1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Fuzz Command
# Runs the v6 fuzz suite against a pull request on demand, when someone comments
# `/fuzz` on it. Feature PRs do not fuzz by default because the sweeps are far too
# slow to sit on every push; this is the escape hatch for when a change warrants it.
#
# Release PRs do not need this - `PR Mergeable` fuzzes those automatically and blocks
# the merge on the result.
#
# Built the same way as the `/benchmark` command in benchmark-report-dispatch.yml:
# validate the commenter, then `createWorkflowDispatch` the real workflow against the
# PR's *base* ref, passing the head as inputs. Dispatching against the base ref means
# the workflow definition always comes from the target branch, never from the proposed
# code, while the checkout in the dispatched run still fuzzes the PR's head.
#
# TRUST MODEL: the dispatched run checks out and executes the pull request's code, so
# this is limited to commenters with write-ish access. Note this is stricter than
# `/benchmark`, which also allows CONTRIBUTOR.
on:
issue_comment:
types:
permissions:
actions: write
contents: read
pull-requests: write
jobs:
dispatch-fuzz:
# `issue_comment` fires for issues as well as pull requests; `issue.pull_request`
# is only present on the latter.
if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/fuzz')
runs-on: ubuntu-latest
steps:
- name: Validate trigger and dispatch the v6 fuzz suite
uses: actions/github-script@v9
with:
script: |
const owner = context.repo.owner;
const repo = context.repo.repo;
const issueNumber = context.payload.issue.number;
const comment = context.payload.comment;
const association = comment.author_association;
// `author_association` is set by GitHub from the commenter's relationship to
// the repository, and cannot be spoofed by the contents of the comment.
const allowedAssociations = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
if (!allowedAssociations.has(association)) {
core.setFailed(
`/fuzz requires OWNER, MEMBER, or COLLABORATOR status. ${comment.user.login} is ${association}.`
);
return;
}
const { data: pr } = await github.rest.pulls.get({
owner,
repo,
pull_number: issueNumber,
});
await github.rest.actions.createWorkflowDispatch({
owner,
repo,
workflow_id: "fuzz-v6.yml",
ref: pr.base.ref,
inputs: {
pr_number: String(pr.number),
head_sha: pr.head.sha,
},
});
await github.rest.issues.createComment({
owner,
repo,
issue_number: issueNumber,
body: `Queued v6 fuzz suite for \`${pr.head.label}\` at \`${pr.head.sha.slice(0, 12)}\`. The run comments back with the result.`,
});