# Fuzzing lives on `cargo fuzz`, which needs a nightly toolchain and must never
# be part of the stable `cargo clippy --workspace` gate in ci.yml (ci.sh only
# checks that the fuzz crate still compiles on stable). This workflow is
# therefore SCHEDULED (not a PR gate) and starts from the corpus checked into
# this repo under `fuzz/corpus/node/`.
#
# The 24 CPU-hour release budget (spec §7) is spent by hand before a release;
# this scheduled run uses a modest per-run budget so it stays cheap while still
# re-executing every known input.

name: Fuzz

on:
  schedule:
    # Daily at 00:05 UTC. Deliberately not push/PR — the nightly + cargo-fuzz
    # toolchain is slow to install/build and has no place in a review gate.
    - cron: "5 0 * * *"
  workflow_dispatch: {}

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  fuzz-node:
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      # rust-toolchain.toml pins stable, which overrides `rustup default`, so
      # every cargo call below names `+nightly` explicitly (cargo-fuzz passes
      # `-Z` flags that only nightly accepts).
      - name: Install nightly toolchain + cargo-fuzz
        run: |
          rustup toolchain install nightly --profile minimal --component rust-src
          cargo +nightly install cargo-fuzz --locked

      - name: Run the Node harness from the checked-in corpus
        # Re-runs every corpus entry first, then keeps fuzzing for the budget.
        # Both input modes (basic and adversarial, chosen by the first input
        # byte) run in the one `node` target.
        run: cargo +nightly fuzz run node -- -max_total_time=1800

      # A crash leaves its reproducer under fuzz/artifacts/node/. Reproduce
      # with `cargo +nightly fuzz run node <file>`.
      - name: Upload crash reproducers
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: fuzz-artifacts-node
          path: fuzz/artifacts/node/
          if-no-files-found: ignore
          retention-days: 30

      # New inputs found by this run exist only on the runner and in this
      # 7-day artifact; nothing commits them back. To keep them, download the
      # artifact, minimise with `cargo +nightly fuzz cmin node`, and commit.
      - name: Upload grown corpus
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: fuzz-corpus-node
          path: fuzz/corpus/node/
          if-no-files-found: ignore
          retention-days: 7