fuzz.yml

name: Fuzzing

on:
  push:
    branches:
      - main
    tags:
      - 'v*'
  pull_request:
  schedule:
    - cron: '50 9 * * *' # Run fuzz tests daily at 09:50 UTC

permissions: {}

jobs:
  fuzz:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    env:
      # 500k runs for releases, 50k for regular CI
      FUZZ_RUNS: ${{ startsWith(github.ref, 'refs/tags/') && '500000' || '50000' }}
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
        with:
          persist-credentials: false
      - name: Install Rust toolchain
        if: matrix.ext-pqcrypto
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9  # nightly
        with:
          toolchain: nightly
          components: rustfmt
      - name: Setup PHP
        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f  # v2.37.0
        with:
          php-version: '8.4'
      - name: Build and install ext-pqcrypto
        shell: bash
        run: |
          git clone --depth 1 https://github.com/paragonie/ext-pqcrypto.git "$RUNNER_TEMP/ext-pqcrypto"
          cd "$RUNNER_TEMP/ext-pqcrypto"
          cargo build --release
          EXT_DIR="$(php -r "echo ini_get('extension_dir');")"
          if [[ "$RUNNER_OS" == "Windows" ]]; then
            cp target/release/pqcrypto.dll "$EXT_DIR/pqcrypto.dll"
          else
            sudo cp target/release/libpqcrypto.so "$EXT_DIR/pqcrypto.so"
          fi
          echo "extension=pqcrypto" >> "$(php -r "echo php_ini_loaded_file();")"
          php -m | grep pqcrypto
      - name: Setup PHP-Fuzzer
        run: composer global require --dev nikic/php-fuzzer
      - name: Install dependencies
        run: composer install --optimize-autoloader
      - name: Run FuzzProtocol
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzProtocol.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzProtocol-}"; done
      - name: Run FuzzRequestHandlers
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzRequestHandlers.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzRequestHandlers-}"; done
      - name: Run FuzzActivityStream
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzActivityStream.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzActivityStream-}"; done
      - name: Run FuzzJsonParsing
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzJsonParsing.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzJsonParsing-}"; done
      - name: Run FuzzMath
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzMath.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzMath-}"; done
      - name: Run FuzzNetworkTrait
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzNetworkTrait.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzNetworkTrait-}"; done
      - name: Run FuzzParams
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzParams.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzParams-}"; done
      - name: Run FuzzRateLimit
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzRateLimit.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzRateLimit-}"; done
      - name: Run FuzzBase64
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzBase64.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzBase64-}"; done
      - name: Run FuzzMerkleLeaf
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzMerkleLeaf.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzMerkleLeaf-}"; done
      - name: Run FuzzMerkleTree
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzMerkleTree.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzMerkleTree-}"; done
      - name: Run FuzzTOTP
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/FuzzTOTP.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-FuzzTOTP-}"; done
      - name: Run DifferentialFuzzProtocolWitness
        run: |
          php-fuzzer fuzz --timeout 10 --max-runs "$FUZZ_RUNS" fuzzing/DifferentialFuzzProtocolWitness.php
          shopt -s nullglob; for f in crash-*.txt; do mv "$f" "${f/crash-/fuzzed-DifferentialFuzzProtocolWitness-}"; done
      - name: Check for crashes
        if: always()
        run: |
          if compgen -G "fuzzed-*.txt" > /dev/null; then
            echo "::error::Fuzzing found crashes"
            echo "=== Crash files found ==="
            for f in fuzzed-*.txt; do
              echo "--- $f ---"
              cat "$f"
              echo ""
              echo "Hex dump:"
              xxd "$f"
              echo ""
            done
            exit 1
          fi
          echo "No crashes detected"