hyperlight/.github/workflows/Fuzzing.yml at main · hyperlight-dev/hyperlight · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
name: Fuzzing Workflow

on:
  schedule:
    - cron: '0 0 * * 0' # Runs at 00:00 every Sunday
  workflow_dispatch: # Allow manual triggering

permissions:
  contents: read

jobs:
  # Build guests first - fuzzing needs the release guest artifacts
  build-guests:
    uses: ./.github/workflows/dep_build_guests.yml
    secrets: inherit
    with:
      arch: X64
      config: release

  fuzzing:
    needs: build-guests
    strategy:
      fail-fast: false
      matrix:
        target: ['fuzz_host_print', 'fuzz_guest_call', 'fuzz_host_call', 'fuzz_guest_estimate_trace_event', 'fuzz_guest_trace', 'fuzz_virtq_malformed', 'fuzz_virtq_roundtrip']
    uses: ./.github/workflows/dep_fuzzing.yml
    with:
      target: ${{ matrix.target }}
      arch: X64
      max_total_time: 18000 # 5 hours in seconds
      timeout_minutes: 330 # 300 minutes fuzzing plus 30 minutes for setup, build, cmin and corpus save
      persist_corpus: true
    secrets: inherit

  notify-failure:
    runs-on: ubuntu-latest
    needs: [build-guests, fuzzing]
    # Timed-out jobs report 'cancelled'. A cancelled workflow stays quiet.
    if: ${{ !cancelled() && (needs.build-guests.result == 'failure' || needs.build-guests.result == 'cancelled' || needs.fuzzing.result == 'failure' || needs.fuzzing.result == 'cancelled') }}
    permissions:
      issues: write
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Notify Fuzzing Failure
        run: ./dev/notify-ci-failure.sh --labels="area/fuzzing,area/testing,lifecycle/needs-review,release-blocker"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}