1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: Fuzz replay
# The fast half of the fuzzing program (the nightly `Fuzz` workflow is the slow half).
#
# Exploration — mutating for hours to discover NEW paths — belongs nightly. This is the REGRESSION
# gate: replay every input the nightly has already accumulated against the code as it stands now.
# It is deterministic (same corpus, same answer every run, no "it got lucky on push #47"), it takes
# minutes rather than hours, and it answers the question a per-push job should answer — "did this
# change break a path we already explored?" A short mutation burst is available on manual dispatch,
# but deliberately does NOT run per push — see the note on that step for the measured cost.
#
# Read-only with respect to the corpus cache: the nightly owns the canonical corpus, so nothing here
# writes it back. On a cache miss (a branch with no nightly cache yet) the replay is a no-op and the
# burst still runs, so this degrades gracefully rather than failing.
on:
push:
branches:
pull_request:
workflow_dispatch:
inputs:
burst_seconds:
description: "Seconds of extra mutation fuzzing after the replay"
default: "60"
env:
CARGO_TERM_COLOR: always
TRIPLE: x86_64-unknown-linux-gnu
jobs:
replay:
name: Replay corpus
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- uses: actions/checkout@v5
- uses: dtolnay/rust-toolchain@nightly
with:
components: rust-src
# The build dominates this job's wall clock (nightly + sanitizer + instrumented std runs to
# minutes and dwarfs the fuzzing), so caching it is what makes a per-push gate tolerable.
- uses: Swatinem/rust-cache@v2
with:
workspaces: fuzz
- uses: taiki-e/install-action@v2
with:
tool: cargo-fuzz
- name: Build fuzz target
run: cargo +nightly fuzz build parse --target "$TRIPLE"
# Read the nightly's canonical corpus. Caches written on main are readable from PR branches.
- name: Restore corpus
uses: actions/cache/restore@v4
with:
path: fuzz/corpus/parse
key: fuzz-corpus-parse-
restore-keys: fuzz-corpus-parse-
# `-runs=0` executes each corpus input exactly once and exits — no mutation, no randomness.
- name: Replay corpus
run: |
set -euo pipefail
BIN="fuzz/target/$TRIPLE/release/parse"
mkdir -p fuzz/corpus/parse fuzz/artifacts/parse
COUNT=$(find fuzz/corpus/parse -type f | wc -l)
echo "Replaying $COUNT corpus inputs"
if [ "$COUNT" -eq 0 ]; then
echo "::notice::no corpus cached yet (the nightly populates it) — replay skipped"
exit 0
fi
"$BIN" -runs=0 -timeout=25 -rss_limit_mb=4096 \
-artifact_prefix=fuzz/artifacts/parse/ \
fuzz/corpus/parse
# Opt-in only (manual dispatch), NOT on every push. Measured: a nominal 60s burst cost ~275s,
# because in fork mode each child reloads the whole 12.6k corpus before it mutates and loading
# dominates at the runner's ~46 exec/s. That is a bad trade for ~60s of mutation when the
# nightly already runs 3x5h of exploration — and it would make a deterministic gate randomly
# red. Per push we replay only; exploration stays nightly's job.
- name: Short mutation burst
if: github.event_name == 'workflow_dispatch'
run: |
set -euo pipefail
BIN="fuzz/target/$TRIPLE/release/parse"
"$BIN" -fork=1 -ignore_crashes=1 \
-max_total_time=${{ github.event.inputs.burst_seconds || '60' }} \
-timeout=25 -rss_limit_mb=4096 \
-artifact_prefix=fuzz/artifacts/parse/ \
fuzz/corpus/parse
- name: Upload findings
if: always()
uses: actions/upload-artifact@v4
with:
name: fuzz-replay-findings
path: fuzz/artifacts/
if-no-files-found: ignore
# The replay exits non-zero on a crash, but fork mode in the burst swallows it — so check
# explicitly, exactly as the nightly does.
- name: Fail on crashes
if: always()
run: |
hits=$(find fuzz/artifacts -type f \( -name 'crash-*' -o -name 'timeout-*' -o -name 'oom-*' \) 2>/dev/null || true)
if [ -n "$hits" ]; then
echo "::error::fuzzing saved crash/timeout artifacts (see the fuzz-replay-findings artifact)"
printf '%s\n' "$hits"
exit 1
fi
echo "no crash/timeout/oom artifacts"