ClusterFuzzLite batch fuzzing #56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ClusterFuzzLite batch fuzzing | |
| # Nightly extended fuzzing across all targets. Companion to cflite_pr.yml | |
| # (per-PR fuzzing of changed code). NOTE: ClusterFuzzLite's `mode: batch` | |
| # does not currently populate SARIF results, so crashes found here will | |
| # appear in the run's `crashes` artifact but NOT in the Security tab. | |
| # PR-mode (code-change) is the path that reliably surfaces findings. | |
| on: | |
| schedule: | |
| - cron: '0 2 * * *' # nightly at 02:00 UTC | |
| workflow_dispatch: | |
| permissions: read-all | |
| jobs: | |
| BatchFuzzing: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| sanitizer: [address] | |
| steps: | |
| - name: Build Fuzzers (${{ matrix.sanitizer }}) | |
| id: build | |
| uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 | |
| with: | |
| language: rust | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| sanitizer: ${{ matrix.sanitizer }} | |
| - name: Run ClusterFuzzLite batch fuzzing | |
| uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| fuzz-seconds: 600 | |
| mode: batch | |
| sanitizer: ${{ matrix.sanitizer }} | |
| output-sarif: true | |
| - name: Upload SARIF | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | |
| with: | |
| sarif_file: cifuzz-sarif/results.sarif | |
| category: clusterfuzzlite-${{ matrix.sanitizer }} |