fix(fuzz): the crate was invisible to lint, dependabot, audit, deny, and osv

.github/dependabot.yml

@@ -15,6 +15,26 @@ updates:
     reviewers:
       - forkwright
 
+  # WHY a second cargo entry: `fuzz/` declares its own empty [workspace] table so
+  # a nightly sanitizer build stays out of the stable workspace. That detachment
+  # also puts it outside every repo-wide check keyed to the root manifest --
+  # `cargo audit`, `cargo deny`, and the `directory: /` entry above all resolve
+  # the root graph and never see this crate's dependencies. Without this entry
+  # the fuzz harness's deps receive no security updates at all.
+  - package-ecosystem: cargo
+    directory: /fuzz
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      patch-updates:
+        update-types: [patch]
+      minor-updates:
+        update-types: [minor]
+    reviewers:
+      - forkwright
+
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/security.yml

@@ -61,6 +61,20 @@ jobs:
           command: check advisories licenses bans sources
           arguments: --all-features
 
+      # WHY a second invocation rather than a wider first one: `fuzz/` declares
+      # its own [workspace], so the root run resolves a graph that does not
+      # contain it. cargo-deny follows the manifest it is given and there is no
+      # flag that makes one run span two workspaces.
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check advisories licenses bans sources
+          arguments: --all-features
+          # WHY the action's own input rather than a flag in `arguments`: the
+          # action always passes `--manifest-path` from this input (defaulting
+          # to ./Cargo.toml), so putting one in `arguments` supplies the flag
+          # twice and cargo-deny rejects it outright.
+          manifest-path: fuzz/Cargo.toml
+
   cargo-audit:
     # WHY: cargo-deny's advisories check overlaps but uses a different code
     # path; running cargo-audit independently protects against bugs or
@@ -84,6 +98,11 @@ jobs:
         # .cargo/audit.toml, which mirrors deny.toml's [[advisories.ignore]]
         # entries — no silent --ignore flags here.
         run: cargo audit --deny unmaintained --deny unsound --deny yanked
+      - name: cargo audit (fuzz workspace)
+        # WHY separate: cargo-audit reads one lockfile, and `fuzz/` has its own
+        # because it is a detached workspace. Without this its dependency tree
+        # is scanned by nothing.
+        run: cargo audit --file fuzz/Cargo.lock --deny unmaintained --deny unsound --deny yanked
 
   osv-scanner:
     name: osv-scanner
@@ -106,4 +125,9 @@ jobs:
             echo "ERROR: downloaded binary version mismatch" >&2; exit 1; }
           echo "/tmp" >> "$GITHUB_PATH"
       - name: osv scanner
-        run: osv-scanner scan source --config=osv-scanner.toml --lockfile=Cargo.lock
+        # WHY both lockfiles named explicitly: `fuzz/` is a detached workspace
+        # with its own lockfile, and a single `--lockfile` covers only the graph
+        # it names.
+        run: |
+          osv-scanner scan source --config=osv-scanner.toml \
+            --lockfile=Cargo.lock --lockfile=fuzz/Cargo.lock

deny.toml

@@ -34,6 +34,20 @@ allow = [
 ]
 confidence-threshold = 0.8
 
+# WHY an exception rather than adding NCSA to `allow` above: libfuzzer-sys is
+# `(MIT OR Apache-2.0) AND NCSA` because it wraps LLVM's libFuzzer, which
+# predates LLVM's relicensing. NCSA is permissive, OSI-approved, FSF
+# Free/Libre and compatible with this workspace's AGPL-3.0 — but it is
+# compatible for THIS dependency, and a global allow would silently accept it
+# from any future crate in the runtime graph as well. The exception keeps the
+# grant attached to the crate that needs it.
+#
+# It applies to the detached `fuzz/` workspace only; nothing in the shipped
+# runtime graph depends on libfuzzer-sys (forkwright/akroasis#95).
+[[licenses.exceptions]]
+name = "libfuzzer-sys"
+allow = ["NCSA"]
+
 [bans]
 multiple-versions = "warn"
 wildcards = "allow"