Security Deep nightly is failing

[github-actions]

Security Deep failed on run 26675421992.

• Kani: success
• Fuzzing: success
• Atheris: failure
• Miri: success
• Sanitizers: success

Run: https://github.com/cachekit-io/cachekit-py/actions/runs/26675421992

[27Bslash6]

Triage (this issue was auto-filed by the new alert step in PR #137, dispatched run 26675421992):

Fixed by #137 (verified green in that run):

• Sanitizers (address/thread/memory) — were EXDEV os error 18
• Kani — was exit 127 (cargo-kani not on PATH)
• Extended Fuzzing — was the cargo-fuzz/rustix nightly build failure

Remaining red: Atheris. Root cause is not a workflow bug — atheris==2.3.0 fails to build because clang/libFuzzer is not present on the cachekit ARC runner:

Failed to find libFuzzer; set either $CLANG_BIN to point to your Clang
binary, or $LIBFUZZER_LIB to point directly to your libFuzzer

Fix belongs in the ARC runner image (runner/), not here: bake in clang + compiler-rt (libFuzzer) and expose CLANG_BIN. Secondary: the job resolved CPython 3.14, which atheris==2.3.0 also doesn't support — pin the Atheris job to 3.12 once clang is available.

Until the runner has clang, Security Deep Success will stay red on Atheris alone. This issue will keep being updated (not duplicated) by the dedup in the alert step.

[github-actions]

Security Deep failed on run 26693957972.

• Kani: success
• Fuzzing: success
• Atheris: failure
• Miri: success
• Sanitizers: success

Run: https://github.com/cachekit-io/cachekit-py/actions/runs/26693957972

[27Bslash6]

Resolved by #142 (ci: pin Atheris fuzzing job to Python 3.11, merged 2026-05-31).

Root cause: the atheris-fuzzing job had no Python pin, so uv floated to cpython 3.14, for which atheris 2.3.0 ships no wheel. uv fell back to an sdist build (find_libfuzzer.sh needs clang + libFuzzer, absent on the self-hosted runner), so uv sync failed before any fuzzing ran — an install error, not a fuzz finding. #142 pins the job to Python 3.11 (newest interpreter with an atheris cp311 wheel).

Security Deep has been green on every nightly run since 2026-06-01 (latest verified: 2026-06-05). Closing as fixed.