[ptr727]

Summary

Retires the media parser fuzz gate. Per OPERATIONS.md "Trust Boundaries", the media tooling reads the maintainer's own media. In a fork's run it reads the pull request's untrusted files, where the worst a crafted file does is fail that run's own check. So that section adds nothing to defend the tooling against crafted shapes, and the fuzzer tests exactly those.

• Deletes checks/media_parser_fuzz_gate.py and its step in the validate action.
• Moves the fixture builders the media gate tests used into checks/tests/media_fixtures.py. Each is unchanged except that jpeg_fixture and exif_segment lose the parameters only the fuzzer passed.
• Drops the fuzzer's own seed-sampling tests and its entry in the CLI-usage test.
• Removes the fuzzer from README.md and checks/README.md. OPERATIONS.md already says nothing is added against a crafted file.

The media gate's own checks for metadata leaks and accidental damage stay.

Part of #549. That issue closes from the promotion pull request.

Verification

• cd checks && uvx ruff check . && uvx ruff format --check . && uvx mypy@latest: clean.
• cd checks && python3 -m unittest discover -s tests: 200 tests, OK.
• Hub prose_lint.py --diff against the merge base: no findings.

Local review

Two passes ran. The first raised three findings:

• The progressive branch of jpeg_fixture and the tail parameter of exif_segment were dead once the fuzzer was gone. Both were fixed in the second commit.
• jpeg_segment and png_chunk duplicate builders in scripts/normalize_media.py. Declined, since fixtures built independently of the encoder under test keep a defect in that encoder from cancelling out of the test. This duplication predates the change, which only moves it.

The second pass raised nothing.

🤖 Generated with Claude Code

[ptr727]

A recorded local strict-review pass covers head 2fc2c9b1600062412527afe0b67de32b278eebc6, the content this pull request carries at that commit against develop, and it recorded 0 findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d563a821-67e3-4a5a-a308-f8027f4224a6

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (develop@0ed885a). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop     #570   +/-   ##
==========================================
  Coverage           ?   67.12%           
==========================================
  Files              ?       11           
  Lines              ?     2494           
  Branches           ?        0           
==========================================
  Hits               ?     1674           
  Misses             ?      820           
  Partials           ?        0           

Flag	Coverage Δ
python-3.13	67.12% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟡 Changes recommended

An unresolved finding leaves the PR description and OPERATIONS.md disagreeing on whether fork runs read untrusted pull-request media files, which the retirement rationale depends on.

1 open issue

• Resolve the conflicting claims about fork PR media files · New

What changed in this PR

This PR retires the media parser fuzz gate. The fuzzer generated malformed versions of committed media to test the metadata gate and normalizer. The PR treats that work as unnecessary because the media is the maintainer's own, so the fuzzer, its CI step, and its docs are removed. The metadata-leak and accidental-damage checks in the media gate stay. The fixture builders the gate tests need move into a new shared module.

Changes:

• Deletes the fuzzer script and its CI step in the validate action.
• Moves the fixture builders into checks/tests/media_fixtures.py. jpeg_fixture and exif_segment lose the parameters only the fuzzer used.
• Removes the fuzzer's seed-sampling tests, its entry in the CLI usage test, and its mentions in the README files.

File	Description
README.md	Removes the paragraph that described the fuzzer in the media section.
checks/​tests/​test_media_metadata_gate.py	Imports the shared fixtures module, drops the fuzzer seed tests, and removes the unused random import.
checks/​tests/​test_cli_usage.py	Removes the fuzzer script from the CLI usage list.
checks/​tests/​media_fixtures.py	New module with the fixture builders moved from the fuzzer, with unused parameters removed.
checks/​README.md	Removes the fuzzer's table row and its link reference.
checks/​media_parser_fuzz_gate.py	Deleted. This was the fuzzer script.
.github/​actions/​validate/​action.yml	Removes the CI step that ran the fuzzer.

_{Review effort: Lite}