feat(tools): enhance dependency management for tools requiring specif… #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Fuzz Testing | ||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
| schedule: | ||
| # Run weekly fuzz testing (Sunday at 2 AM UTC) | ||
| - cron: '0 2 * * 0' | ||
| workflow_dispatch: | ||
| inputs: | ||
| fuzz_duration: | ||
| description: 'Fuzz duration in seconds' | ||
| required: false | ||
| default: '60' | ||
| env: | ||
| CARGO_TERM_COLOR: always | ||
| jobs: | ||
| fuzz-pr: | ||
| name: Quick Fuzz (PR) | ||
| runs-on: ubuntu-latest | ||
| if: github.event_name == 'pull_request' || github.event_name == 'push' | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| target: | ||
| - fuzz_config_parser | ||
| - fuzz_version_parser | ||
| - fuzz_toml_input | ||
| - fuzz_tool_spec | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Rust nightly | ||
| uses: dtolnay/rust-toolchain@nightly | ||
| - name: Install cargo-fuzz | ||
| run: cargo install cargo-fuzz | ||
| - name: Rust cache | ||
| uses: swatinem/rust-cache@v2 | ||
| - name: Run fuzz target (60 seconds) | ||
| run: | | ||
| cd fuzz | ||
| cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=60 | ||
| continue-on-error: true | ||
| - name: Upload crash artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| if: failure() | ||
| with: | ||
| name: fuzz-crashes-${{ matrix.target }} | ||
| path: fuzz/artifacts/ | ||
| retention-days: 30 | ||
| fuzz-scheduled: | ||
| name: Extended Fuzz (Scheduled) | ||
| runs-on: ubuntu-latest | ||
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| target: | ||
| - fuzz_config_parser | ||
| - fuzz_version_parser | ||
| - fuzz_toml_input | ||
| - fuzz_tool_spec | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Rust nightly | ||
| uses: dtolnay/rust-toolchain@nightly | ||
| - name: Install cargo-fuzz | ||
| run: cargo install cargo-fuzz | ||
| - name: Rust cache | ||
| uses: swatinem/rust-cache@v2 | ||
| - name: Download existing corpus | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: fuzz-corpus-${{ matrix.target }} | ||
| path: fuzz/corpus/${{ matrix.target }} | ||
| continue-on-error: true | ||
| - name: Run fuzz target (extended) | ||
| run: | | ||
| cd fuzz | ||
| DURATION=${{ github.event.inputs.fuzz_duration || '28800' }} | ||
| echo "Running fuzz target for ${DURATION} seconds..." | ||
| cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=${DURATION} | ||
| continue-on-error: true | ||
| - name: Upload corpus | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: fuzz-corpus-${{ matrix.target }} | ||
| path: fuzz/corpus/${{ matrix.target }} | ||
| retention-days: 90 | ||
| - name: Upload crash artifacts | ||
| uses: actions/upload-artifact@v4 | ||
| if: failure() | ||
| with: | ||
| name: fuzz-crashes-${{ matrix.target }} | ||
| path: fuzz/artifacts/ | ||
| retention-days: 90 | ||
| - name: Create issue on crash | ||
| if: failure() | ||
| uses: actions/github-script@v7 | ||
| with: | ||
| script: | | ||
| const fs = require('fs'); | ||
| const artifactPath = 'fuzz/artifacts/${{ matrix.target }}'; | ||
| if (fs.existsSync(artifactPath)) { | ||
| const crashes = fs.readdirSync(artifactPath); | ||
| if (crashes.length > 0) { | ||
| await github.rest.issues.create({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| title: `[Fuzz] Crash found in ${{ matrix.target }}`, | ||
| body: `## Fuzz Testing Crash Report | ||
| **Target:** \`${{ matrix.target }}\` | ||
| **Workflow Run:** ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId} | ||
| ### Crashes Found | ||
| ${crashes.map(c => `- \`${c}\``).join('\n')} | ||
| ### Next Steps | ||
| 1. Download the crash artifacts from the workflow run | ||
| 2. Reproduce locally with \`cargo +nightly fuzz run ${{ matrix.target }} <crash_input>\` | ||
| 3. Fix the issue and add a regression test | ||
| /label bug fuzz`, | ||
| labels: ['bug', 'fuzz'] | ||
| }); | ||
| } | ||
| } | ||
| continue-on-error: true | ||
