1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: Fuzz
# canonical CI template: [[reference_alice_ci_canonical_template]]
# ALICE-SDF v1.7.7 (commit 52d26f9) を base に ALICE-Analytics 用に調整
#
# 目的:
# - 3 fuzz target (fuzz_event_parse / fuzz_metric_aggregate / fuzz_sketch_insert) を time-boxed 実行
# - 攻撃者制御 telemetry data で panic ゼロ + OOM 予防を検証
#
# 罠:
# - cargo-fuzz は nightly toolchain 必須 (rust-toolchain 不使用時も明示指定)
on:
push:
branches:
paths:
- 'src/**'
- 'fuzz/**'
- '.github/workflows/fuzz.yml'
- '.github/actions/**'
pull_request:
branches:
paths:
- 'src/**'
- 'fuzz/**'
- '.github/workflows/fuzz.yml'
- '.github/actions/**'
schedule:
# 毎日 03:00 UTC = 12:00 JST (idle 時間帯)
- cron: '0 3 * * *'
workflow_dispatch:
inputs:
duration_seconds:
description: 'Per-target fuzz duration (seconds)'
required: false
default: '60'
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
fuzz:
name: Fuzz — ${{ matrix.target }}
runs-on: ubuntu-latest
continue-on-error: true
strategy:
fail-fast: false
matrix:
target:
- fuzz_event_parse
- fuzz_metric_aggregate
- fuzz_sketch_insert
steps:
- uses: actions/checkout@v5
# cargo-fuzz は nightly toolchain 必須
- name: Install nightly toolchain
uses: dtolnay/rust-toolchain@nightly
- uses: Swatinem/rust-cache@v2
with:
workspaces: fuzz
- name: Create ALICE optional bridge stubs
uses: ./.github/actions/alice-stubs
- name: Install cargo-fuzz
run: cargo install cargo-fuzz --locked
- name: Set fuzz duration
id: dur
run: |
DURATION="${{ github.event.inputs.duration_seconds }}"
if [ -z "$DURATION" ]; then
DURATION=60
fi
echo "seconds=$DURATION" >> "$GITHUB_OUTPUT"
- name: Run fuzz target (time-boxed)
run: |
cd fuzz
cargo +nightly fuzz run "${{ matrix.target }}" -- \
-max_total_time=${{ steps.dur.outputs.seconds }}
- name: Upload crash artifacts (if any)
if: failure()
uses: actions/upload-artifact@v4
with:
name: fuzz-crash-${{ matrix.target }}
path: fuzz/artifacts/${{ matrix.target }}
if-no-files-found: ignore
retention-days: 14