flowsdk/.github/workflows/clusterfuzzlite.yml at main · emqx/flowsdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
name: ClusterFuzzLite Continuous Fuzzing

on:
  # Run on pull requests for PR fuzzing
  pull_request:
    branches: [main]
    paths:
      - 'src/**'
      - 'fuzz/**'
      - '.clusterfuzzlite/**'

  # Run on pushes to main for batch fuzzing
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'fuzz/**'
      - '.clusterfuzzlite/**'

  # Allow manual triggering
  workflow_dispatch:

  # Run on a schedule for continuous fuzzing
  schedule:
    # Run daily at 2 AM UTC
    - cron: '0 2 * * *'

permissions:
  contents: read
  issues: write
  pull-requests: write
  security-events: write

jobs:
  # PR fuzzing - quick checks on pull requests
  pr-fuzzing:
    name: PR Fuzzing
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    strategy:
      fail-fast: false
      matrix:
        sanitizer: [address]
    steps:
      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          sanitizer: ${{ matrix.sanitizer }}
          language: rust

      - name: Run Fuzzers (${{ matrix.sanitizer }})
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 300  # 5 minutes per target
          mode: 'code-change'
          sanitizer: ${{ matrix.sanitizer }}
          output-sarif: true

      - name: Upload SARIF
        if: always() && steps.run.outcome == 'failure'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.run.outputs.sarif }}

  # Batch fuzzing - longer runs on main branch
  batch-fuzzing:
    name: Batch Fuzzing
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    strategy:
      fail-fast: false
      matrix:
        #sanitizer: [address, undefined]
        sanitizer: [address]
    steps:
      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          sanitizer: ${{ matrix.sanitizer }}
          language: rust

      - name: Run Fuzzers (${{ matrix.sanitizer }})
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 600  # 10 minutes per target
          mode: 'batch'
          sanitizer: ${{ matrix.sanitizer }}
          output-sarif: true

      - name: Upload SARIF
        if: always() && steps.run.outcome == 'failure'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.run.outputs.sarif }}

  # Continuous fuzzing - long runs on schedule
  continuous-fuzzing:
    name: Continuous Fuzzing
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    strategy:
      fail-fast: false
      matrix:
        #sanitizer: [address, undefined, memory]
        sanitizer: [address]
    steps:
      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          sanitizer: ${{ matrix.sanitizer }}
          language: rust

      - name: Run Fuzzers (${{ matrix.sanitizer }})
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 3600  # 1 hour per target
          mode: 'batch'
          sanitizer: ${{ matrix.sanitizer }}
          output-sarif: true

      - name: Upload SARIF
        if: always() && steps.run.outcome == 'failure'
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.run.outputs.sarif }}

  # Corpus pruning - minimize corpus size
  prune:
    name: Prune Corpus
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    steps:
      - name: Build Fuzzers
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          language: rust

      - name: Run Fuzzers (Prune)
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 600
          mode: 'prune'

  # Coverage report
  coverage:
    name: Code Coverage
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: Build Fuzzers
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          sanitizer: coverage
          language: rust

      - name: Run Fuzzers (Coverage)
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 600
          mode: 'coverage'