fuzz.yml

name: fuzz

# H-27 wants >=30 DAYS of coverage-guided fuzzing with zero open crashers.
# That is a calendar quantity, so it has to accrue on a schedule rather than
# in a release scramble: this runs nightly, CARRIES THE CORPUS FORWARD via
# the actions cache (without that, every night restarts from the seeds and
# the coverage never compounds), and files an issue the moment a crasher
# appears. The per-PR smoke job lives in ci.yml and does a different job —
# it proves the targets still build and run.
on:
  schedule:
    - cron: "0 3 * * *"
  workflow_dispatch:
    inputs:
      minutes:
        description: "Minutes per target"
        default: "30"

permissions:
  contents: read
  issues: write

jobs:
  fuzz:
    strategy:
      fail-fast: false
      matrix:
        # `corruption` is pointed at the free-list link CHECK rather than at a
        # workload, so it is the one target that needs `secure` — without it
        # the check is not compiled in and the target has nothing to hunt
        # false positives in.
        include:
          - target: alloc_ops
            features: ""
          - target: xthread
            features: ""
          - target: corruption
            features: "--features secure"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772
        with:
          toolchain: nightly
      - name: install cargo-fuzz (pinned)
        run: cargo install cargo-fuzz --version 0.13.2 --locked

      # The corpus is the accumulated coverage. Restore yesterday's, fuzz on
      # top of it, save it back under a run-unique key so each night's
      # findings survive.
      - name: restore corpus
        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: fuzz/corpus/${{ matrix.target }}
          key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
          restore-keys: fuzz-corpus-${{ matrix.target }}-

      - name: fuzz
        run: |
          mins="${{ github.event.inputs.minutes || '30' }}"
          cargo +nightly fuzz run ${{ matrix.target }} ${{ matrix.features }} -- \
            -max_total_time=$((mins * 60)) -print_final_stats=1

      - name: save corpus
        if: always()
        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: fuzz/corpus/${{ matrix.target }}
          key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}

      # A crasher must not sit in a log nobody reads. Keep the input as an
      # artifact (it becomes the regression test) and open an issue.
      - name: upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: fuzz-crash-${{ matrix.target }}
          path: fuzz/artifacts/${{ matrix.target }}
          if-no-files-found: ignore

      - name: file an issue on a crasher
        if: failure()
        uses: actions/github-script@10b53a9ec6c222bb4ce97aa6bd2b5f739696b536 # v7
        with:
          script: |
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `fuzz: ${{ matrix.target }} crasher on ${context.sha.slice(0,7)}`,
              body: `The nightly fuzz job for \`${{ matrix.target }}\` failed.\n\n` +
                    `Run: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}\n\n` +
                    `The reproducer is attached to that run as an artifact. Per H-27, every ` +
                    `past crasher becomes a regression test before the gate can read clean again.`,
              labels: ['security', 'fuzz']
            })