Building GitLab with GitLab: Web API Fuzz Testing

This post details the implementation of Web API Fuzz Testing within GitLab, focusing on the technical challenges and solutions encountered. Key contributions include: auto-generating OpenAPI specifications from Grape annotations by adapting the `grape-swagger` gem to handle edge cases like file parameters (WorkhorseFile) and wildcard segments; performance tuning strategies for large APIs, including using multi-CPU runners, excluding slow operations, splitting tests into multiple jobs, and dynamically generating child pipelines; and the process of triaging fuzzing findings, leveraging Postman collections and the GitLab Development Kit for debugging.