Skip to content

Commit 9f8b2f2

Browse files
berisherberisher
authored
fix: harden release and smoke workflows (#13)
1 parent 927322f commit 9f8b2f2

9 files changed

Lines changed: 171 additions & 88 deletions

File tree

‎.github/workflows/action-smoke.yml‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,27 +9,45 @@ on:
99
required: false
1010
default: latest
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
smoke:
1417
name: Action Smoke Test (${{ matrix.os }})
1518
runs-on: ${{ matrix.os }}
16-
env:
17-
ACTION_VERSION: ${{ github.event.inputs.version || 'latest' }}
1819
strategy:
1920
fail-fast: false
2021
matrix:
21-
os: [ubuntu-latest, macos-latest, windows-latest]
22+
include:
23+
- os: ubuntu-latest
24+
local_binary: target/release/pickle-fuzzer
25+
- os: macos-latest
26+
local_binary: target/release/pickle-fuzzer
27+
- os: windows-latest
28+
local_binary: target/release/pickle-fuzzer.exe
2229
defaults:
2330
run:
2431
shell: bash
2532
steps:
2633
- name: Checkout code
27-
uses: actions/checkout@v4
34+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35+
36+
- name: Install Rust toolchain
37+
if: ${{ github.event_name == 'pull_request' }}
38+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
39+
with:
40+
toolchain: stable
41+
42+
- name: Build local binary
43+
if: ${{ github.event_name == 'pull_request' }}
44+
run: cargo build --release --locked --bin pickle-fuzzer
2845

2946
- name: Install pickle-fuzzer
3047
uses: ./
3148
with:
32-
version: ${{ env.ACTION_VERSION }}
49+
version: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version || '' }}
50+
binary_path: ${{ github.event_name == 'pull_request' && matrix.local_binary || '' }}
3351
mode: cli
3452
install_only: true
3553

@@ -39,7 +57,8 @@ jobs:
3957
- name: Generate samples
4058
uses: ./
4159
with:
42-
version: ${{ env.ACTION_VERSION }}
60+
version: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.version || '' }}
61+
binary_path: ${{ github.event_name == 'pull_request' && matrix.local_binary || '' }}
4362
mode: cli
4463
output_dir: samples
4564
samples: 5
@@ -55,7 +74,7 @@ jobs:
5574
runs-on: ubuntu-latest
5675
steps:
5776
- name: Checkout code
58-
uses: actions/checkout@v4
77+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5978

6079
- name: Run Atheris harness
6180
uses: ./

‎.github/workflows/ci.yml‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
uses: actions/checkout@v4
2525

2626
- name: Install Rust toolchain
27-
uses: dtolnay/rust-toolchain@master
27+
uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9
2828
with:
2929
toolchain: ${{ matrix.rust }}
3030

@@ -60,8 +60,9 @@ jobs:
6060
uses: actions/checkout@v4
6161

6262
- name: Install Rust toolchain
63-
uses: dtolnay/rust-toolchain@stable
63+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
6464
with:
65+
toolchain: stable
6566
components: rustfmt
6667

6768
- name: Check formatting
@@ -75,8 +76,9 @@ jobs:
7576
uses: actions/checkout@v4
7677

7778
- name: Install Rust toolchain
78-
uses: dtolnay/rust-toolchain@stable
79+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
7980
with:
81+
toolchain: stable
8082
components: clippy
8183

8284
- name: Run clippy
@@ -90,7 +92,9 @@ jobs:
9092
uses: actions/checkout@v4
9193

9294
- name: Install Rust toolchain
93-
uses: dtolnay/rust-toolchain@nightly
95+
uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f
96+
with:
97+
toolchain: nightly
9498

9599
- name: Install tarpaulin
96100
run: cargo install cargo-tarpaulin
@@ -99,7 +103,7 @@ jobs:
99103
run: cargo tarpaulin
100104

101105
- name: Upload coverage to Codecov
102-
uses: codecov/codecov-action@v4
106+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
103107
with:
104108
files: ./coverage/cobertura.xml
105109
fail_ci_if_error: false
@@ -124,7 +128,9 @@ jobs:
124128
uses: actions/checkout@v4
125129

126130
- name: Install Rust toolchain
127-
uses: dtolnay/rust-toolchain@stable
131+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
132+
with:
133+
toolchain: stable
128134

129135
- name: Build release
130136
run: cargo build --release --verbose
@@ -148,7 +154,9 @@ jobs:
148154
uses: actions/checkout@v4
149155

150156
- name: Install Rust toolchain
151-
uses: dtolnay/rust-toolchain@stable
157+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
158+
with:
159+
toolchain: stable
152160

153161
- name: Run benchmarks
154162
run: cargo bench --no-fail-fast

‎.github/workflows/fuzz.yml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,9 @@ jobs:
3333
uses: actions/checkout@v4
3434

