fuzz.yml

name: Go fuzz tests

on:
  schedule:
    - cron: "0 3 * * 0" # Every Sunday at 03:00 UTC
  workflow_dispatch:

permissions:
  contents: read

jobs:
  discover:
    name: Discover fuzz tests
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Find all fuzz tests
        id: set-matrix
        run: |
          matrix=$(
            { grep -rl "^func Fuzz" transpiler --include="*_test.go" || true; } | sort | while read -r file; do
              pkg_dir=$(dirname "$file")
              go_pkg="./${pkg_dir#transpiler}"
              grep "^func Fuzz" "$file" | sed 's/func \(Fuzz[^(]*\).*/\1/' | while read -r fn; do
                printf '{"function":"%s","go_package":"%s","corpus_path":"%s/testdata/fuzz"}\n' \
                  "$fn" "$go_pkg" "$pkg_dir"
              done
            done | jq -sc '.'
          )
          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"

  fuzz:
    name: ${{ matrix.function }}
    needs: discover
    if: needs.discover.outputs.matrix != '[]'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJson(needs.discover.outputs.matrix) }}
    defaults:
      run:
        working-directory: transpiler
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
        with:
          go-version-file: transpiler/go.mod
          cache: false
      - name: Run ${{ matrix.function }}
        env:
          GO_PKG: ${{ matrix.go_package }}
          FUZZ_FN: ${{ matrix.function }}
        run: go test "$GO_PKG" "-fuzz=$FUZZ_FN" -fuzztime=5m
      - name: Upload fuzz failure seed corpus
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fuzz-corpus-${{ matrix.function }}
          path: ${{ matrix.corpus_path }}/${{ matrix.function }}
      - name: Output troubleshooting message
        if: failure()
        env:
          FUZZ_FN: ${{ matrix.function }}
          RUN_ID: ${{ github.run_id }}
          SHA: ${{ github.sha }}
        shell: bash
        run: |
          echo -e "Fuzz test $FUZZ_FN failed on commit $SHA. To troubleshoot locally, use the GitHub CLI to download the seed corpus with\n\ngh run download $RUN_ID -n fuzz-corpus-$FUZZ_FN\n"