[alexkutsan]

Summary

Adds a third STAR / Bright Agent CI workflow — .github/workflows/bright-agent-fuzzing.yml — running STAR in RUN_MODE=fuzzing.

Fuzzing mode is a separate, self-contained STAR mode: a coverage-guided, structure-aware evolutionary fuzzer that targets the bugs the DAST modes can't see — crashes, hangs, native memory-safety faults, unrecoverable managed-runtime faults, and resource-amplification DoS. It deliberately ships no SQLi/XSS/SSRF oracle (those stay with the DAST workflow). It does not start the app, open a Repeater, run a cloud scan, or detect auth; it resolves a standalone fuzzer binary, has an LLM write per-function Docker harnesses, fuzzes them, triages the faults, and optionally fixes + re-validates — all local except a BRIGHT_TOKEN license check.

This complements the existing workflows:

• bright-agent.yml — DAST scan + fix loop (RUN_MODE=full)
• bright-agent-sast-validation.yml — CodeQL SAST → STAR validation (RUN_MODE=validation)

Runs alongside the DAST workflow as an orthogonal robustness pass, not instead of it.

Details

Modeled on the two existing STAR workflows for consistency:

• Triggers: /bright-fuzz comment (OWNER/MEMBER/COLLABORATOR, non-fork) on a PR, or manual workflow_dispatch — same fork-refusal guard and gating.
• Mode: RUN_MODE=fuzzing with the full FUZZER_* config reference documented inline (commented at defaults: FUZZER_MAX_TARGETS=12, FUZZER_MAX_PER_FILE=3, FUZZER_TIMEOUT=5, FUZZER_DEPTH=1, FUZZER_FIX on).
• Drops the DAST-only bits that don't apply (no DIFF_BASE, no SARIF_PATH); fuzzing fuzzes the whole repo and needs Docker for harness builds.
• Same secrets/vars (BRIGHT_TOKEN, INFERENCE_TOKEN, INFERENCE_URL), artifact uploads namespaced bright-agent-fuzzing-*.

Notes

• Like the other comment-triggered workflows, this must be merged to the default branch (stable) before /bright-fuzz replies will fire.

Testing

• YAML validated; RUN_MODE: fuzzing confirmed on the run step.

[alexkutsan]

Addressed review feedback:

• NeuraLegion → BrightSec download URL (@ilya-olchikov): fixed in 3f63136.
• CodeQL untrusted-checkout / TOCTOU alerts (258, 259): these were raised against the issue_comment (/bright-fuzz) trigger in the original commit. That trigger — and all of its comment-steering machinery and PR-head checkout — was removed in 0b37571; the workflow now runs on workflow_dispatch only, so there is no untrusted-code path in a privileged context. The alerts should clear on the next code-scanning run.