3535
- name: Install Rust toolchain
36-
uses: dtolnay/rust-toolchain@nightly
36+
uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f
37+
with:
38+
toolchain: nightly
3739

3840
- name: Install cargo-fuzz
3941
run: cargo install cargo-fuzz
@@ -90,7 +92,9 @@ jobs:
9092
uses: actions/checkout@v4
9193

9294
- name: Install Rust toolchain
93-
uses: dtolnay/rust-toolchain@nightly
95+
uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f
96+
with:
97+
toolchain: nightly
9498

9599
- name: Install Python
96100
uses: actions/setup-python@v5
@@ -161,7 +165,9 @@ jobs:
161165
uses: actions/checkout@v4
162166

163167
- name: Install Rust toolchain
164-
uses: dtolnay/rust-toolchain@nightly
168+
uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f
169+
with:
170+
toolchain: nightly
165171

166172
- name: Install Python
167173
uses: actions/setup-python@v5
@@ -224,7 +230,9 @@ jobs:
224230
uses: actions/checkout@v4
225231

226232
- name: Install Rust toolchain
227-
uses: dtolnay/rust-toolchain@nightly
233+
uses: dtolnay/rust-toolchain@0f1b44df7e9cbb178d781a242338dfa5e243ad7f
234+
with:
235+
toolchain: nightly
228236

229237
- name: Install cargo-fuzz
230238
run: cargo install cargo-fuzz

‎.github/workflows/release.yml‎

Lines changed: 39 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -23,56 +23,38 @@ jobs:
2323
name: Create Release
2424
runs-on: ubuntu-latest
2525
outputs:
26-
upload_url: ${{ steps.finalize.outputs.upload_url }}
27-
release_exists: ${{ steps.release_info.outputs.exists }}
26+
tag_name: ${{ steps.release_info.outputs.tag_name }}
2827
steps:
2928
- name: Check if release exists
3029
id: release_info
3130
env:
32-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3332
TAG_NAME: ${{ github.event.inputs.tag || github.ref_name }}
3433
shell: bash
3534
run: |
36-
api_url="https://api.github.com/repos/${{ github.repository }}/releases/tags/${TAG_NAME}"
37-
response_path="${RUNNER_TEMP}/release_info.json"
38-
status_code=$(curl -sS -o "${response_path}" -w "%{http_code}" \
39-
-H "Authorization: Bearer ${GITHUB_TOKEN}" \
40-
-H "Accept: application/vnd.github+json" \
41-
"${api_url}")
42-
if [[ "${status_code}" == "200" ]]; then
43-
upload_url=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1], "r", encoding="utf-8")).get("upload_url", ""))' \
44-
"${response_path}")
35+
echo "tag_name=${TAG_NAME}" >> "$GITHUB_OUTPUT"
36+
if gh release view "${TAG_NAME}" --repo "${GITHUB_REPOSITORY}" >/dev/null 2>&1; then
4537
echo "exists=true" >> "$GITHUB_OUTPUT"
46-
echo "upload_url=${upload_url}" >> "$GITHUB_OUTPUT"
4738
else
4839
echo "exists=false" >> "$GITHUB_OUTPUT"
4940
fi
5041
5142
- name: Create Release
52-
id: create_release
5343
if: steps.release_info.outputs.exists != 'true'
54-
uses: actions/create-release@v1
5544
env:
56-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
57-
with:
58-
tag_name: ${{ github.event.inputs.tag || github.ref_name }}
59-
release_name: Release ${{ github.event.inputs.tag || github.ref_name }}
60-
draft: false
61-
prerelease: false
62-
63-
- name: Finalize release metadata
64-
id: finalize
45+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
46+
TAG_NAME: ${{ steps.release_info.outputs.tag_name }}
47+
shell: bash
6548
run: |
66-
upload_url="${{ steps.create_release.outputs.upload_url }}"
67-
if [ "${{ steps.release_info.outputs.exists }}" = "true" ]; then
68-
upload_url="${{ steps.release_info.outputs.upload_url }}"
69-
fi
70-
echo "upload_url=${upload_url}" >> "$GITHUB_OUTPUT"
49+
gh release create "${TAG_NAME}" \
50+
--repo "${GITHUB_REPOSITORY}" \
51+
--target "${GITHUB_SHA}" \
52+
--title "Release ${TAG_NAME}" \
53+
--notes ""
7154
7255
build-release:
7356
name: Build Release Binaries
7457
needs: create-release
75-
if: needs.create-release.outputs.release_exists != 'true'
7658
runs-on: ${{ matrix.os }}
7759
strategy:
7860
matrix:
@@ -101,10 +83,13 @@ jobs:
10183
steps:
10284
- name: Checkout code
10385
uses: actions/checkout@v4
86+
with:
87+
ref: ${{ needs.create-release.outputs.tag_name }}
10488

