fix: harden workflow attestation and fuzz builder paths

.clusterfuzzlite/build.sh

@@ -6,8 +6,8 @@ cd "$SRC/newsdom-api"
 uv sync --frozen --extra fuzz
 export PATH="$SRC/newsdom-api/.venv/bin:$PATH"
 
-for fuzzer in $(find fuzzers -name '*_fuzzer.py'); do
-	fuzzer_basename=$(basename -s .py "$fuzzer")
+while IFS= read -r -d '' fuzzer; do
+	fuzzer_basename=$(basename "$fuzzer" .py)
 	fuzzer_package="${fuzzer_basename}.pkg"
 
 	pyinstaller --distpath "$OUT" --onefile --name "$fuzzer_package" "$fuzzer"
@@ -18,4 +18,4 @@ this_dir=\$(dirname "\$0")
 exec "\$this_dir/$fuzzer_package" "\$@"
 EOF
 	chmod +x "$OUT/$fuzzer_basename"
-done
+done < <(find fuzzers -type f -name '*_fuzzer.py' -print0)

scripts/release/export_release_attestations.py

@@ -18,12 +18,22 @@ def _bundle_candidates(working_dir: Path, digest: str) -> tuple[Path, Path]:
     )
 
 
+def _resolve_gh_cli() -> str:
+    """Resolve the GitHub CLI path required for attestation downloads."""
+
+    gh_executable = shutil.which("gh")
+    if gh_executable is None:
+        raise FileNotFoundError("gh CLI is required to export release attestations")
+    return gh_executable
+
+
 def export_attestations(
     dist_dir: Path, repo: str, *, working_dir: Path | None = None
 ) -> list[Path]:
     """Download attestation bundles for release artifacts and rename them for Scorecard."""
 
     working_dir = (working_dir or Path.cwd()).resolve()
+    gh_executable = _resolve_gh_cli()
     exported: list[Path] = []
 
     for artifact in sorted(dist_dir.iterdir()):
@@ -34,12 +44,14 @@ def export_attestations(
         if artifact.name.endswith(".intoto.jsonl"):
             continue
 
+        artifact_path = artifact.resolve()
         subprocess.run(
-            ["gh", "attestation", "download", str(artifact), "-R", repo],
+            [gh_executable, "attestation", "download", str(artifact_path), "-R", repo],
             check=True,
+            cwd=working_dir,
         )
 
-        digest = hashlib.sha256(artifact.read_bytes()).hexdigest()
+        digest = hashlib.sha256(artifact_path.read_bytes()).hexdigest()
         bundle_path = next(
             (
                 candidate

tests/test_fuzzing_integration.py

@@ -44,6 +44,13 @@ def test_clusterfuzzlite_build_script_uses_locked_uv_fuzz_extra():
     assert "pip3 install . pyinstaller atheris" not in text
 
 
+def test_clusterfuzzlite_build_script_iterates_fuzzers_safely() -> None:
+    text = Path(".clusterfuzzlite/build.sh").read_text(encoding="utf-8")
+    assert "find fuzzers -type f -name '*_fuzzer.py' -print0" in text
+    assert "while IFS= read -r -d '' fuzzer; do" in text
+    assert "for fuzzer in $(find" not in text
+
+
 def test_dom_builder_fuzzer_smoke_mode_runs_without_cluster():
     completed = subprocess.run(
         [

tests/test_release_pipeline.py

@@ -110,27 +110,36 @@ def test_release_attestation_export_script_writes_named_intoto_files(
     downloaded = tmp_path / f"sha256:{digest}.jsonl"
     downloaded.write_text('{"bundle": true}', encoding="utf-8")
 
-    calls: list[list[str]] = []
+    calls: list[tuple[list[str], bool, Path | None]] = []
 
-    def fake_run(cmd, check):
-        calls.append(cmd)
+    def fake_run(cmd, check, cwd=None):
+        calls.append((cmd, check, cwd))
         assert check is True
 
+    monkeypatch.setattr(
+        "scripts.release.export_release_attestations.shutil.which",
+        lambda executable: "/usr/local/bin/gh" if executable == "gh" else None,
+    )
+
     monkeypatch.setattr(
         "scripts.release.export_release_attestations.subprocess.run", fake_run
     )
 
     export_attestations(dist, "Seongho-Bae/newsdom-api", working_dir=tmp_path)
 
     assert calls == [
-        [
-            "gh",
-            "attestation",
-            "download",
-            str(artifact),
-            "-R",
-            "Seongho-Bae/newsdom-api",
-        ]
+        (
+            [
+                "/usr/local/bin/gh",
+                "attestation",
+                "download",
+                str(artifact.resolve()),
+                "-R",
+                "Seongho-Bae/newsdom-api",
+            ],
+            True,
+            tmp_path,
+        )
     ]
     assert (dist / "demo.whl.intoto.jsonl").read_text(
         encoding="utf-8"