Patrick Ventuzelo
2edcc40cea
Revise README for manual workflow and support info
...
Updated README to include manual workflow setup and support project section.
2025-10-16 22:31:22 +02:00
tduhamel42
73ba98afa8
docs: Add Secret Detection Benchmarks section with performance metrics
...
- Added dedicated section showcasing secret detection benchmark results
- Includes comparison table with recall rates and speeds
- Links to detailed benchmark analysis
- Highlights LLM detector's 84.4% recall on obfuscated secrets
2025-10-16 14:05:05 +02:00
tduhamel42
3f133374d5
docs: Add development status warning for fuzzing workflows
...
- Added note that fuzzing workflows are in early development
- Fixed Fuzzer Integration feature to list actual workflows only
- Clarified OSS-Fuzz integration is under heavy development
- Listed stable workflows for production use
2025-10-16 14:00:32 +02:00
tduhamel42
28ad4468de
Merge branch 'master' into dev for v0.7.0 release
...
Resolved conflicts:
- Kept monitor.py (dev version - required for live monitoring)
- Kept workflow_exec.py (dev version - includes worker management, --live, --fail-on, --export-sarif)
- Kept main.py (dev version - includes new command structure)
All conflicts resolved in favor of dev branch features for 0.7.0 release.
2025-10-16 12:32:25 +02:00
tduhamel42
746699e7c0
chore: Bump version to 0.7.0
...
Version updates:
- README.md badge: 0.6.0 → 0.7.0
- cli/pyproject.toml: 0.6.0 → 0.7.0
- backend/pyproject.toml: 0.6.0 → 0.7.0
- sdk/pyproject.toml: 0.6.0 → 0.7.0
- ai/pyproject.toml: 0.6.0 → 0.7.0
Add CHANGELOG.md with comprehensive release notes for 0.7.0:
- Secret detection workflows (gitleaks, trufflehog, llm_secret_detection)
- AI module and agent integration
- Temporal migration completion
- CI/CD integration
- Documentation updates
- Bug fixes and improvements
Update llm_analysis default model to gpt-5-mini
2025-10-16 12:23:56 +02:00
tduhamel42
8063f03d87
docs: Update README and fix worker startup instructions
...
README updates:
- Update docker compose command (now main docker-compose.yml)
- Remove obsolete insecure registries section (MinIO replaces local registry)
- Add .env configuration section for AI agent API keys
Worker management fixes:
- Add worker_service field to API response (backend)
- Fix CLI help message to use correct service name with 'docker compose up -d'
- Use modern 'docker compose' syntax instead of deprecated 'docker-compose'
This ensures users get correct instructions when workers aren't running.
2025-10-16 12:12:49 +02:00
tduhamel42
60ca088ecf
CI/CD Integration with Ephemeral Deployment Model ( #14 )
...
* feat: Complete migration from Prefect to Temporal
BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal
## Major Changes
- Replace Prefect with Temporal for workflow orchestration
- Implement vertical worker architecture (rust, android)
- Replace Docker registry with MinIO for unified storage
- Refactor activities to be co-located with workflows
- Update all API endpoints for Temporal compatibility
## Infrastructure
- New: docker-compose.temporal.yaml (Temporal + MinIO + workers)
- New: workers/ directory with rust and android vertical workers
- New: backend/src/temporal/ (manager, discovery)
- New: backend/src/storage/ (S3-cached storage with MinIO)
- New: backend/toolbox/common/ (shared storage activities)
- Deleted: docker-compose.yaml (old Prefect setup)
- Deleted: backend/src/core/prefect_manager.py
- Deleted: backend/src/services/prefect_stats_monitor.py
- Deleted: Docker registry and insecure-registries requirement
## Workflows
- Migrated: security_assessment workflow to Temporal
- New: rust_test workflow (example/test workflow)
- Deleted: secret_detection_scan (Prefect-based, to be reimplemented)
- Activities now co-located with workflows for independent testing
## API Changes
- Updated: backend/src/api/workflows.py (Temporal submission)
- Updated: backend/src/api/runs.py (Temporal status/results)
- Updated: backend/src/main.py (727 lines, TemporalManager integration)
- Updated: All 16 MCP tools to use TemporalManager
## Testing
- ✅ All services healthy (Temporal, PostgreSQL, MinIO, workers, backend)
- ✅ All API endpoints functional
- ✅ End-to-end workflow test passed (72 findings from vulnerable_app)
- ✅ MinIO storage integration working (target upload/download, results)
- ✅ Worker activity discovery working (6 activities registered)
- ✅ Tarball extraction working
- ✅ SARIF report generation working
## Documentation
- ARCHITECTURE.md: Complete Temporal architecture documentation
- QUICKSTART_TEMPORAL.md: Getting started guide
- MIGRATION_DECISION.md: Why we chose Temporal over Prefect
- IMPLEMENTATION_STATUS.md: Migration progress tracking
- workers/README.md: Worker development guide
## Dependencies
- Added: temporalio>=1.6.0
- Added: boto3>=1.34.0 (MinIO S3 client)
- Removed: prefect>=3.4.18
* feat: Add Python fuzzing vertical with Atheris integration
This commit implements a complete Python fuzzing workflow using Atheris:
## Python Worker (workers/python/)
- Dockerfile with Python 3.11, Atheris, and build tools
