Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 #584
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Fuzz Tests | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| schedule: | |
| # Run extended fuzzing weekly on Sunday at 2am UTC | |
| - cron: "0 2 * * 0" | |
| workflow_dispatch: | |
| inputs: | |
| fuzz_time: | |
| description: "Fuzz duration per test (e.g., 30s, 5m)" | |
| type: string | |
| required: false | |
| default: "1m" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| fuzz-tests: | |
| name: Fuzz Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| env: | |
| go: "1.26" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Go | |
| uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: ${{ env.go }} | |
| check-latest: true | |
| - name: Restore fuzz corpus | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| ~/.cache/go-build/fuzz | |
| **/testdata/fuzz | |
| key: fuzz-corpus-${{ runner.os }}-${{ hashFiles('**/*_fuzz_test.go') }} | |
| restore-keys: | | |
| fuzz-corpus-${{ runner.os }}- | |
| - name: Set fuzz duration | |
| id: fuzz-config | |
| env: | |
| INPUT_FUZZ_TIME: ${{ github.event.inputs.fuzz_time }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| REF: ${{ github.ref }} | |
| run: | | |
| if [ -n "$INPUT_FUZZ_TIME" ]; then | |
| echo "FUZZ_TIME=$INPUT_FUZZ_TIME" >> $GITHUB_ENV | |
| elif [ "$EVENT_NAME" = "schedule" ]; then | |
| echo "FUZZ_TIME=2m" >> $GITHUB_ENV | |
| elif [ "$EVENT_NAME" = "push" ] && [ "$REF" = "refs/heads/main" ]; then | |
| echo "FUZZ_TIME=30s" >> $GITHUB_ENV | |
| else | |
| # For PRs, just validate seed corpus (no extended fuzzing) | |
| echo "FUZZ_TIME=0" >> $GITHUB_ENV | |
| fi | |
| - name: Validate seed corpus (PRs only) | |
| if: env.FUZZ_TIME == '0' | |
| run: | | |
| echo "Validating fuzz test seed corpus..." | |
| go test -run='^Fuzz' -tags=unittest ./common/ | |
| - name: Run fuzz tests | |
| if: env.FUZZ_TIME != '0' | |
| run: | | |
| echo "Running fuzz tests for $FUZZ_TIME per target..." | |
| # Run encryption fuzz tests (security-critical) | |
| echo "=== FuzzEncryptDecryptRoundTrip ===" | |
| go test -run='^$' -fuzz=FuzzEncryptDecryptRoundTrip -fuzztime="$FUZZ_TIME" -tags=unittest ./common/ | |
| echo "=== FuzzDecryptMalformed ===" | |
| go test -run='^$' -fuzz=FuzzDecryptMalformed -fuzztime="$FUZZ_TIME" -tags=unittest ./common/ | |
| # Run path fuzz tests | |
| echo "=== FuzzNormalizeObjectName ===" | |
| go test -run='^$' -fuzz=FuzzNormalizeObjectName -fuzztime="$FUZZ_TIME" -tags=unittest ./common/ | |
| echo "=== FuzzJoinUnixFilepath ===" | |
| go test -run='^$' -fuzz=FuzzJoinUnixFilepath -fuzztime="$FUZZ_TIME" -tags=unittest ./common/ | |
| - name: Save fuzz corpus | |
| if: always() && github.event_name != 'pull_request' | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| ~/.cache/go-build/fuzz | |
| **/testdata/fuzz | |
| key: fuzz-corpus-${{ runner.os }}-${{ hashFiles('**/*_fuzz_test.go') }}-${{ github.run_id }} | |
| - name: Upload crash artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: fuzz-crash-artifacts-${{ github.sha }} | |
| path: | | |
| **/testdata/fuzz/*/crash-* | |
| **/testdata/fuzz/*/leak-* | |
| if-no-files-found: ignore | |
| retention-days: 30 |