Add fuzz target to make (#6828)

Co-authored-by: Claude <claude@anthropic.com>

server/forge/github/convert.go

@@ -164,7 +164,7 @@ func convertRepoHook(eventRepo *github.PushEventRepository) *model.Repo {
 func convertLabels(from []*github.Label) []string {
 	labels := make([]string, len(from))
 	for i, label := range from {
-		labels[i] = *label.Name
+		labels[i] = label.GetName()
 	}
 	return labels
 }

server/forge/github/fuzz_test.go

@@ -0,0 +1,54 @@
+// Copyright 2026 Woodpecker Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package github
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// FuzzParseHookPayload feeds untrusted webhook payloads of arbitrary event
+// types into the payload parser. The property checked is that parsing never
+// panics, no matter how malformed the payload or event type is.
+func FuzzParseHookPayload(f *testing.F) {
+	fixtures, err := filepath.Glob(filepath.Join("fixtures", "*.json"))
+	if err != nil {
+		f.Fatal(err)
+	}
+	for _, fixture := range fixtures {
+		data, err := os.ReadFile(fixture)
+		if err != nil {
+			f.Fatal(err)
+		}
+		// derive the event type from the fixture name (HookPush.json -> push)
+		webhookType := "push"
+		name := filepath.Base(fixture)
+		switch {
+		case strings.HasPrefix(name, "HookPullRequest"):
+			webhookType = "pull_request"
+		case strings.HasPrefix(name, "HookDeploy"):
+			webhookType = "deployment"
+		case strings.HasPrefix(name, "HookRelease"):
+			webhookType = "release"
+		}
+		f.Add(webhookType, data, true)
+	}
+
+	f.Fuzz(func(_ *testing.T, webhookType string, raw []byte, merge bool) {
+		_, _, _, _, _, _ = parseHookPayload(webhookType, raw, merge)
+	})
+}

server/forge/github/parse.go

@@ -56,7 +56,7 @@ const (
 
 // parseHook parses a GitHub hook from an http.Request request and returns
 // Repo and Pipeline detail. If a hook type is unsupported nil values are returned.
-func parseHook(r *http.Request, merge bool) (_ *github.PullRequest, _ *model.Repo, _ *model.Pipeline, currCommit, prevCommit string, _ error) {
+func parseHook(r *http.Request, merge bool) (*github.PullRequest, *model.Repo, *model.Pipeline, string, string, error) {
 	var reader io.Reader = r.Body
 
 	if payload := r.FormValue(hookField); payload != "" {
@@ -68,7 +68,14 @@ func parseHook(r *http.Request, merge bool) (_ *github.PullRequest, _ *model.Rep
 		return nil, nil, nil, "", "", err
 	}
 
-	payload, err := github.ParseWebHook(github.WebHookType(r), raw)
+	return parseHookPayload(github.WebHookType(r), raw, merge)
+}
+
+// parseHookPayload parses a raw GitHub hook payload of the given webhook type
+// and returns Repo and Pipeline detail. If a hook type is unsupported nil
+// values are returned.
+func parseHookPayload(webhookType string, raw []byte, merge bool) (_ *github.PullRequest, _ *model.Repo, _ *model.Pipeline, currCommit, prevCommit string, _ error) {
+	payload, err := github.ParseWebHook(webhookType, raw)
 	if err != nil {
 		return nil, nil, nil, "", "", err
 	}
@@ -216,7 +223,7 @@ func parsePullHook(hook *github.PullRequestEvent, merge bool) (*github.PullReque
 			hook.GetPullRequest().GetHead().GetRef(),
 			hook.GetPullRequest().GetBase().GetRef(),
 		),
-		PullRequestLabels:    convertLabels(hook.GetPullRequest().Labels),
+		PullRequestLabels:    convertLabels(hook.GetPullRequest().GetLabels()),
 		PullRequestMilestone: hook.GetPullRequest().GetMilestone().GetTitle(),
 		PullRequestDraft:     hook.GetPullRequest().GetDraft(),
 		FromFork:             fromFork,