- Generic worker.py for dynamic workflow discovery
- requirements.txt with temporalio, boto3, atheris dependencies
- Added to docker-compose.temporal.yaml with dedicated cache volume
## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/)
- Reusable module extending BaseModule
- Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py)
- Recursive search to find targets in nested directories
- Dynamically loads TestOneInput() function
- Configurable max_iterations and timeout
- Real-time stats callback support for live monitoring
- Returns findings as ModuleFinding objects
## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/)
- Temporal workflow for orchestrating fuzzing
- Downloads user code from MinIO
- Executes AtherisFuzzer module
- Uploads results to MinIO
- Cleans up cache after execution
- metadata.yaml with vertical: python for routing
## Test Project (test_projects/python_fuzz_waterfall/)
- Demonstrates stateful waterfall vulnerability
- main.py with check_secret() that leaks progress
- fuzz_target.py with Atheris TestOneInput() harness
- Complete README with usage instructions
## Backend Fixes
- Fixed parameter merging in REST API endpoints (workflows.py)
- Changed workflow parameter passing from positional args to kwargs (manager.py)
- Default parameters now properly merged with user parameters
## Testing
✅ Worker discovered AtherisFuzzingWorkflow
✅ Workflow executed end-to-end successfully
✅ Fuzz target auto-discovered in nested directories
✅ Atheris ran 100,000 iterations
✅ Results uploaded and cache cleaned
* chore: Complete Temporal migration with updated CLI/SDK/docs
This commit includes all remaining Temporal migration changes:
## CLI Updates (cli/)
- Updated workflow execution commands for Temporal
- Enhanced error handling and exceptions
- Updated dependencies in uv.lock
## SDK Updates (sdk/)
- Client methods updated for Temporal workflows
- Updated models for new workflow execution
- Updated dependencies in uv.lock
## Documentation Updates (docs/)
- Architecture documentation for Temporal
- Workflow concept documentation
- Resource management documentation (new)
- Debugging guide (new)
- Updated tutorials and how-to guides
- Troubleshooting updates
## README Updates
- Main README with Temporal instructions
- Backend README
- CLI README
- SDK README
## Other
- Updated IMPLEMENTATION_STATUS.md
- Removed old vulnerable_app.tar.gz
These changes complete the Temporal migration and ensure the
CLI/SDK work correctly with the new backend.
* fix: Use positional args instead of kwargs for Temporal workflows
The Temporal Python SDK's start_workflow() method doesn't accept
a 'kwargs' parameter. Workflows must receive parameters as positional
arguments via the 'args' parameter.
Changed from:
args=workflow_args # Positional arguments
This fixes the error:
TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs'
Workflows now correctly receive parameters in order:
- security_assessment: [target_id, scanner_config, analyzer_config, reporter_config]
- atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds]
- rust_test: [target_id, test_message]
* fix: Filter metadata-only parameters from workflow arguments
SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5.
The issue was that target_path and volume_mode from default_parameters
were being passed to the workflow, when they should only be used by
the system for configuration.
Now filters out metadata-only parameters (target_path, volume_mode)
before passing arguments to workflow execution.
* refactor: Remove Prefect leftovers and volume mounting legacy
Complete cleanup of Prefect migration artifacts:
Backend:
- Delete registry.py and workflow_discovery.py (Prefect-specific files)
- Remove Docker validation from setup.py (no longer needed)
- Remove ResourceLimits and VolumeMount models
- Remove target_path and volume_mode from WorkflowSubmission
- Remove supported_volume_modes from API and discovery
- Clean up metadata.yaml files (remove volume/path fields)
- Simplify parameter filtering in manager.py
SDK:
- Remove volume_mode parameter from client methods
- Remove ResourceLimits and VolumeMount models
- Remove Prefect error patterns from docker_logs.py
- Clean up WorkflowSubmission and WorkflowMetadata models
CLI:
- Remove Volume Modes display from workflow info
All removed features are Prefect-specific or Docker volume mounting
artifacts. Temporal workflows use MinIO storage exclusively.
* feat: Add comprehensive test suite and benchmark infrastructure
- Add 68 unit tests for fuzzer, scanner, and analyzer modules
- Implement pytest-based test infrastructure with fixtures
- Add 6 performance benchmarks with category-specific thresholds
- Configure GitHub Actions for automated testing and benchmarking
- Add test and benchmark documentation
Test coverage:
- AtherisFuzzer: 8 tests
- CargoFuzzer: 14 tests
- FileScanner: 22 tests
- SecurityAnalyzer: 24 tests
All tests passing (68/68)
All benchmarks passing (6/6)
* fix: Resolve all ruff linting violations across codebase
Fixed 27 ruff violations in 12 files:
- Removed unused imports (Depends, Dict, Any, Optional, etc.)
