CI/CD support for FuzzForge with on-demand worker management:

**Worker Management (v0.7.0)**
- Add WorkerManager for automatic worker lifecycle control
- Auto-start workers from stopped state when workflows execute
- Auto-stop workers after workflow completion
- Health checks and startup timeout handling (90s default)

**CI/CD Features**
- `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info)
- `--export-sarif` flag: Export findings in SARIF 2.1.0 format
- `--auto-start`/`--auto-stop` flags: Control worker lifecycle
- Exit code propagation: Returns 1 on blocking findings, 0 on success

**Exit Code Fix**
- Add `except typer.Exit: raise` handlers at 3 critical locations
- Move worker cleanup to finally block for guaranteed execution
- Exit codes now propagate correctly even when build fails

**CI Scripts & Examples**
- ci-start.sh: Start FuzzForge services with health checks
- ci-stop.sh: Clean shutdown with volume preservation option
- GitHub Actions workflow example (security-scan.yml)
- GitLab CI pipeline example (.gitlab-ci.example.yml)
- docker-compose.ci.yml: CI-optimized compose file with profiles

**OSS-Fuzz Integration**
- New ossfuzz_campaign workflow for running OSS-Fuzz projects
- OSS-Fuzz worker with Docker-in-Docker support
- Configurable campaign duration and project selection

**Documentation**
- Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md)
- Updated architecture docs with worker lifecycle details
- Updated workspace isolation documentation
- CLI README with worker management examples

**SDK Enhancements**
- Add get_workflow_worker_info() endpoint
- Worker vertical metadata in workflow responses

**Testing**
- All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing
- All monitoring commands tested: stats, crashes, status, finding
- Full CI pipeline simulation verified
- Exit codes verified for success/failure scenarios

Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers.

* fix: Resolve ruff linting violations in CI/CD code

- Remove unused variables (run_id, defaults, result)
- Remove unused imports
- Fix f-string without placeholders

All CI/CD integration files now pass ruff checks.

ai/src/fuzzforge_ai/__main__.py

@@ -78,7 +78,7 @@ def create_a2a_app():
     print("\033[0m")  # Reset color
     
     # Create A2A app
-    print(f"🚀 Starting FuzzForge A2A Server")
+    print("🚀 Starting FuzzForge A2A Server")
     print(f"   Model: {fuzzforge.model}")
     if fuzzforge.cognee_url:
         print(f"   Memory: Cognee at {fuzzforge.cognee_url}")
@@ -86,7 +86,7 @@ def create_a2a_app():
     
     app = create_custom_a2a_app(fuzzforge.adk_agent, port=port, executor=fuzzforge.executor)
     
-    print(f"\n✅ FuzzForge A2A Server ready!")
+    print("\n✅ FuzzForge A2A Server ready!")
     print(f"   Agent card: http://localhost:{port}/.well-known/agent-card.json")
     print(f"   A2A endpoint: http://localhost:{port}/")
     print(f"\n📡 Other agents can register FuzzForge at: http://localhost:{port}")
@@ -101,7 +101,7 @@ def main():
     app = create_a2a_app()
     port = int(os.getenv('FUZZFORGE_PORT', 10100))
 
-    print(f"\n🎯 Starting server with uvicorn...")
+    print("\n🎯 Starting server with uvicorn...")
     uvicorn.run(app, host="127.0.0.1", port=port)
 
 

ai/src/fuzzforge_ai/a2a_server.py

@@ -18,7 +18,6 @@ from typing import Optional, Union
 
 from starlette.applications import Starlette
 from starlette.responses import Response, FileResponse
-from starlette.routing import Route
 
 from google.adk.a2a.executor.a2a_agent_executor import A2aAgentExecutor
 from google.adk.a2a.utils.agent_card_builder import AgentCardBuilder

ai/src/fuzzforge_ai/agent_card.py

@@ -15,7 +15,7 @@ Defines what FuzzForge can do and how others can discover it
 
 
 from dataclasses import dataclass
-from typing import List, Optional, Dict, Any
+from typing import List, Dict, Any
 
 @dataclass
 class AgentSkill:

ai/src/fuzzforge_ai/agent_executor.py

@@ -12,7 +12,6 @@
 
 
 import asyncio
-import base64
 import time
 import uuid
 import json
@@ -392,7 +391,7 @@ class FuzzForgeExecutor:
                     user_email = f"project_{config.get_project_context()['project_id']}@fuzzforge.example"
                     user = await get_user(user_email)
                     cognee.set_user(user)
-                except Exception as e:
+                except Exception:
                     pass  # User context not critical
                 
                 # Use cognee search directly for maximum flexibility
@@ -583,7 +582,6 @@ class FuzzForgeExecutor:
                 pattern: Glob pattern (e.g. '*.py', '**/*.js', '') 
             """
             try:
-                from pathlib import Path
 
                 # Get project root from config
                 config = ProjectConfigManager()
@@ -648,7 +646,6 @@ class FuzzForgeExecutor:
                 max_lines: Maximum lines to read (0 for all, default 200 for large files)
             """
             try:
-                from pathlib import Path
 
                 # Get project root from config
                 config = ProjectConfigManager()
@@ -711,7 +708,6 @@ class FuzzForgeExecutor:
             """
             try:
                 import re
-                from pathlib import Path
 
