Polyweb/.github/workflows/fuzz.yml at main · BlueCannonBall/Polyweb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
name: Fuzz

on:
  push:
  pull_request:
  schedule:
    # Minute drawn at random rather than picked, since scheduled jobs are delayed most
    # when everyone reaches for the same round number
    - cron: '11 4 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  seeds:
    name: Seeds (${{ matrix.target }})
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        target: [http_request, http_response, websocket, url, decoders]
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive

      # The Clang the distribution ships cannot compile std::expected against the
      # libstdc++ beside it, and its libc++ has no std::move_only_function
      - name: Install OpenSSL development files and Clang
        run: |
          sudo apt-get update && sudo apt-get install --yes libssl-dev
          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
          chmod +x /tmp/llvm.sh
          sudo /tmp/llvm.sh 20
          echo "CXX=clang++-20" >> "$GITHUB_ENV"

      # A short run from the seeds alone, to catch a change that breaks the parser badly
      # enough to crash on a message that is known to be good. Finding anything new is the
      # nightly job's business, since a corpus built from nothing in a minute finds little
      - name: Fuzz from the seeds
        working-directory: tests/fuzz
        run: |
          ./build.sh ${{ matrix.target }}
          ./${{ matrix.target }} corpus/${{ matrix.target }} seeds/${{ matrix.target }} \
            -max_total_time=30 -max_len=8192

      - name: Upload crashes
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: crashes-seeds-${{ matrix.target }}
          path: |
            tests/fuzz/crash-*
            tests/fuzz/leak-*
            tests/fuzz/timeout-*
            tests/fuzz/oom-*
          if-no-files-found: ignore

  nightly:
    name: Nightly (${{ matrix.target }})
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        target: [http_request, http_response, websocket, url, decoders]
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive

      # The Clang the distribution ships cannot compile std::expected against the
      # libstdc++ beside it, and its libc++ has no std::move_only_function
      - name: Install OpenSSL development files and Clang
        run: |
          sudo apt-get update && sudo apt-get install --yes libssl-dev
          wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
          chmod +x /tmp/llvm.sh
          sudo /tmp/llvm.sh 20
          echo "CXX=clang++-20" >> "$GITHUB_ENV"

      # A cache entry can only be written once, so the key carries the run id and the
      # prefix restores the newest one there is. A fixed key would freeze the corpus at
      # whatever the first run produced and quietly never grow it again
      - name: Restore the corpus
        uses: actions/cache@v4
        with:
          path: tests/fuzz/corpus/${{ matrix.target }}
          key: fuzz-${{ matrix.target }}-${{ github.run_id }}
          restore-keys: fuzz-${{ matrix.target }}-

      - name: Fuzz
        working-directory: tests/fuzz
        run: |
          ./build.sh ${{ matrix.target }}
          ./${{ matrix.target }} corpus/${{ matrix.target }} seeds/${{ matrix.target }} \
            -max_total_time=600 -max_len=8192

      # Keeps only what still earns its coverage, so the corpus does not grow without
      # bound and slow down every run after this one
      - name: Minimise the corpus
        working-directory: tests/fuzz
        run: |
          mkdir -p minimised
          ./${{ matrix.target }} -merge=1 minimised corpus/${{ matrix.target }} seeds/${{ matrix.target }}
          rm -rf corpus/${{ matrix.target }}
          mv minimised corpus/${{ matrix.target }}

      - name: Upload crashes
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: crashes-nightly-${{ matrix.target }}
          path: |
            tests/fuzz/crash-*
            tests/fuzz/leak-*
            tests/fuzz/timeout-*
            tests/fuzz/oom-*
          if-no-files-found: ignore