- Fixed undefined workflow_info variable in workflows.py
- Removed dead code with undefined variables in atheris_fuzzer.py
- Changed f-string to regular string where no placeholders used
All files now pass ruff checks for CI/CD compliance.
* fix: Configure CI for unit tests only
- Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility
- Commented out integration-tests job (no integration tests yet)
- Updated test-summary to only depend on lint and unit-tests
CI will now run successfully with 68 unit tests. Integration tests can be added later.
* feat: Add CI/CD integration with ephemeral deployment model
Implements comprehensive CI/CD support for FuzzForge with on-demand worker management:
**Worker Management (v0.7.0)**
- Add WorkerManager for automatic worker lifecycle control
- Auto-start workers from stopped state when workflows execute
- Auto-stop workers after workflow completion
- Health checks and startup timeout handling (90s default)
**CI/CD Features**
- `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info)
- `--export-sarif` flag: Export findings in SARIF 2.1.0 format
- `--auto-start`/`--auto-stop` flags: Control worker lifecycle
- Exit code propagation: Returns 1 on blocking findings, 0 on success
**Exit Code Fix**
- Add `except typer.Exit: raise` handlers at 3 critical locations
- Move worker cleanup to finally block for guaranteed execution
- Exit codes now propagate correctly even when build fails
**CI Scripts & Examples**
- ci-start.sh: Start FuzzForge services with health checks
- ci-stop.sh: Clean shutdown with volume preservation option
- GitHub Actions workflow example (security-scan.yml)
- GitLab CI pipeline example (.gitlab-ci.example.yml)
- docker-compose.ci.yml: CI-optimized compose file with profiles
**OSS-Fuzz Integration**
- New ossfuzz_campaign workflow for running OSS-Fuzz projects
- OSS-Fuzz worker with Docker-in-Docker support
- Configurable campaign duration and project selection
**Documentation**
- Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md)
- Updated architecture docs with worker lifecycle details
- Updated workspace isolation documentation
- CLI README with worker management examples
**SDK Enhancements**
- Add get_workflow_worker_info() endpoint
- Worker vertical metadata in workflow responses
**Testing**
- All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing
- All monitoring commands tested: stats, crashes, status, finding
- Full CI pipeline simulation verified
- Exit codes verified for success/failure scenarios
Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers.
* fix: Resolve ruff linting violations in CI/CD code
- Remove unused variables (run_id, defaults, result)
- Remove unused imports
- Fix f-string without placeholders
All CI/CD integration files now pass ruff checks.
2025-10-14 10:13:45 +02:00
abel
4ad44332ee
docs: updated discord invite link
2025-10-06 11:59:28 +02:00
Tanguy Duhamel
987c49569c
Merge branch 'master' of github.com:FuzzingLabs/fuzzforge_ai
2025-10-01 10:16:43 +02:00
Tanguy Duhamel
dd0a80252d
Update readme with insecure registries
2025-10-01 10:16:33 +02:00
Tomás Grüner
ad4c837866
docs(readme): fix repo name in git clone command
2025-09-30 19:04:59 -03:00
abel
5dd470f6e0
fix: update documentation links to new domain
2025-09-30 16:06:09 +02:00
Patrick Ventuzelo
f3c9964856
Update README.md
...
add roadmap link
2025-09-30 13:55:20 +02:00
Patrick Ventuzelo
ec11c11f0e
Update README.md
...
remove logo website
2025-09-30 13:52:24 +02:00
tduhamel42
1dde5f54b7
Update README.md
2025-09-30 13:51:23 +02:00
Patrick Ventuzelo
d00ac7574c
Update README.md
...
fix github star button
2025-09-30 13:50:05 +02:00
tduhamel42
4ea38570fd
Update README.md
2025-09-30 13:45:47 +02:00
Patrick Ventuzelo
4b5326395e
Update README.md
2025-09-30 13:39:33 +02:00
Patrick Ventuzelo
44dfafd8c3
Update README.md
...
add new banner github
2025-09-30 13:38:23 +02:00
Tanguy Duhamel
fb9ed420be
Fix parameters bug + installation issues
2025-09-30 12:10:47 +02:00
tduhamel42
f46565438c
Update README.md
2025-09-30 09:36:23 +02:00
Patrick Ventuzelo
a4d204db27
Update README.md
2025-09-29 23:25:25 +02:00
Tanguy Duhamel
323a434c73
Initial commit
2025-09-29 21:26:41 +02:00
tduhamel42
f0fd367ed8
Add files via upload
2025-09-29 15:12:47 +02:00
