Fuzz & Bench #6245

	name: Fuzz & Bench
	on:
	workflow_dispatch:
	pull_request:
	merge_group:

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	fuzz-bench:
	name: Check that the fuzz and bench targets work
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-24.04, macos-15] # FIXME: ubuntu-24.04-arm has issues
	check: [fuzz, bench]
	runs-on: ${{ matrix.os }}

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- uses: mozilla/actions/rust@25cb84d060946c0ad6d2c3f79da479b16d180d71 # v1.1.0
	with:
	version: nightly
	token: ${{ secrets.GITHUB_TOKEN }}

	- name: Install cargo-fuzz
	if: ${{ matrix.check == 'fuzz' }}
	# cargo-fuzz must be compiled from source so it targets the native toolchain;
	# binstall provides prebuilt binaries that may target a different architecture.
	run: cargo install cargo-fuzz

	- id: nss-version
	uses: ./.github/actions/minimum-version
	with:
	directory: .
	- uses: mozilla/actions/nss@25cb84d060946c0ad6d2c3f79da479b16d180d71 # v1.1.0
	with:
	minimum-version: ${{ steps.nss-version.outputs.minimum }}
	token: ${{ secrets.GITHUB_TOKEN }}

	- if: ${{ matrix.check == 'fuzz' }}
	env:
	UBUNTU: ${{ startsWith(matrix.os, 'ubuntu') }}
	run: \|
	cargo fuzz build --dev
	for fuzzer in $(cargo fuzz list); do
	cargo fuzz run --dev --sanitizer none "$fuzzer" -- -runs=1
	done

	- if: ${{ matrix.check == 'bench' }}
	run: cargo bench --features bench --profile dev -- --profile-time 1

Provide feedback