ygo/.github/workflows/fuzz.yml at main · Deln0r/ygo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
name: fuzz

# Continuous fuzzing of the untrusted-input decode paths (update apply,
# state vector, delete set, Any values, awareness presence, sync frames,
# lib0 primitives). The committed seed corpus already runs as regression
# tests in the main `test` job; this workflow does NEW exploration.
#
# A `discover` job enumerates every FuzzXxx target and emits a matrix, so
# the target list never has to be maintained by hand. The `fuzz` job then
# runs one matrix leg per target IN PARALLEL: a long burst on the nightly
# schedule, a short smoke burst on any change to a decode path. Running
# legs in parallel (rather than one serial loop) lets each target get a
# much longer nightly budget at a sane wall-clock, isolates a crasher to
# its own leg (fail-fast is off), and uploads a per-target crasher corpus.
on:
  schedule:
    - cron: "0 6 * * *" # daily 06:00 UTC
  push:
    branches: [main]
    paths:
      - "internal/lib0/**"
      - "internal/encoding/**"
      - "internal/awareness/**"
      - "internal/sync/**"
      - "internal/block/**"
      - "internal/types/**"
      - "internal/undo/**"
      - ".github/workflows/fuzz.yml"
  pull_request:
    branches: [main]
    paths:
      - "internal/lib0/**"
      - "internal/encoding/**"
      - "internal/awareness/**"
      - "internal/sync/**"
      - "internal/block/**"
      - "internal/types/**"
      - "internal/undo/**"
  workflow_dispatch:

jobs:
  discover:
    name: discover targets
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.list.outputs.matrix }}
    steps:
      - uses: actions/checkout@v6
      - id: list
        name: enumerate fuzz targets
        run: |
          set -euo pipefail
          entries=$(grep -rl '^func Fuzz' --include='*_test.go' . | while IFS= read -r f; do
            dir=$(dirname "$f")
            grep -oE '^func (Fuzz[A-Za-z0-9_]+)' "$f" \
              | awk -v d="${dir#./}" '{printf "{\"pkg\":\"%s\",\"func\":\"%s\"}\n", d, $2}'
          done | paste -sd, -)
          echo "matrix={\"include\":[$entries]}" >> "$GITHUB_OUTPUT"

  fuzz:
    name: fuzz ${{ matrix.func }}
    needs: discover
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.discover.outputs.matrix) }}
    env:
      # Long continuous run on the nightly schedule; a quick burst on
      # push / PR. Legs run in parallel, so the nightly budget is per
      # target, not summed across them.
      FUZZTIME: ${{ github.event_name == 'schedule' && '600s' || '40s' }}
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: "1.24"
      - name: go mod download
        run: go mod download
      - name: fuzz ${{ matrix.func }} (${{ env.FUZZTIME }})
        run: go test -run='^$' -fuzz="^${{ matrix.func }}$" -fuzztime="${FUZZTIME}" "./${{ matrix.pkg }}"
      - name: upload crashers
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: fuzz-crashers-${{ matrix.func }}
          path: "${{ matrix.pkg }}/testdata/fuzz/**"
          if-no-files-found: ignore