ossf/OSS-CRS scan

Build and fuzz/analyze one harness of an OSS-Fuzz-format project with any OSS-CRS engine.

Trust Signals

name	description	required	default
harness	Harness name to fuzz (e.g. parse_class; see the project's build.sh).	yes	—
crs	CRS engine. Bundled: crs-bug-finding-claude-code. For any other registry CRS, pass its compose via compose-file (see composes/ for the pattern).	no	crs-bug-finding-claude-code
proj-path	OSS-Fuzz project path passed as --fuzz-proj-path.	no	oss-fuzz
image	OSS-CRS runner image.	no	ghcr.io/ossf/oss-crs-runner:latest
compose-file	Path (in the checkout) to a CRS compose file. Empty = use the compose bundled for `crs`. Set this to run any registry CRS that isn't bundled.	no	""
litellm-config	Path (in the checkout) to a LiteLLM config for proxy-based LLM CRSs. Empty = use the bundled per-CRS default (composes/<crs>.litellm-config.yaml).	no	""
timeout	Fuzzing/analysis budget in seconds for the run phase.	no	300
fail-on-crash	Exit non-zero when a PoV/crash is found (true for presubmit; false to report only).	no	true
env	Credentials/config to forward into the CRS container, one KEY=VALUE per line. Values come from your caller's secrets, e.g. env: \| CLAUDE_CODE_OAUTH_TOKEN=${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} Each name is forwarded to the container (value never appears in logs); the chosen CRS's compose / LiteLLM config decides which names it reads.	no	""

name	description
crashed	'true' if at least one PoV/crash was found.
artifacts-dir	Directory holding collected PoVs and logs.