ci: integrate with OSS-Fuzz for continuous distributed fuzzing

Start with the OSS-Fuzz Rust new-project guide and review the existing fuzz targets: fuzz_parse_eager, fuzz_parse_lazy, fuzz_depth, and fuzz_ffi_ops. Prepare projects/qjson/ in google/oss-fuzz with its Dockerfile and project.yaml, then submit the PR. Done means all four targets run successfully, the project is approved, and the first OSS-Fuzz run completes with maintainer dashboard access.

Background

qjson currently runs timed fuzzing weekly (60 seconds per target), which is sufficient for corpus regression but insufficient for discovering deep bugs. OSS-Fuzz provides free continuous distributed fuzzing for open-source projects, running thousands of CPU hours daily.

Production JSON parsers like simdjson and serde_json have found multiple security-relevant bugs through OSS-Fuzz that local fuzzing would never discover.

Goal

Integrate qjson with Google's OSS-Fuzz for continuous, large-scale fuzz testing.

Why OSS-Fuzz

Scope

Integration Steps

1. Create projects/qjson/ in google/oss-fuzz repository
2. Write Dockerfile to build qjson fuzz targets
3. Write project.yaml with project metadata
4. Adapt existing fuzz targets (fuzz_parse_eager, fuzz_parse_lazy, fuzz_depth, fuzz_ffi_ops)
5. Submit PR to google/oss-fuzz, await approval (typically 1-2 weeks)

Requirements for Acceptance

• Open-source with OSI-approved license (Apache-2.0 ✓)
• Active maintenance ✓
• Real user base (API7/APISIX ecosystem ✓)
• Commitment to fix reported vulnerabilities within 90-day disclosure deadline

Acceptance Criteria

• PR submitted to google/oss-fuzz repository
• All 4 existing fuzz targets integrated
• Project approved and running on OSS-Fuzz infrastructure
• ClusterFuzz dashboard accessible to maintainers
• First fuzzing run completes successfully

References

• OSS-Fuzz: https://github.com/google/oss-fuzz
• New project guide: https://google.github.io/oss-fuzz/getting-started/new-project-guide/
• Rust integration: https://google.github.io/oss-fuzz/getting-started/new-project-guide/rust-lang/
• Example Rust project: https://github.com/google/oss-fuzz/tree/master/projects/serde_json