53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
# Fuzzing lives on `cargo fuzz`, which needs a nightly toolchain and must never
|
|
# be part of the stable `cargo clippy --workspace` gate in ci.yml. This workflow
|
|
# is therefore SCHEDULED (not a PR push/PR gate) and runs against the corpus
|
|
# that is checked into this repo under `fuzz/corpus/node/`.
|
|
#
|
|
# The 24 CPU-hour budget mentioned in Task 12 is release-time; this scheduled run
|
|
# uses a modest per-run budget so it stays cheap while still re-executing every
|
|
# known input and continuing to grow the corpus.
|
|
|
|
name: Fuzz
|
|
|
|
on:
|
|
schedule:
|
|
# Daily at 00:05 UTC. Deliberately not push/PR — the nightly + cargo-fuzz
|
|
# toolchain is slow to install/build and has no place in a review gate.
|
|
- cron: "5 0 * * *"
|
|
workflow_dispatch: {}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
fuzz-node:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 120
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
# The corpus is committed, so the run continues where it left off and
|
|
# re-runs every known crashing/non-crashing input on each schedule.
|
|
fetch-depth: 0
|
|
|
|
- name: Install nightly toolchain + cargo-fuzz
|
|
run: |
|
|
rustup toolchain install nightly --profile minimal --component rust-src
|
|
rustup default nightly
|
|
cargo install cargo-fuzz
|
|
|
|
- name: Run the Node harness against the checked-in corpus
|
|
# Re-runs every corpus entry (fast path) and then continues fuzzing for
|
|
# the run budget. The corpus directory is part of the repo, so it grows
|
|
# in place across schedules; a fresh checkout still has prior inputs.
|
|
run: cargo fuzz run node -- -max_total_time=1800
|
|
|
|
- name: Upload corpus artifacts (optional retention)
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: fuzz-corpus-node
|
|
path: fuzz/corpus/node/
|
|
if-no-files-found: ignore
|
|
retention-days: 7
|