1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: Fuzz
# Runs each fuzz target for a bounded time: telemetry values chosen by an
# attacker (NaN / ±Inf / subnormal / extreme counts) must not panic or exhaust
# memory. cargo-fuzz needs a nightly toolchain.
on:
push:
branches:
paths:
- 'src/**'
- 'fuzz/**'
- '.github/workflows/fuzz.yml'
pull_request:
branches:
paths:
- 'src/**'
- 'fuzz/**'
- '.github/workflows/fuzz.yml'
schedule:
# every day 03:00 UTC
- cron: '0 3 * * *'
workflow_dispatch:
inputs:
duration_seconds:
description: 'Per-target fuzz duration (seconds)'
required: false
default: '60'
type: string
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
jobs:
fuzz:
name: Fuzz — ${{ matrix.target }}
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
target:
- fuzz_event_parse
- fuzz_metric_aggregate
- fuzz_sketch_insert
steps:
- uses: actions/checkout@v5
- name: Install nightly toolchain
uses: dtolnay/rust-toolchain@nightly
- uses: Swatinem/rust-cache@v2
with:
workspaces: fuzz
- name: Install cargo-fuzz
# built from source: the prebuilt cargo-fuzz binary targets musl by
# default, which the sanitizer build cannot use
run: cargo install cargo-fuzz --locked
# the build blocks: a target that does not compile must not pass
- name: Build fuzz target
run: |
cd fuzz
cargo +nightly fuzz build "${{ matrix.target }}"
- name: Set fuzz duration
id: dur
run: |
DURATION="${{ github.event.inputs.duration_seconds }}"
if [ -z "$DURATION" ]; then
DURATION=60
fi
echo "seconds=$DURATION" >> "$GITHUB_OUTPUT"
# the run is informational: a crash is uploaded for triage, not blocking
- name: Run fuzz target (time-boxed)
id: run
continue-on-error: true
run: |
cd fuzz
cargo +nightly fuzz run "${{ matrix.target }}" -- \
-max_total_time=${{ steps.dur.outputs.seconds }}
- name: Upload crash artifacts (if any)
if: steps.run.outcome == 'failure'
uses: actions/upload-artifact@v6
with:
name: fuzz-crash-${{ matrix.target }}
path: fuzz/artifacts/${{ matrix.target }}
if-no-files-found: ignore
retention-days: 14
- name: Report crash (informational)
if: steps.run.outcome == 'failure'
run: echo "::warning::fuzz target ${{ matrix.target }} found a crash — see fuzz-crash-${{ matrix.target }} artifact"