Files
fuzzforge_ai/cli/completion_install.py
tduhamel42 60ca088ecf CI/CD Integration with Ephemeral Deployment Model (#14)
* feat: Complete migration from Prefect to Temporal

BREAKING CHANGE: Replaces Prefect workflow orchestration with Temporal

## Major Changes
- Replace Prefect with Temporal for workflow orchestration
- Implement vertical worker architecture (rust, android)
- Replace Docker registry with MinIO for unified storage
- Refactor activities to be co-located with workflows
- Update all API endpoints for Temporal compatibility

## Infrastructure
- New: docker-compose.temporal.yaml (Temporal + MinIO + workers)
- New: workers/ directory with rust and android vertical workers
- New: backend/src/temporal/ (manager, discovery)
- New: backend/src/storage/ (S3-cached storage with MinIO)
- New: backend/toolbox/common/ (shared storage activities)
- Deleted: docker-compose.yaml (old Prefect setup)
- Deleted: backend/src/core/prefect_manager.py
- Deleted: backend/src/services/prefect_stats_monitor.py
- Deleted: Docker registry and insecure-registries requirement

## Workflows
- Migrated: security_assessment workflow to Temporal
- New: rust_test workflow (example/test workflow)
- Deleted: secret_detection_scan (Prefect-based, to be reimplemented)
- Activities now co-located with workflows for independent testing

## API Changes
- Updated: backend/src/api/workflows.py (Temporal submission)
- Updated: backend/src/api/runs.py (Temporal status/results)
- Updated: backend/src/main.py (727 lines, TemporalManager integration)
- Updated: All 16 MCP tools to use TemporalManager

## Testing
-  All services healthy (Temporal, PostgreSQL, MinIO, workers, backend)
-  All API endpoints functional
-  End-to-end workflow test passed (72 findings from vulnerable_app)
-  MinIO storage integration working (target upload/download, results)
-  Worker activity discovery working (6 activities registered)
-  Tarball extraction working
-  SARIF report generation working

## Documentation
- ARCHITECTURE.md: Complete Temporal architecture documentation
- QUICKSTART_TEMPORAL.md: Getting started guide
- MIGRATION_DECISION.md: Why we chose Temporal over Prefect
- IMPLEMENTATION_STATUS.md: Migration progress tracking
- workers/README.md: Worker development guide

## Dependencies
- Added: temporalio>=1.6.0
- Added: boto3>=1.34.0 (MinIO S3 client)
- Removed: prefect>=3.4.18

* feat: Add Python fuzzing vertical with Atheris integration

This commit implements a complete Python fuzzing workflow using Atheris:

## Python Worker (workers/python/)
- Dockerfile with Python 3.11, Atheris, and build tools
- Generic worker.py for dynamic workflow discovery
- requirements.txt with temporalio, boto3, atheris dependencies
- Added to docker-compose.temporal.yaml with dedicated cache volume

## AtherisFuzzer Module (backend/toolbox/modules/fuzzer/)
- Reusable module extending BaseModule
- Auto-discovers fuzz targets (fuzz_*.py, *_fuzz.py, fuzz_target.py)
- Recursive search to find targets in nested directories
- Dynamically loads TestOneInput() function
- Configurable max_iterations and timeout
- Real-time stats callback support for live monitoring
- Returns findings as ModuleFinding objects

## Atheris Fuzzing Workflow (backend/toolbox/workflows/atheris_fuzzing/)
- Temporal workflow for orchestrating fuzzing
- Downloads user code from MinIO
- Executes AtherisFuzzer module
- Uploads results to MinIO
- Cleans up cache after execution
- metadata.yaml with vertical: python for routing

## Test Project (test_projects/python_fuzz_waterfall/)
- Demonstrates stateful waterfall vulnerability
- main.py with check_secret() that leaks progress
- fuzz_target.py with Atheris TestOneInput() harness
- Complete README with usage instructions

