fuzz.yml

on:
  schedule:
    - cron: "30 2 * * 1"
  workflow_dispatch:

permissions: {}

jobs:
  fuzz:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with:
          go-version-file: go.mod
      - name: Run all fuzz targets
        run: |
          for pkg in $(go list ./...); do
            for target in $(go test -list '^Fuzz' "$pkg" | grep '^Fuzz' || true); do
              go test -run '^$' -fuzz "^${target}\$" -fuzztime 5m "$pkg"
            done
          done
        env:
          GOFLAGS: -mod=readonly
      - name: Upload crashing inputs
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fuzz-crashers
          path: '**/testdata/fuzz/**'
          retention-days: 30
      - name: Open an issue on failure
        if: failure()
        run: |
          title="Weekly fuzzing found a failing input"
          if [ -z "$(gh issue list --state open --search "$title in:title" --json number --jq '.[0].number')" ]; then
            gh issue create --title "$title" \
              --body "Failed run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}. The crashing input is in the fuzz-crashers artifact of that run."
          fi
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}