Push CI is configured only for main, so dev pushes receive no automatic validation. The fuzz job only builds targets, Valgrind runs only the unit binary, and TLS multithread coverage is xfailed. SSH tests were also previously collected with a module-time false skip (fixed on the triage branch).
Location
.gitea/workflows/ci.yaml:3-7,62-74,99-115
tests/integration/test_tls.py:145-167
Validation
Inspect workflow triggers and job commands; fuzz targets are never run and Valgrind never exercises server/network paths.
Suggested implementation
Trigger CI for dev, run each fuzz target for bounded sanitizer iterations with seed corpora, add representative integration execution under Valgrind where feasible, and remove the TLS xfail once the supported multithreaded path is reliable. Enforce a documented coverage threshold.
## Severity
Medium
## Description
Push CI is configured only for main, so dev pushes receive no automatic validation. The fuzz job only builds targets, Valgrind runs only the unit binary, and TLS multithread coverage is xfailed. SSH tests were also previously collected with a module-time false skip (fixed on the triage branch).
## Location
- .gitea/workflows/ci.yaml:3-7,62-74,99-115
- tests/integration/test_tls.py:145-167
## Validation
Inspect workflow triggers and job commands; fuzz targets are never run and Valgrind never exercises server/network paths.
## Suggested implementation
Trigger CI for dev, run each fuzz target for bounded sanitizer iterations with seed corpora, add representative integration execution under Valgrind where feasible, and remove the TLS xfail once the supported multithreaded path is reliable. Enforce a documented coverage threshold.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity
Medium
Description
Push CI is configured only for main, so dev pushes receive no automatic validation. The fuzz job only builds targets, Valgrind runs only the unit binary, and TLS multithread coverage is xfailed. SSH tests were also previously collected with a module-time false skip (fixed on the triage branch).
Location
Validation
Inspect workflow triggers and job commands; fuzz targets are never run and Valgrind never exercises server/network paths.
Suggested implementation
Trigger CI for dev, run each fuzz target for bounded sanitizer iterations with seed corpora, add representative integration execution under Valgrind where feasible, and remove the TLS xfail once the supported multithreaded path is reliable. Enforce a documented coverage threshold.