10589
- name: Install Rust toolchain
106-
uses: dtolnay/rust-toolchain@stable
90+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
10791
with:
92+
toolchain: stable
10893
targets: ${{ matrix.target }}
10994

11095
- name: Build release binary
@@ -139,30 +124,38 @@ jobs:
139124
$hash = (Get-FileHash -Algorithm SHA256 $artifactPath).Hash.ToLower()
140125
"$hash ${{ matrix.asset_name }}" | Out-File -FilePath $checksumPath -Encoding ascii
141126
127+
- name: Prepare release asset
128+
shell: bash
129+
run: |
130+
cp "target/${{ matrix.target }}/release/${{ matrix.artifact_name }}" \
131+
"target/${{ matrix.target }}/release/${{ matrix.asset_name }}"
132+
142133
- name: Attest release binary
143134
uses: actions/attest-build-provenance@v2
144135
with:
145136
subject-path: ./target/${{ matrix.target }}/release/${{ matrix.artifact_name }}
146137

147138
- name: Upload Release Asset
148-
uses: actions/upload-release-asset@v1
149139
env:
150-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
151-
with:
152-
upload_url: ${{ needs.create-release.outputs.upload_url }}
153-
asset_path: ./target/${{ matrix.target }}/release/${{ matrix.artifact_name }}
154-
asset_name: ${{ matrix.asset_name }}
155-
asset_content_type: application/octet-stream
140+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
141+
TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
142+
shell: bash
143+
run: |
144+
gh release upload "${TAG_NAME}" \
145+
"./target/${{ matrix.target }}/release/${{ matrix.asset_name }}" \
146+
--repo "${GITHUB_REPOSITORY}" \
147+
--clobber
156148
157149
- name: Upload checksum asset
158-
uses: actions/upload-release-asset@v1
159150
env:
160-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
161-
with:
162-
upload_url: ${{ needs.create-release.outputs.upload_url }}
163-
asset_path: ./target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256
164-
asset_name: ${{ matrix.asset_name }}.sha256
165-
asset_content_type: text/plain
151+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
152+
TAG_NAME: ${{ needs.create-release.outputs.tag_name }}
153+
shell: bash
154+
run: |
155+
gh release upload "${TAG_NAME}" \
156+
"./target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256" \
157+
--repo "${GITHUB_REPOSITORY}" \
158+
--clobber
166159
167160
# publish-crate:
168161
# name: Publish to crates.io
@@ -173,7 +166,7 @@ jobs:
173166
# uses: actions/checkout@v4
174167

175168
# - name: Install Rust toolchain
176-
# uses: dtolnay/rust-toolchain@stable
169+
# uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
177170

178171
# - name: Publish to crates.io
179172
# run: cargo publish --token ${{ secrets.CARGO_TOKEN }}

‎.github/workflows/security.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@ jobs:
1818
uses: actions/checkout@v4
1919

2020
- name: Install Rust toolchain
21-
uses: dtolnay/rust-toolchain@stable
21+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
22+
with:
23+
toolchain: stable
2224

2325
- name: Install cargo-audit
2426
run: cargo install cargo-audit
@@ -34,7 +36,9 @@ jobs:
3436
uses: actions/checkout@v4
3537

3638
- name: Install Rust toolchain
37-
uses: dtolnay/rust-toolchain@stable
39+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
40+
with:
41+
toolchain: stable
3842

3943
- name: Install cargo-deny
4044
run: cargo install cargo-deny
@@ -56,7 +60,9 @@ jobs:
5660
uses: actions/checkout@v4
5761

5862
- name: Install Rust toolchain
59-
uses: dtolnay/rust-toolchain@stable
63+
uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7
64+
with:
65+
toolchain: stable
6066

6167
- name: Install cargo-outdated
6268
run: cargo install cargo-outdated

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,11 @@ You can also pass raw arguments via `args`, which overrides other inputs:
8080
args: "--dir samples --samples 200 --protocol 4"
8181
```
8282

83-
Set `version` to download a specific release tag, or `install_only: true` to
84-
just add the binary to `PATH` without running it. When you pin the action to a
85-
branch, commit SHA, or local checkout, set `version` explicitly; the action
86-
does not fall back to `latest` unless you opt into that mutable release.
83+
Set `version` to download a specific release tag, `binary_path` to install a
84+
local build, or `install_only: true` to just add the binary to `PATH` without
85+
running it. When you pin the action to a branch, commit SHA, or local checkout,
86+
set `version` explicitly; the action does not fall back to `latest` unless you
87+
opt into that mutable release.
8788

8889
To run a custom Atheris harness (see `python/examples/harness.py` for a starter
8990
template), use `mode: atheris` and provide a harness path:

0 commit comments

Comments
 (0)