fuzz.yml

name: Fuzz

# Fuzz targets are excluded from the default cargo workspace and require
# nightly + cargo-fuzz. Run on demand or on a slow schedule, not on every
# PR.
on:
  workflow_dispatch:
    inputs:
      duration_secs:
        description: "Per-target fuzz duration (seconds)"
        required: false
        default: "60"
  schedule:
    # Sunday 03:30 UTC — once a week is enough for the parser surface
    # we're covering; bump if/when we add more targets.
    - cron: "30 3 * * 0"

# Default to a read-only token. The job uploads artifacts on failure,
# which is satisfied by `contents: read` plus `actions/upload-artifact`'s
# own scoping; no write access to repo contents is needed.
permissions:
  contents: read

jobs:
  fuzz:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - tlv_list_parse
          - tlv_list_parse_lenient
          - raw_tlv_parse
          - packet_unauth_parse
          - packet_auth_parse
          - agentx_decode_header
          - agentx_decode_oid
    steps:
      - uses: actions/checkout@v4
      - name: Install nightly toolchain
        uses: dtolnay/rust-toolchain@nightly
      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz
      - name: Run fuzz target
        env:
          # Use env-var indirection per GitHub security guidance: matrix
          # values are author-controlled, but pulling them through env
          # protects against future template changes that might let
          # untrusted input slip in.
          FUZZ_TARGET: ${{ matrix.target }}
          DURATION: ${{ github.event.inputs.duration_secs || '60' }}
        run: |
          cd fuzz
          cargo +nightly fuzz run "$FUZZ_TARGET" -- -max_total_time="$DURATION"
      - name: Upload crashes (if any)
        if: failure()
        uses: actions/upload-artifact@v4
        env:
          FUZZ_TARGET: ${{ matrix.target }}
        with:
          name: fuzz-crashes-${{ matrix.target }}
          path: |
            fuzz/artifacts/${{ matrix.target }}/
            fuzz/corpus/${{ matrix.target }}/
          if-no-files-found: ignore