[xsscx]

PR Summary

#2866

Checklist

• Signed all Commits in PR
• Built locally according to docs/build.md
• Followed the guidelines in Contributing document
• Ran relevant CTest/profile tests from docs/ctest.md
• Updated documentation for user-visible behavior changes
• Ran sanitizer coverage for memory-safety or parser changes
• Added or updated regression coverage for behavior changes
• Attached a base...HEAD contract matrix for cross-cutting changes:
  producer, consumer, build/runtime behavior, platform/toolchain boundary,
  CI trigger, dependency owner, and local evidence
• Reviewed active and suppressed automated findings from review threads and summaries
• For Python package changes, followed docs/python-packaging-release.md for PR and merge requirements
• Did not change maintainer-owned workflow, CTest, CPack, sanitizer, release, or security infrastructure unless requested by an iccDEV maintainer
• New source files include the ICC copyright and BSD 3-Clause license header
• Code style matches nearby code: 2-space indent, K&R braces, m_ members

Legal Requirements

All official software projects hosted by the International Color Consortium (ICC)
follows the open source software best practice policies. The International Color Consortium IP policy governs ICC specification development and contributions to ICC open source software. Software contributions are also covered by the Contributor License Agreement (CLA).

Contributor License Agreements

Developers who wish to contribute code to be considered for inclusion
in ICC software must first complete a Contributor License Agreement
(CLA).

There is no cost or membership requirement to sign the ICC Contributor License Agreement (CLA). Please note that this is different from membership in the International Color Consortium (ICC). If your organization relies on our projects, please become a member. Membership dues are an essential source of funding and investment for these projects.

• If you are an individual writing the code on your own time and you are SURE you are the sole owner of any intellectual property you contribute, you can sign the CLA as an individual contributor.

• If you are writing the code as part of your job, or if there is any possibility that your employer might think they own any intellectual property you create, then you should use the Corporate Contributor Licence Agreement

License

ICC software is licensed under the BSD 3-Clause "New" or "Revised" License. Contributions to ICC software projects should abide by that license unless otherwised specified or approved by the ICC.

Copyright Notices

All new source files must begin with the ICC Copyright notice and include or reference the BSD 3-Clause "New" or "Revised" License.

INTELLECTUAL PROPERTY & PATENTS

Participation in ICC's development activities is subject to ICC's Patent Policy.

Maintainer Review Required

If you have questions, contact a listed Maintainer.

[Copilot]

🟡 Changes recommended

Default CFL dependencies, patch application paths, and corpus retention logic have confirmed correctness issues.

3 open issues

• Enable dependencies for XML and JSON CLI wrapper targets · New
• Do not infer corpus emptiness from compressed size · New
• Apply patches from target checkout, not workflow-scripts · New

What changed in this PR

Updates CI dependencies, restores manual fuzz-smoke workflows, and reduces the regression container’s CodeQL footprint for #2866.

Changes:

• Adds manual/reusable AFL and CFL workflows with pinned AFL++ tooling.
• Refreshes dependency pins and validates retained CodeQL languages.
• Updates corpus cleanup, configuration checks, and maintainer guidance.

File	Description
docs/​regression-container.md	Documents retained CodeQL languages.
docs/​afl-fuzzing.md	Updates smoke usage and AFL++ pin.
Dockerfile	Updates Ubuntu digest and trims CodeQL.
.github/​workflows/​ci-preflight-safety.yml	Updates zizmor.
.github/​workflows/​ci-pr-risk-security-analysis.yml	Updates zizmor.
.github/​workflows/​ci-iccdev-tool-tests.yml	Refreshes spectral-preview dependencies.
.github/​workflows/​ci-docker.yml	Checks CodeQL language availability.
.github/​workflows/​ci-clusterfuzzlite.yml	Updates checkout pins.
.github/​workflows/​ci-cfl-smoke.yml	Adds manual/reusable CFL smoke.
.github/​workflows/​ci-afl-smoke.yml	Adds manual/reusable AFL smoke.
.github/​skills/​afl-smoke/​SKILL.md	Pins AFL++ bootstrap guidance.
.github/​scripts/​iccdev-clusterfuzzlite-config-tests.sh	Checks smoke workflow contracts.
.github/​scripts/​iccdev-cfl-artifact-cleanup.sh	Adds corpus-size filtering.
.github/​scripts/​iccdev-cfl-artifact-cleanup-tests.sh	Tests size-aware artifact selection.
.github/​prompts/​maintainer-afl-smoke.prompt.md	Aligns AFL++ pin guidance.
.github/​ci/​requirements/​docker-workflow-qa.txt	Updates container zizmor.
.github/​ci/​requirements/​docker-spectral-preview.txt	Refreshes image dependencies.
.github/​ci/​docker/​iccdev-fuzz-env.sh	Updates displayed bootstrap guidance.

_{Review effort: Balanced}