test: expose Jazzer fuzzing and require code owners (#27)

* ci: require code owner review

Signed-off-by: kriptoburak <kriptoburak@users.noreply.github.com>

* docs: license code owner policy

Signed-off-by: kriptoburak <kriptoburak@users.noreply.github.com>

* test: expose Jazzer fuzzing to Scorecard

Signed-off-by: kriptoburak <kriptoburak@users.noreply.github.com>

---------

Signed-off-by: kriptoburak <kriptoburak@users.noreply.github.com>
Co-authored-by: kriptoburak <kriptoburak@users.noreply.github.com>

Author: Burak Bayır

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# SPDX-FileCopyrightText: 2026 Xquik Contributors
+# SPDX-License-Identifier: Apache-2.0
+
+* @kriptoburak @furkanerday

buildSrc/src/main/kotlin/x-twitter-scraper.java.gradle.kts

@@ -32,6 +32,11 @@ tasks.withType<JavaCompile>().configureEach {
     options.release.set(8)
 }
 
+tasks.named<JavaCompile>("compileTestJava") {
+    // Tests use Java 26 dependencies and never enter published artifacts.
+    options.release.set(26)
+}
+
 tasks.withType<Zip>().configureEach {
     isPreserveFileTimestamps = false
     isReproducibleFileOrder = true

buildSrc/src/main/kotlin/x-twitter-scraper.kotlin.gradle.kts

@@ -5,6 +5,7 @@
 import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 import org.jetbrains.kotlin.gradle.dsl.JvmDefaultMode
 import org.jetbrains.kotlin.gradle.dsl.KotlinVersion
+import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
 
 plugins {
     id("x-twitter-scraper.java")
@@ -42,6 +43,13 @@ tasks.withType<Test>().configureEach {
     inputs.property("skipMockTests", System.getenv("SKIP_MOCK_TESTS")).optional(true)
 }
 
+tasks.named<KotlinCompile>("compileTestKotlin") {
+    compilerOptions {
+        freeCompilerArgs.set(emptyList())
+        jvmTarget.set(JvmTarget.JVM_26)
+    }
+}
+
 val ktfmt = configurations.create("ktfmt")
 dependencies {
     ktfmt("com.facebook:ktfmt:0.64")

x-twitter-scraper-java-core/src/test/java/com/x_twitter_scraper/api/core/http/RetryAfterFuzzInput.java

@@ -0,0 +1,16 @@
+// SPDX-FileCopyrightText: 2026 Xquik contributors
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package com.x_twitter_scraper.api.core.http;
+
+import com.code_intelligence.jazzer.api.FuzzedDataProvider;
+
+final class RetryAfterFuzzInput {
+
+    private RetryAfterFuzzInput() {}
+
+    static String consume(FuzzedDataProvider data) {
+        return data.consumeRemainingAsString();
+    }
+}

x-twitter-scraper-java-core/src/test/kotlin/com/x_twitter_scraper/api/core/http/RetryAfterFuzzTest.kt

@@ -16,7 +16,7 @@ internal class RetryAfterFuzzTest {
 
     @FuzzTest(maxDuration = "30s")
     fun retryAfterDelayRemainsBounded(data: FuzzedDataProvider) {
-        val retryAfter = data.consumeRemainingAsString()
+        val retryAfter = RetryAfterFuzzInput.consume(data)
         val sleeper = RecordingRetrySleeper()
         val transport =
             SequenceHttpClient(