/diet-fuzz — Batch Diet Fuzz Testing
Full specification: See
.github/prompts/diet-fuzz.prompt.mdfor the complete execution pipeline, project selection algorithm, and issue filing format.
Quick Reference
- Full run:
/diet-fuzz all— 5 projects × 4 languages × 3 SBOM tools - Targeted:
/diet-fuzz go,typescript --count 10— 10 projects × 2 languages - Single tool:
/diet-fuzz python --tool syft --count 3 - Curated:
/diet-fuzz all --projects-file projects.txt - High parallel:
/diet-fuzz all --max-parallel 8
Pipeline
- Pull
origin/main& rebuilduzomuzo-diet - Select projects (stratified sampling or projects-file)
- Pre-filter (clone + SBOM, skip empty dependency graphs)
- Run
uzomuzo-dietper project × tool - Detect anomalies (IBNC, EOL-ZERO-SCORE, HIGH-SCORE-BUT-HARD)
- Compare with previous runs (auto-diff)
- Auto-file/update GitHub issues (grouped by root cause)
- Append new findings to
uzomuzo-diet-findings.md - Display cross-language summary table
Key Points
- Stratified sampling: Projects chosen across popularity tiers (stars) and time periods for parser pattern diversity
- All SBOM tools by default: trivy, syft, cdxgen — cross-tool comparison reveals tool-specific issues
- Auto issue management: Creates new issues or adds evidence to existing ones, labels
bug+diet-trial+lang:* - Regression detection: Compares with past runs to catch accuracy regressions
- Pre-filter: Skips projects where SBOM has no dependency graph (avoids wasted diet runs)
- Uses
gh api(REST) for GitHub operations to avoid GraphQL rate limits