## Backend Fixes
- Fixed parameter merging in REST API endpoints (workflows.py)
- Changed workflow parameter passing from positional args to kwargs (manager.py)
- Default parameters now properly merged with user parameters

## Testing
 Worker discovered AtherisFuzzingWorkflow
 Workflow executed end-to-end successfully
 Fuzz target auto-discovered in nested directories
 Atheris ran 100,000 iterations
 Results uploaded and cache cleaned

* chore: Complete Temporal migration with updated CLI/SDK/docs

This commit includes all remaining Temporal migration changes:

## CLI Updates (cli/)
- Updated workflow execution commands for Temporal
- Enhanced error handling and exceptions
- Updated dependencies in uv.lock

## SDK Updates (sdk/)
- Client methods updated for Temporal workflows
- Updated models for new workflow execution
- Updated dependencies in uv.lock

## Documentation Updates (docs/)
- Architecture documentation for Temporal
- Workflow concept documentation
- Resource management documentation (new)
- Debugging guide (new)
- Updated tutorials and how-to guides
- Troubleshooting updates

## README Updates
- Main README with Temporal instructions
- Backend README
- CLI README
- SDK README

## Other
- Updated IMPLEMENTATION_STATUS.md
- Removed old vulnerable_app.tar.gz

These changes complete the Temporal migration and ensure the
CLI/SDK work correctly with the new backend.

* fix: Use positional args instead of kwargs for Temporal workflows

The Temporal Python SDK's start_workflow() method doesn't accept
a 'kwargs' parameter. Workflows must receive parameters as positional
arguments via the 'args' parameter.

Changed from:
  args=workflow_args  # Positional arguments

This fixes the error:
  TypeError: Client.start_workflow() got an unexpected keyword argument 'kwargs'

Workflows now correctly receive parameters in order:
- security_assessment: [target_id, scanner_config, analyzer_config, reporter_config]
- atheris_fuzzing: [target_id, target_file, max_iterations, timeout_seconds]
- rust_test: [target_id, test_message]

* fix: Filter metadata-only parameters from workflow arguments

SecurityAssessmentWorkflow was receiving 7 arguments instead of 2-5.
The issue was that target_path and volume_mode from default_parameters
were being passed to the workflow, when they should only be used by
the system for configuration.

Now filters out metadata-only parameters (target_path, volume_mode)
before passing arguments to workflow execution.

* refactor: Remove Prefect leftovers and volume mounting legacy

Complete cleanup of Prefect migration artifacts:

Backend:
- Delete registry.py and workflow_discovery.py (Prefect-specific files)
- Remove Docker validation from setup.py (no longer needed)
- Remove ResourceLimits and VolumeMount models
- Remove target_path and volume_mode from WorkflowSubmission
- Remove supported_volume_modes from API and discovery
- Clean up metadata.yaml files (remove volume/path fields)
- Simplify parameter filtering in manager.py

SDK:
- Remove volume_mode parameter from client methods
- Remove ResourceLimits and VolumeMount models
- Remove Prefect error patterns from docker_logs.py
- Clean up WorkflowSubmission and WorkflowMetadata models

CLI:
- Remove Volume Modes display from workflow info

All removed features are Prefect-specific or Docker volume mounting
artifacts. Temporal workflows use MinIO storage exclusively.

* feat: Add comprehensive test suite and benchmark infrastructure

- Add 68 unit tests for fuzzer, scanner, and analyzer modules
- Implement pytest-based test infrastructure with fixtures
- Add 6 performance benchmarks with category-specific thresholds
- Configure GitHub Actions for automated testing and benchmarking
- Add test and benchmark documentation

Test coverage:
- AtherisFuzzer: 8 tests
- CargoFuzzer: 14 tests
- FileScanner: 22 tests
- SecurityAnalyzer: 24 tests

All tests passing (68/68)
All benchmarks passing (6/6)

* fix: Resolve all ruff linting violations across codebase

Fixed 27 ruff violations in 12 files:
- Removed unused imports (Depends, Dict, Any, Optional, etc.)
- Fixed undefined workflow_info variable in workflows.py
- Removed dead code with undefined variables in atheris_fuzzer.py
- Changed f-string to regular string where no placeholders used

All files now pass ruff checks for CI/CD compliance.

