chore(fuzz): add parse-html target, make fuzz and geiger

.gitignore

@@ -1,5 +1,9 @@
 /target/
 coverage/
+fuzz/target/
+fuzz/corpus/
+fuzz/artifacts/
+fuzz/coverage/
 /demo-leptos/dist/
 /demo-leptos/target/
 /demo-tauri/src/target/

Cargo.toml

@@ -9,7 +9,7 @@ members = [
     "crates/rangular-parser",
     "crates/rangular-runtime",
 ]
-exclude = ["demo-leptos", "demo-tauri/src"]
+exclude = ["demo-leptos", "demo-tauri/src", "fuzz"]
 resolver = "3"
 
 [workspace.package]

Makefile

@@ -22,7 +22,7 @@ TAG ?= dev
 .DEFAULT_GOAL := help
 
 .PHONY: help check test lint format format-check clean ci no-panic coverage \
-	coverage-summary coverage-html tarpaulin machete outdated \
+	coverage-summary coverage-html tarpaulin machete outdated fuzz fuzz-build geiger \
 	doc doc-open doc-clean \
 	demo demo-leptos demo-build demo-leptos-build demo-check demo-leptos-check \
 	demo-desktop demo-tauri demo-desktop-build demo-tauri-build \
@@ -48,6 +48,9 @@ help:
 	@echo "  make tarpaulin        cargo tarpaulin → coverage/tarpaulin/ (local alternate)"
 	@echo "  make machete          cargo machete (unused deps)"
 	@echo "  make outdated         cargo outdated --workspace"
+	@echo "  make fuzz             cargo +nightly fuzz run $(FUZZ_TARGET) (FUZZ_TIME=$(FUZZ_TIME)s)"
+	@echo "  make fuzz-build       cargo +nightly fuzz build"
+	@echo "  make geiger           cargo geiger (unsafe dependency audit)"
 	@echo "  make audit         cargo audit"
 	@echo "  make deny          cargo deny check"
 	@echo "  make format        cargo fmt"
@@ -138,6 +141,21 @@ machete:
 outdated:
 	cd $(ROOT) && $(CARGO) outdated --workspace
 
+## Default fuzz target: rangular_parser::parse (Angular-subset HTML).
+## Requires nightly + `cargo install cargo-fuzz`. Override: FUZZ_TARGET=… FUZZ_TIME=…
+FUZZ_TARGET ?= parse-html
+FUZZ_TIME ?= 10
+
+fuzz-build:
+	cd $(ROOT) && cargo +nightly fuzz build
+
+fuzz:
+	cd $(ROOT) && cargo +nightly fuzz run $(FUZZ_TARGET) -- -max_total_time=$(FUZZ_TIME)
+
+## Unsafe Rust surface in deps + workspace. Requires `cargo install cargo-geiger`.
+geiger:
+	cd $(ROOT) && $(CARGO) geiger --workspace
+
 ci: lint test no-panic doc audit deny
 
 ## rustdoc → `docs/api-rust/` (GitHub Pages publish folder).

docs/CONTRIBUTING.md

@@ -59,6 +59,8 @@ Adjust the relative path to match your layout.
 
 - Prefer one concern per PR.
 - Run `make lint` and `make test` before push.
+- Local fuzz / unsafe audit: `make fuzz` (default target `parse-html`, needs nightly +
+  `cargo fuzz`) and `make geiger` (needs `cargo geiger`).
 - Conventional commits: `feat(parser): …`, `fix(aot): …`, etc.
 - PR body follows [`pull_request_template.md`](pull_request_template.md)
   (**Summary** + **Test plan** only).

fuzz/Cargo.toml

@@ -0,0 +1,19 @@
+[package]
+name = "rangular-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2024"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+rangular-parser = { path = "../crates/rangular-parser" }
+
+[[bin]]
+name = "parse-html"
+path = "fuzz_targets/parse_html.rs"
+test = false
+doc = false
+bench = false

fuzz/fuzz_targets/parse_html.rs

@@ -0,0 +1,10 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+
+fuzz_target!(|data: &[u8]| {
+    let Ok(src) = std::str::from_utf8(data) else {
+        return;
+    };
+    let _ = rangular_parser::parse(src, "fuzz.html");
+});