fuzz.yml

name: Fuzz

# Canonicalization is security-critical (`v0.1 §2.3`): two distinct actions sharing a canonical
# form share an approval, and nothing in a receipt would look wrong. `Policy.from_yaml` promises
# in its docstring that anything malformed raises `PolicyError`. Both are properties rather than
# examples, so both are fuzzed. `fuzz/properties.py` holds the invariants; this runs them.

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "23 4 * * 1"

permissions:
  contents: read

jobs:
  fuzz:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install
        run: |
          pip install --require-hashes -r requirements/fuzz.txt
          pip install --no-deps --no-build-isolation -e .

      # The gate. No Atheris, so it cannot be skipped by a toolchain problem, and it fails on
      # a seed that regressed rather than on a campaign that happened to find one.
      - name: The seed corpus still holds
        run: |
          python fuzz/fuzz_canonical.py --corpus
          python fuzz/fuzz_policy.py --corpus

      # Atheris is a real dependency and a failure to install it is a red build, not a skip:
      # a fuzzing job that quietly stops fuzzing is the false green this repository keeps
      # finding in other costumes.
      - name: Install Atheris
        run: pip install --require-hashes -r requirements/atheris.txt

      # Bounded, or an unbounded `atheris.Fuzz()` hangs until the job timeout, which reads as a
      # broken build rather than as a finding. `-runs` is not used: wall-clock is what makes a
      # pull request's campaign the same size on a fast and a slow runner.
      - name: Campaign
        run: |
          python fuzz/fuzz_canonical.py -max_total_time=120 -print_final_stats=1 fuzz/corpus/canonical
          python fuzz/fuzz_policy.py -max_total_time=120 -print_final_stats=1 fuzz/corpus/policy

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: failure()
        with:
          name: crashes
          path: |
            crash-*
            timeout-*
            oom-*
          if-no-files-found: ignore
          retention-days: 14