* fix: Configure CI for unit tests only

- Renamed docker-compose.temporal.yaml → docker-compose.yml for CI compatibility
- Commented out integration-tests job (no integration tests yet)
- Updated test-summary to only depend on lint and unit-tests

CI will now run successfully with 68 unit tests. Integration tests can be added later.

* feat: Add CI/CD integration with ephemeral deployment model

Implements comprehensive CI/CD support for FuzzForge with on-demand worker management:

**Worker Management (v0.7.0)**
- Add WorkerManager for automatic worker lifecycle control
- Auto-start workers from stopped state when workflows execute
- Auto-stop workers after workflow completion
- Health checks and startup timeout handling (90s default)

**CI/CD Features**
- `--fail-on` flag: Fail builds based on SARIF severity levels (error/warning/note/info)
- `--export-sarif` flag: Export findings in SARIF 2.1.0 format
- `--auto-start`/`--auto-stop` flags: Control worker lifecycle
- Exit code propagation: Returns 1 on blocking findings, 0 on success

**Exit Code Fix**
- Add `except typer.Exit: raise` handlers at 3 critical locations
- Move worker cleanup to finally block for guaranteed execution
- Exit codes now propagate correctly even when build fails

**CI Scripts & Examples**
- ci-start.sh: Start FuzzForge services with health checks
- ci-stop.sh: Clean shutdown with volume preservation option
- GitHub Actions workflow example (security-scan.yml)
- GitLab CI pipeline example (.gitlab-ci.example.yml)
- docker-compose.ci.yml: CI-optimized compose file with profiles

**OSS-Fuzz Integration**
- New ossfuzz_campaign workflow for running OSS-Fuzz projects
- OSS-Fuzz worker with Docker-in-Docker support
- Configurable campaign duration and project selection

**Documentation**
- Comprehensive CI/CD integration guide (docs/how-to/cicd-integration.md)
- Updated architecture docs with worker lifecycle details
- Updated workspace isolation documentation
- CLI README with worker management examples

**SDK Enhancements**
- Add get_workflow_worker_info() endpoint
- Worker vertical metadata in workflow responses

**Testing**
- All workflows tested: security_assessment, atheris_fuzzing, secret_detection, cargo_fuzzing
- All monitoring commands tested: stats, crashes, status, finding
- Full CI pipeline simulation verified
- Exit codes verified for success/failure scenarios

Ephemeral CI/CD model: ~3-4GB RAM, ~60-90s startup, runs entirely in CI containers.

* fix: Resolve ruff linting violations in CI/CD code

- Remove unused variables (run_id, defaults, result)
- Remove unused imports
- Fix f-string without placeholders

