cifuzz.yml

name: ClusterFuzzLite

on:
  pull_request:
    branches: ["main"]
  schedule:
    # Weekly batch. Offset from Scorecard (Sat 01:30) and CodeQL (Mon 04:17).
    - cron: "45 6 * * 2"
  workflow_dispatch:

permissions: {}

# Host job. First step is harden-runner audit. ClusterFuzzLite still builds
# in its own containers; the agent watches the runner VM.
jobs:
  fuzzing:
    name: ClusterFuzzLite
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
        with:
          egress-policy: audit

      # google/clusterfuzzlite actions omit OSS_FUZZ_PROJECT_NAME. The oss-fuzz
      # copies of these actions require that name and then look the project up
      # in OSS-Fuzz, which fails for a repo that only has .clusterfuzzlite/.
      # v1 is an annotated tag; the pinned SHA is the commit it points at.
      - name: Build fuzzers
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
        with:
          language: c++
          sanitizer: address
          github-token: ${{ secrets.GITHUB_TOKEN }}
          # Run both targets on every pull request. Affected-target pruning needs
          # coverage metadata this header-only build does not emit.
          keep-unaffected-fuzz-targets: true

      - name: Run fuzzers
        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
        with:
          language: c++
          sanitizer: address
          github-token: ${{ secrets.GITHUB_TOKEN }}
          # Pull requests get a short code-change run. The weekly schedule batch-fuzzes longer.
          fuzz-seconds: ${{ github.event_name == 'schedule' && '600' || '180' }}
          mode: ${{ github.event_name == 'schedule' && 'batch' || 'code-change' }}

      - name: Upload crash artifacts
        if: failure() && steps.build.outcome == 'success'
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: clusterfuzzlite-crashes
          path: ./out/artifacts
          if-no-files-found: ignore