fuzz.yml

name: Fuzz Testing

on:
  schedule:
    - cron: "0 2 * * *"
  workflow_dispatch:
    inputs:
      fuzz-time:
        description: "Time per fuzz target (Go duration format)"
        required: false
        default: "2m"

concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: true

permissions:
  contents: read
  issues: write

jobs:
  fuzz:
    name: Fuzz
    runs-on: ubuntu-latest
    timeout-minutes: 120

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod
          cache: true

      - name: Set up Task
        uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2

      - name: Download Go modules
        run: go mod download

      - name: Run fuzz tests
        run: task fuzz
        env:
          FUZZ_TIME: ${{ inputs.fuzz-time || '2m' }}

      - name: Upload crash corpus
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fuzz-crashes
          path: "**/testdata/fuzz/**"
          if-no-files-found: ignore

      - name: Create issue on failure
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh issue create \
            --title "Nightly fuzz: crash found ($(date -u +%Y-%m-%d))" \
            --label "bug" \
            --body "$(cat <<'EOF'
          The nightly fuzz run found a crash. The failing corpus entry is attached as an artifact on the workflow run.

          **Run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

          Download the `fuzz-crashes` artifact from that run and place the corpus file into the appropriate `testdata/fuzz/FuzzName/` directory to reproduce locally:

          ```
          go test -run FuzzName/corpus_filename .
          ```
          EOF
          )"