All CI/CD integration files now pass ruff checks.
2025-10-14 10:13:45 +02:00

323 lines
9.9 KiB
Python

#!/usr/bin/env python3
# Copyright (c) 2025 FuzzingLabs
#
# Licensed under the Business Source License 1.1 (BSL). See the LICENSE file
# at the root of this repository for details.
#
# After the Change Date (four years from publication), this version of the
# Licensed Work will be made available under the Apache License, Version 2.0.
# See the LICENSE-APACHE file or http://www.apache.org/licenses/LICENSE-2.0
#
# Additional attribution and requirements are provided in the NOTICE file.
"""
Install shell completion for FuzzForge CLI.
This script installs completion using Typer's built-in --install-completion command.
"""
import os
import sys
import subprocess
from pathlib import Path
import typer
def run_fuzzforge_completion_install(shell: str) -> bool:
"""Install completion using the fuzzforge CLI itself."""
try:
# Use the CLI's built-in completion installation
result = subprocess.run([
sys.executable, "-m", "fuzzforge_cli.main",
"--install-completion", shell
], capture_output=True, text=True, cwd=Path(__file__).parent.parent)
if result.returncode == 0:
print(f"{shell.capitalize()} completion installed successfully")
return True
else:
print(f"❌ Failed to install {shell} completion: {result.stderr}")
return False
except Exception as e:
print(f"❌ Error installing {shell} completion: {e}")
return False
def create_manual_completion_scripts():
"""Create manual completion scripts as fallback."""
scripts = {
"bash": '''
# FuzzForge CLI completion for bash
_fuzzforge_completion() {
local IFS=$'\\t'
local response
response=$(env COMP_WORDS="${COMP_WORDS[*]}" COMP_CWORD=$COMP_CWORD _FUZZFORGE_COMPLETE=bash_complete $1)
for completion in $response; do
IFS=',' read type value <<< "$completion"
if [[ $type == 'dir' ]]; then
COMPREPLY=()
compopt -o dirnames
elif [[ $type == 'file' ]]; then
COMPREPLY=()
compopt -o default
elif [[ $type == 'plain' ]]; then
COMPREPLY+=($value)
fi
done
return 0
}
complete -o nosort -F _fuzzforge_completion fuzzforge
''',
"zsh": '''
#compdef fuzzforge
_fuzzforge_completion() {
local -a completions
local -a completions_with_descriptions
local -a response
response=(${(f)"$(env COMP_WORDS="${words[*]}" COMP_CWORD=$((CURRENT-1)) _FUZZFORGE_COMPLETE=zsh_complete fuzzforge)"})
for type_and_line in $response; do
if [[ "$type_and_line" =~ ^([^,]*),(.*)$ ]]; then
local type="$match[1]"
local line="$match[2]"
if [[ "$type" == "dir" ]]; then
_path_files -/
elif [[ "$type" == "file" ]]; then
_path_files -f
elif [[ "$type" == "plain" ]]; then
if [[ "$line" =~ ^([^:]*):(.*)$ ]]; then
completions_with_descriptions+=("$match[1]":"$match[2]")
else
completions+=("$line")
fi
fi
fi
done
if [ -n "$completions_with_descriptions" ]; then
_describe "" completions_with_descriptions -V unsorted
fi
if [ -n "$completions" ]; then
compadd -U -V unsorted -a completions
fi
}
compdef _fuzzforge_completion fuzzforge;
''',
"fish": '''
# FuzzForge CLI completion for fish
function __fuzzforge_completion
set -l response
for value in (env _FUZZFORGE_COMPLETE=fish_complete COMP_WORDS=(commandline -cp) COMP_CWORD=(commandline -t) fuzzforge)
set response $response $value
end
for completion in $response
set -l metadata (string split "," $completion)
if test $metadata[1] = "dir"
__fish_complete_directories $metadata[2]
else if test $metadata[1] = "file"
__fish_complete_path $metadata[2]
else if test $metadata[1] = "plain"
echo $metadata[2]
end
end
end
complete --no-files --command fuzzforge --arguments "(__fuzzforge_completion)"
'''
}
return scripts
def install_bash_completion():
"""Install bash completion."""
print("📝 Installing bash completion...")
# Get the manual completion script
scripts = create_manual_completion_scripts()
completion_script = scripts["bash"]
# Try different locations for bash completion
completion_dirs = [
Path.home() / ".bash_completion.d",
Path("/usr/local/etc/bash_completion.d"),
Path("/etc/bash_completion.d")
]
for completion_dir in completion_dirs:
try:
completion_dir.mkdir(exist_ok=True)
completion_file = completion_dir / "fuzzforge"
completion_file.write_text(completion_script)
