hiero-sdk-python/.github/workflows/clusterfuzzlite.yml at main · aceppaluni/hiero-sdk-python · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: ClusterFuzzLite

on:
  pull_request:
    paths:
      - "src/**"
      - ".clusterfuzzlite/**"
      - "pyproject.toml"
      - "generate_proto.py"
  push:
    branches:
      - main
    paths:
      - "src/**"
      - ".clusterfuzzlite/**"
      - "pyproject.toml"
      - "generate_proto.py"

permissions: read-all

jobs:
  # ── PR fuzzing ────────────────────────────────────────────────────────────
  # Runs on every pull request and reports any new crashes found in the
  # changed code paths (code-change mode).
  PR:
    if: github.event_name == 'pull_request'
    runs-on: hl-sdk-py-lin-md
    concurrency:
      group: ${{ github.workflow }}-pr-${{ matrix.sanitizer }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        sanitizer:
          - address
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
        with:
          language: python
          github-token: ${{ secrets.GITHUB_TOKEN }}
          sanitizer: ${{ matrix.sanitizer }}

      - name: Run Fuzzers (${{ matrix.sanitizer }})
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 600
          mode: code-change
          sanitizer: ${{ matrix.sanitizer }}
          output-sarif: true

  # ── Continuous builds ─────────────────────────────────────────────────────
  # Uploads a fresh fuzzer build artifact on every push to main so that PR
  # fuzzing can determine whether a crash was newly introduced.
  Build:
    if: github.event_name == 'push'
    runs-on: hl-sdk-py-lin-md
    concurrency:
      group: ${{ github.workflow }}-build-${{ matrix.sanitizer }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        sanitizer:
          - address
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
        with:
          language: python
          sanitizer: ${{ matrix.sanitizer }}
          upload-build: true