yams/.forgejo/workflows/fuzz-smoke.yml

# Short libFuzzer runs over the direct-P2P lane and the topology snapshot decoder, on our own
# Forgejo runner. Each harness traps on an oracle violation, so any crash, sanitizer report, or
# oracle failure fails the job and its reproducer is uploaded. Long campaigns stay local
# (tools/fuzzing/fuzz.sh local|fuzz).
#
# Runner requirements (checked by the preflight step): clang with the libFuzzer runtime,
# conan 2, meson, ninja, python3, Boost headers, and the Conan build dependencies.
name: Fuzz Smoke

on:
  pull_request:
    paths:
      - "src/daemon/p2p/**"
      - "include/yams/daemon/p2p/**"
      - "src/topology/topology_codec.cpp"
      - "include/yams/topology/topology_codec.h"
      - "src/metadata/repository/search_query_helpers.cpp"
      - "include/yams/common/utf8_utils.h"
      - "src/extraction/**"
      - "src/compression/**"
      - "tools/fuzzing/**"
      - ".forgejo/workflows/fuzz-smoke.yml"
  push:
    branches:
      - experimental
    paths:
      - "src/daemon/p2p/**"
      - "src/topology/topology_codec.cpp"
      - "src/metadata/repository/search_query_helpers.cpp"
      - "include/yams/common/utf8_utils.h"
      - "src/extraction/**"
      - "src/compression/**"
      - "tools/fuzzing/**"
  schedule:
    - cron: "17 6 * * *"
  workflow_dispatch:
    inputs:
      seconds:
        description: "Seconds per harness"
        required: false
        default: "60"

jobs:
  fuzz:
    name: libFuzzer smoke
    runs-on: self-hosted
    timeout-minutes: 120
    env:
      FUZZ_SECONDS: ${{ inputs.seconds || '60' }}
    steps:
      - name: Checkout
        uses: https://code.forgejo.org/actions/checkout@v4
        with:
          submodules: false

      - name: Initialize required submodules
        run: |
          set -eu
          for module in third_party/sqlite-vec-cpp third_party/simeon third_party/symspell; do
            git submodule update --init --depth 1 "$module"
          done

      - name: Preflight toolchain
        run: |
          set -eu
          missing=0
          for tool in clang clang++ conan meson ninja python3; do
            if ! command -v "$tool" >/dev/null 2>&1; then
              echo "::error::runner is missing $tool"
              missing=1
            fi
          done
          probe="$(mktemp -d)"
          printf '%s\n' '#include <cstddef>' '#include <cstdint>' \
            'extern "C" int LLVMFuzzerTestOneInput(const std::uint8_t*, std::size_t) { return 0; }' \
            > "$probe/probe.cpp"
          if ! clang++ -fsanitize=fuzzer "$probe/probe.cpp" -o "$probe/probe" 2>/dev/null; then
            echo "::error::clang on this runner cannot link the libFuzzer runtime"
            missing=1
          fi
          rm -rf "$probe"
          exit "$missing"

      - name: Build libFuzzer harnesses
        run: |
          set -eu
          export YAMS_COMPILER=clang
          export ENABLE_TSAN=false
          export YAMS_EXTRA_MESON_FLAGS="-Dbuild-tests=false"
          ./setup.sh Fuzzing
          CONAN_BUILD_ENV="build/fuzzing/build-fuzzing/conan/conanbuild.sh"
          # shellcheck source=/dev/null
          if [ -f "$CONAN_BUILD_ENV" ]; then set +u; . "$CONAN_BUILD_ENV"; set -u; fi
          meson compile -C build/fuzzing -j 4 \
            fuzz_p2p_json fuzz_p2p_connstr fuzz_p2p_handshake fuzz_p2p_delta_stream \
            fuzz_p2p_inbound fuzz_p2p_protocol fuzz_p2p_delta fuzz_topology_codec \
            fuzz_fts5_query fuzz_utf8 fuzz_text_extractors fuzz_compressed_block

      - name: Generate seed corpus
        run: bash tools/fuzzing/generate_corpus.sh

      - name: Run harnesses
        run: |
          set -u
          failed=""
          for target in p2p_json p2p_connstr p2p_handshake p2p_delta_stream p2p_inbound \
                        p2p_protocol p2p_delta topology_codec fts5_query utf8 \
                        text_extractors compressed_block; do
            echo "== fuzz_${target} (${FUZZ_SECONDS}s)"
            if ! FUZZ_BUILD_DIR=build/fuzzing ./tools/fuzzing/fuzz.sh local "$target" \
                -max_total_time="${FUZZ_SECONDS}" -timeout=10 -rss_limit_mb=4096 \
                -print_final_stats=1; then
              failed="$failed $target"
            fi
          done
          if [ -n "$failed" ]; then
            echo "::error::fuzz findings in:$failed"
            exit 1
          fi

      - name: Upload reproducers
        if: failure()
        uses: https://code.forgejo.org/actions/upload-artifact@v3
        with:
          name: fuzz-smoke-findings
          path: build/fuzzing/fuzz-runs/*/artifacts/
          if-no-files-found: ignore
          retention-days: 14