print(f"✅ Bash completion installed to: {completion_file}")
# Add source line to .bashrc if not present
bashrc = Path.home() / ".bashrc"
source_line = f"source {completion_file}"
if bashrc.exists():
bashrc_content = bashrc.read_text()
if source_line not in bashrc_content:
with bashrc.open("a") as f:
f.write(f"\n# FuzzForge CLI completion\n{source_line}\n")
print("✅ Added completion source to ~/.bashrc")
return True
except PermissionError:
continue
except Exception as e:
print(f"❌ Failed to install bash completion: {e}")
continue
print("❌ Could not install bash completion (permission denied)")
return False
def install_zsh_completion():
"""Install zsh completion."""
print("📝 Installing zsh completion...")
# Get the manual completion script
scripts = create_manual_completion_scripts()
completion_script = scripts["zsh"]
# Create completion directory
comp_dir = Path.home() / ".zsh" / "completions"
comp_dir.mkdir(parents=True, exist_ok=True)
try:
completion_file = comp_dir / "_fuzzforge"
completion_file.write_text(completion_script)
print(f"✅ Zsh completion installed to: {completion_file}")
# Add fpath to .zshrc if not present
zshrc = Path.home() / ".zshrc"
fpath_line = 'fpath=(~/.zsh/completions $fpath)'
autoload_line = 'autoload -U compinit && compinit'
if zshrc.exists():
zshrc_content = zshrc.read_text()
lines_to_add = []
if fpath_line not in zshrc_content:
lines_to_add.append(fpath_line)
if autoload_line not in zshrc_content:
lines_to_add.append(autoload_line)
if lines_to_add:
with zshrc.open("a") as f:
f.write("\n# FuzzForge CLI completion\n")
for line in lines_to_add:
f.write(f"{line}\n")
print("✅ Added completion setup to ~/.zshrc")
return True
except Exception as e:
print(f"❌ Failed to install zsh completion: {e}")
return False
def install_fish_completion():
"""Install fish completion."""
print("📝 Installing fish completion...")
# Get the manual completion script
scripts = create_manual_completion_scripts()
completion_script = scripts["fish"]
# Fish completion directory
comp_dir = Path.home() / ".config" / "fish" / "completions"
comp_dir.mkdir(parents=True, exist_ok=True)
try:
completion_file = comp_dir / "fuzzforge.fish"
completion_file.write_text(completion_script)
print(f"✅ Fish completion installed to: {completion_file}")
return True
except Exception as e:
print(f"❌ Failed to install fish completion: {e}")
return False
def detect_shell():
"""Detect the current shell."""
shell_path = os.environ.get('SHELL', '')
if 'bash' in shell_path:
return 'bash'
elif 'zsh' in shell_path:
return 'zsh'
elif 'fish' in shell_path:
return 'fish'
else:
return None
def main():
"""Install completion for the current shell or all shells."""
print("🚀 FuzzForge CLI Completion Installer")
print("=" * 50)
current_shell = detect_shell()
if current_shell:
print(f"🐚 Detected shell: {current_shell}")
# Check for command line arguments
if len(sys.argv) > 1 and sys.argv[1] == "--all":
install_all = True
print("Installing completion for all shells...")
else:
# Ask user which shells to install (with default to current shell only)
if current_shell:
install_all = typer.confirm("Install completion for all supported shells (bash, zsh, fish)?", default=False)
if not install_all:
print(f"Installing completion for {current_shell} only...")
else:
install_all = typer.confirm("Install completion for all supported shells (bash, zsh, fish)?", default=True)
success_count = 0
if install_all or current_shell == 'bash':
if install_bash_completion():
success_count += 1
if install_all or current_shell == 'zsh':
if install_zsh_completion():
success_count += 1
if install_all or current_shell == 'fish':
if install_fish_completion():
success_count += 1
print("\n" + "=" * 50)
if success_count > 0:
print(f"✅ Successfully installed completion for {success_count} shell(s)!")
print("\n📋 To activate completion:")
print(" • Bash: Restart your terminal or run 'source ~/.bashrc'")
print(" • Zsh: Restart your terminal or run 'source ~/.zshrc'")
print(" • Fish: Completion is active immediately")
print("\n💡 Try typing 'fuzzforge <TAB>' to test completion!")
else:
print("❌ No completions were installed successfully.")
return 1
return 0
if __name__ == "__main__":
sys.exit(main())