♻️ refactor(clean): compile the sanitizer's policy in C (#785) #1022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🔒 fuzz | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: ["main"] | |
| tags-ignore: ["**"] | |
| pull_request: | |
| schedule: | |
| - cron: "0 6 * * 1" # weekly deep run, Monday 06:00 UTC | |
| concurrency: | |
| group: fuzz-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| smoke: | |
| name: 💨 ASan/UBSan smoke (benign corpus) | |
| runs-on: ubuntu-24.04 | |
| # the per-PR gate: build every harness under -fsanitize=address,undefined and replay the benign seed corpus. It is | |
| # fast and deterministic, so a red run means a real regression, not a flaky fuzz find. The deep hunt is the job below. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # meson project() derives the version from git history | |
| persist-credentials: false | |
| - name: 🔄 Install uv | |
| uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| with: | |
| enable-cache: false | |
| - name: ✅ Run fuzz-smoke | |
| run: uvx --with tox-uv tox run -e fuzz-smoke | |
| env: | |
| UV_PYTHON_PREFERENCE: only-managed | |
| deep: | |
| name: 🕳️ ASan/UBSan deep (mutation + structural) | |
| runs-on: ubuntu-24.04 | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| # the continuous hunt: mutation and escalating-depth probes for a wall-clock budget per target. It is not a PR gate | |
| # and is allowed to surface a fault (which fails the job by design), so a maintainer triages new finds from the log. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: 🔄 Install uv | |
| uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| with: | |
| enable-cache: false | |
| - name: ✅ Run fuzz (deep) | |
| run: uvx --with tox-uv tox run -e fuzz -- --minutes 5 | |
| env: | |
| UV_PYTHON_PREFERENCE: only-managed |