D-047: test(fuzz): signature extraction fuzzers for non-Rust languages

[Sephyi]

Summary

test(fuzz): signature extraction fuzzers for non-Rust languages.

Audit context

Closes audit entry D-047 from #3.

Verification

• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test --all-targets

Note: one pre-existing test porcelain_exits_within_timeout_with_no_staged_changes is a known macOS cold-start flake that reproduces on unmodified development — unrelated to this change.

[Copilot]

Pull request overview

Adds multi-language fuzz coverage for CommitBee’s signature extraction by exposing language-specific signature wrappers and introducing a new fuzz target that dispatches across supported tree-sitter grammars.

Changes:

• Refactors signature extraction into a shared extract_signature_for_language helper in src/lib.rs and adds per-language public wrapper functions behind lang-* feature flags.
• Introduces a new fuzz_signature_multilang fuzz target that selects among 10 languages based on the first input byte.
• Updates fuzz crate configuration to enable all language features (while disabling default features) and refreshes fuzz/Cargo.lock accordingly.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
src/lib.rs	Adds a language-parameterized signature extraction helper and new extract_*_signature wrappers for non-Rust languages.
fuzz/fuzz_targets/fuzz_signature_multilang.rs	New fuzz target that dispatches input to the appropriate language-specific signature extractor.
fuzz/Cargo.toml	Enables all language features for fuzzing (and disables default features) and registers the new fuzz binary target.
fuzz/Cargo.lock	Lockfile updates reflecting changed feature/dependency resolution (e.g., dropping secure-storage/keyring from fuzz).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

extract_signature_for_language is always compiled, but it’s only referenced from the language-specific wrappers that are all #[cfg(feature = "lang-*")]. In a --no-default-features build with no language features enabled, this helper becomes unused and will trigger a dead_code warning. Consider gating the helper with the same cfg(any(feature = "lang-rust", ...)) set, or explicitly allowing dead_code with a short rationale so minimal-feature builds stay warning-free.

[Copilot]

The fuzzer drops any input where data[1..] is not valid UTF-8, which can significantly reduce fuzz coverage since many byte sequences will exit early. To exercise the parsers more thoroughly, consider converting with a lossless-to-&str strategy like String::from_utf8_lossy(&data[1..]) (or switching the target input type to (&str, u8) via a structured fuzzer input) so every input still drives the extractor while staying within the &str API contract.

Suggested change

	let Ok(source) = std::str::from_utf8(&data[1..]) else {
	return;
	};
	match selector {
	0 => {
	let _ = commitbee::extract_rust_signature(source);
	}
	1 => {
	let _ = commitbee::extract_typescript_signature(source);
	}
	2 => {
	let _ = commitbee::extract_javascript_signature(source);
	}
	3 => {
	let _ = commitbee::extract_python_signature(source);
	}
	4 => {
	let _ = commitbee::extract_go_signature(source);
	}
	5 => {
	let _ = commitbee::extract_java_signature(source);
	}
	6 => {
	let _ = commitbee::extract_c_signature(source);
	}
	7 => {
	let _ = commitbee::extract_cpp_signature(source);
	}
	8 => {
	let _ = commitbee::extract_ruby_signature(source);
	}
	9 => {
	let _ = commitbee::extract_csharp_signature(source);
	let source = String::from_utf8_lossy(&data[1..]);
	match selector {
	0 => {
	let _ = commitbee::extract_rust_signature(source.as_ref());
	}
	1 => {
	let _ = commitbee::extract_typescript_signature(source.as_ref());
	}
	2 => {
	let _ = commitbee::extract_javascript_signature(source.as_ref());
	}
	3 => {
	let _ = commitbee::extract_python_signature(source.as_ref());
	}
	4 => {
	let _ = commitbee::extract_go_signature(source.as_ref());
	}
	5 => {
	let _ = commitbee::extract_java_signature(source.as_ref());
	}
	6 => {
	let _ = commitbee::extract_c_signature(source.as_ref());
	}
	7 => {
	let _ = commitbee::extract_cpp_signature(source.as_ref());
	}
	8 => {
	let _ = commitbee::extract_ruby_signature(source.as_ref());
	}
	9 => {
	let _ = commitbee::extract_csharp_signature(source.as_ref());