1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
name: Fuzz smoke
# Short, time-boxed fuzz runs on every push / PR — designed to
# catch regressions cheap, not to find new bugs. A longer
# scheduled hunt belongs in a separate job. Issue #20.
on:
push:
branches:
pull_request:
branches:
env:
CARGO_TERM_COLOR: always
FUZZ_TIME_PER_TARGET: 20 # seconds
jobs:
smoke:
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
target:
- arp
- cdp
- dhcp
- dns_udp
- dns_tcp
- http
- icmp
- lldp
- ndp
- ntp
- ssdp
- ssh
- tftp
- tls
- tls_handshake
- layers
steps:
- uses: actions/checkout@v4
- name: Install nightly toolchain
run: rustup toolchain install nightly --profile minimal
- name: Cache cargo registry + fuzz target + cargo-fuzz binary
uses: actions/cache@v4
with:
path: |
~/.cargo/registry
~/.cargo/git
~/.cargo/bin/cargo-fuzz
fuzz/target
key: fuzz-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'fuzz/Cargo.toml') }}
restore-keys: |
fuzz-${{ runner.os }}-
- name: Install cargo-fuzz
# Install only when the cache miss left us without the
# binary — `cargo install` refuses to overwrite an existing
# binary without `--force`, which would defeat the cache.
# No `|| true` swallowing the exit code: a genuine install
# failure here must fail the job (otherwise the run step
# later misleads with `no such command: fuzz`).
run: |
if ! command -v cargo-fuzz >/dev/null 2>&1; then
cargo install cargo-fuzz --locked --version 0.13.1
else
echo "cargo-fuzz already installed: $(cargo-fuzz --version)"
fi
- name: Verify cargo-fuzz is on PATH
run: cargo +nightly fuzz --version
- name: Smoke ${{ matrix.target }} (${{ env.FUZZ_TIME_PER_TARGET }}s)
run: |
cargo +nightly fuzz run ${{ matrix.target }} -- \
-max_total_time=${FUZZ_TIME_PER_TARGET} \
-timeout=10 \
-rss_limit_mb=2048