fuzz-bench.yml

name: Fuzz & Bench
on:
  workflow_dispatch:
  pull_request:
  merge_group:

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  fuzz-bench:
    name: Check that the fuzz and bench targets work
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-24.04, macos-15] # FIXME: ubuntu-24.04-arm has issues
        check: [fuzz, bench]
    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: mozilla/actions/rust@27cbe8fb5d338c2861b787e5de10410559065db1 # v1.1.3
        with:
          version: nightly
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install cargo-fuzz
        if: ${{ matrix.check == 'fuzz' }}
        # cargo-fuzz must be compiled from source so it targets the native toolchain;
        # binstall provides prebuilt binaries that may target a different architecture.
        run: cargo install cargo-fuzz

      - id: nss-version
        uses: ./.github/actions/minimum-version
        with:
          directory: .
      - uses: mozilla/actions/nss@27cbe8fb5d338c2861b787e5de10410559065db1 # v1.1.3
        with:
          minimum-version: ${{ steps.nss-version.outputs.minimum }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - if: ${{ matrix.check == 'fuzz' }}
        env:
          UBUNTU: ${{ startsWith(matrix.os, 'ubuntu') }}
        run: |
          cargo fuzz build --dev
          for fuzzer in $(cargo fuzz list); do
            cargo fuzz run --dev --sanitizer none "$fuzzer" -- -runs=1
          done

      - if: ${{ matrix.check == 'bench' }}
        run: cargo bench --features bench --profile dev --  --profile-time 1