fuzzing.yml

name: CI - Fuzzing (libFuzzer)

on:
  push:
    branches: [ main, develop, 'feature/**', 'fix/**' ]
  pull_request:
    branches: [ main, develop ]
  workflow_dispatch:
    inputs:
      fuzz_duration:
        description: 'Fuzzing duration per target (seconds)'
        required: false
        default: '60'

permissions:
  contents: read

# Collapse overlapping runs on the same ref so rapid pushes don't
# saturate the runner queue (libFuzzer builds plus 11 matrix targets
# per trigger × 2 triggers = 22+ concurrent jobs per push).  Feature
# branches and PR heads cancel previous in-flight runs; main and
# scheduled runs are preserved.
concurrency:
  group: fuzzing-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.event_name != 'schedule' }}

jobs:
  fuzz-core:
    name: Fuzz Core Primitives (${{ matrix.target }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        target:
          - fuzz_sha3
          - fuzz_ed25519
          - fuzz_aes_gcm
          - fuzz_hkdf
          - fuzz_consttime

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3

      - name: Install dependencies
        run: |
          # Remove non-essential third-party apt repos that may cause 403 errors on runners
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
          sudo apt-get update
          sudo apt-get install -y cmake clang libclang-rt-dev

      - name: Build fuzz targets
        run: |
          cmake -B build-fuzz \
            -DCMAKE_C_COMPILER=clang \
            -DCMAKE_BUILD_TYPE=Debug \
            -DAMA_BUILD_FUZZ=ON \
            -DAMA_BUILD_TESTS=OFF \
            -DAMA_BUILD_EXAMPLES=OFF \
            -DAMA_ENABLE_LTO=OFF \
            -DAMA_USE_NATIVE_PQC=ON
          cmake --build build-fuzz --target ${{ matrix.target }} -j$(nproc)

      - name: Run fuzzer (${{ matrix.target }})
        env:
          FUZZ_DURATION: ${{ github.event.inputs.fuzz_duration || '60' }}
        run: |
          mkdir -p corpus/${{ matrix.target }}
          mkdir -p artifacts/${{ matrix.target }}
          echo "Fuzzing ${{ matrix.target }} for ${FUZZ_DURATION}s..."
          ./build-fuzz/bin/${{ matrix.target }} \
            -max_total_time=${FUZZ_DURATION} \
            -max_len=4096 \
            -artifact_prefix=artifacts/${{ matrix.target }}/ \
            corpus/${{ matrix.target }}/

      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: fuzz-crashes-${{ matrix.target }}
          path: artifacts/${{ matrix.target }}/
          retention-days: 30

  fuzz-pqc:
    name: Fuzz PQC Primitives (${{ matrix.target }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        target:
          - fuzz_dilithium
          - fuzz_kyber
          - fuzz_chacha20poly1305
          - fuzz_x25519
          - fuzz_argon2
          - fuzz_secp256k1
          - fuzz_frost
        # SPHINCS+ is too slow for CI fuzzing — run manually
        # - fuzz_sphincs

    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3

      - name: Install dependencies
        run: |
          # Remove non-essential third-party apt repos that may cause 403 errors on runners
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
          sudo apt-get update
          sudo apt-get install -y cmake clang libclang-rt-dev

      - name: Build fuzz targets
        run: |
          cmake -B build-fuzz \
            -DCMAKE_C_COMPILER=clang \
            -DCMAKE_BUILD_TYPE=Debug \
            -DAMA_BUILD_FUZZ=ON \
            -DAMA_BUILD_TESTS=OFF \
            -DAMA_BUILD_EXAMPLES=OFF \
            -DAMA_ENABLE_LTO=OFF \
            -DAMA_USE_NATIVE_PQC=ON
          cmake --build build-fuzz --target ${{ matrix.target }} -j$(nproc)

      - name: Run fuzzer (${{ matrix.target }})
        env:
          FUZZ_DURATION: ${{ github.event.inputs.fuzz_duration || '60' }}
        run: |
          mkdir -p corpus/${{ matrix.target }}
          mkdir -p artifacts/${{ matrix.target }}
          echo "Fuzzing ${{ matrix.target }} for ${FUZZ_DURATION}s..."
          ./build-fuzz/bin/${{ matrix.target }} \
            -max_total_time=${FUZZ_DURATION} \
            -max_len=4096 \
            -artifact_prefix=artifacts/${{ matrix.target }}/ \
            corpus/${{ matrix.target }}/

      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: fuzz-crashes-${{ matrix.target }}
          path: artifacts/${{ matrix.target }}/
          retention-days: 30

  fuzz-consttime-aes:
    name: Fuzz AES-GCM (constant-time bitsliced backend)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3

      - name: Install dependencies
        run: |
          # Remove non-essential third-party apt repos that may cause 403 errors on runners
          sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list || true
          sudo apt-get update
          sudo apt-get install -y cmake clang libclang-rt-dev

      - name: Build with constant-time AES
        run: |
          cmake -B build-fuzz-ct \
            -DCMAKE_C_COMPILER=clang \
            -DCMAKE_BUILD_TYPE=Debug \
            -DAMA_BUILD_FUZZ=ON \
            -DAMA_BUILD_TESTS=OFF \
            -DAMA_BUILD_EXAMPLES=OFF \
            -DAMA_ENABLE_LTO=OFF \
            -DAMA_AES_CONSTTIME=ON \
            -DAMA_USE_NATIVE_PQC=ON
          cmake --build build-fuzz-ct --target fuzz_aes_gcm -j$(nproc)

      - name: Run AES-GCM fuzzer (consttime backend)
        run: |
          mkdir -p corpus/fuzz_aes_gcm_ct
          mkdir -p artifacts/fuzz_aes_gcm_ct
          ./build-fuzz-ct/bin/fuzz_aes_gcm \
            -max_total_time=30 \
            -max_len=4096 \
            -artifact_prefix=artifacts/fuzz_aes_gcm_ct/ \
            corpus/fuzz_aes_gcm_ct/

      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: fuzz-crashes-aes-gcm-consttime
          path: artifacts/fuzz_aes_gcm_ct/
          retention-days: 30

  # Constant-time verification of the legacy tools/constant_time/ harnesses
  # lives in .github/workflows/dudect.yml :: dudect-legacy-harnesses.  That
  # job runs the same `dudect_harness 50000` and `dudect_crypto 50000`
  # invocations under `taskset -c 0 nice -n -10` (single-core pinning +
  # elevated priority) and `cmake --build -j$(nproc)`, both of which the
  # earlier in-file `constant-time-crypto` job lacked.  Keeping a second,
  # un-pinned copy here only multiplied flake exposure on contended
  # runners without adding coverage.