                 # Get project root from config
                 config = ProjectConfigManager()
@@ -757,7 +753,7 @@ class FuzzForgeExecutor:
                     result = f"Found '{search_pattern}' in {len(matches)} locations (searched {files_searched} files):\n"
                     result += "\n".join(matches[:50])
                     if len(matches) >= 50:
-                        result += f"\n... (showing first 50 matches)"
+                        result += "\n... (showing first 50 matches)"
                     return result
                 else:
                     return f"No matches found for '{search_pattern}' in {files_searched} files matching '{file_pattern}'"
@@ -1088,7 +1084,7 @@ class FuzzForgeExecutor:
         
     def _build_instruction(self) -> str:
         """Build the agent's instruction prompt"""
-        instruction = f"""You are FuzzForge, an intelligent A2A orchestrator with dual memory systems.
+        instruction = """You are FuzzForge, an intelligent A2A orchestrator with dual memory systems.
 
 ## Your Core Responsibilities:
 

ai/src/fuzzforge_ai/cli.py

@@ -26,7 +26,6 @@ import random
 from datetime import datetime
 from contextlib import contextmanager
 from pathlib import Path
-from typing import Any
 
 from dotenv import load_dotenv
 
@@ -90,18 +89,12 @@ except ImportError:
 from rich.console import Console
 from rich.table import Table
 from rich.panel import Panel
-from rich.prompt import Prompt
 from rich import box
 
-from google.adk.events.event import Event
-from google.adk.events.event_actions import EventActions
-from google.genai import types as gen_types
 
 from .agent import FuzzForgeAgent
-from .agent_card import get_fuzzforge_agent_card
 from .config_manager import ConfigManager
 from .config_bridge import ProjectConfigManager
-from .remote_agent import RemoteAgentConnection
 
 console = Console()
 
@@ -243,7 +236,7 @@ class FuzzForgeCLI:
             )
         )
         if self.agent.executor.agentops_trace:
-            console.print(f"Tracking: [medium_purple1]AgentOps active[/medium_purple1]")
+            console.print("Tracking: [medium_purple1]AgentOps active[/medium_purple1]")
 
         # Show skills
         console.print("\nSkills:")
@@ -320,7 +313,7 @@ class FuzzForgeCLI:
                 url=args.strip(),
                 description=description
             )
-            console.print(f"   [dim]Saved to config for auto-registration[/dim]")
+            console.print("   [dim]Saved to config for auto-registration[/dim]")
         else:
             console.print(f"[red]Failed: {result['error']}[/red]")
             
@@ -346,9 +339,9 @@ class FuzzForgeCLI:
         # Remove from config
         if self.config_manager.remove_registered_agent(name=agent_to_remove['name'], url=agent_to_remove['url']):
             console.print(f"✅ Unregistered: [bold]{agent_to_remove['name']}[/bold]")
-            console.print(f"   [dim]Removed from config (won't auto-register next time)[/dim]")
+            console.print("   [dim]Removed from config (won't auto-register next time)[/dim]")
         else:
-            console.print(f"[yellow]Agent unregistered from session but not found in config[/yellow]")
+            console.print("[yellow]Agent unregistered from session but not found in config[/yellow]")
     
     async def cmd_list(self, args: str = "") -> None:
         """List registered agents"""
@@ -699,7 +692,7 @@ class FuzzForgeCLI:
         )
         
         console.print(table)
-        console.print(f"\n[dim]Use /artifacts <id> to view artifact content[/dim]")
+        console.print("\n[dim]Use /artifacts <id> to view artifact content[/dim]")
 
     async def cmd_tasks(self, args: str = "") -> None:
         """List tasks or show details for a specific task."""

ai/src/fuzzforge_ai/cognee_integration.py

@@ -16,9 +16,7 @@ Can be reused by external agents and other components
 
 
 import os
-import asyncio
-import json
-from typing import Dict, List, Any, Optional, Union
+from typing import Dict, Any, Optional
 from pathlib import Path
 
 

ai/src/fuzzforge_ai/cognee_service.py

@@ -15,11 +15,9 @@ Provides integrated Cognee functionality for codebase analysis and knowledge gra
 
 
 import os
-import asyncio
 import logging
 from pathlib import Path
-from typing import Dict, List, Any, Optional
-from datetime import datetime
+from typing import Dict, List, Any
 
 logger = logging.getLogger(__name__)
 

ai/src/fuzzforge_ai/config_bridge.py

@@ -13,7 +13,7 @@
 
 try:
     from fuzzforge_cli.config import ProjectConfigManager as _ProjectConfigManager
-except ImportError as exc:  # pragma: no cover - used when CLI not available
+except ImportError:  # pragma: no cover - used when CLI not available
     class _ProjectConfigManager:  # type: ignore[no-redef]
         """Fallback implementation that raises a helpful error."""
 

ai/src/fuzzforge_ai/memory_service.py

@@ -16,15 +16,12 @@ Separate from Cognee which will be used for RAG/codebase analysis
 
 
 import os
-import json
-from typing import Dict, List, Any, Optional
-from datetime import datetime
+from typing import Dict, Any
 import logging
 
 # ADK Memory imports
 from google.adk.memory import InMemoryMemoryService, BaseMemoryService
 from google.adk.memory.base_memory_service import SearchMemoryResponse
-from google.adk.memory.memory_entry import MemoryEntry
 
 # Optional VertexAI Memory Bank
 try: