modules/.github/workflows/cflite.yml at main · envmodules/modules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: ClusterFuzzLite fuzzing

on:
  pull_request:
    paths:
      - 'lib/**'
      - '.clusterfuzzlite/**'
      - '.github/workflows/cflite.yml'
  schedule:
    # bi-weekly, 03:00 UTC on the 1st and 15th of each month; cron has no
    # native "every 2 weeks" field, so day-of-month is the usual
    # approximation for a bi-weekly cadence
    - cron: '0 3 1,15 * *'
  workflow_dispatch:

permissions: read-all

jobs:
  PR:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      # output-sarif: true below has run_fuzzers upload results to code
      # scanning, which needs write access to that API
      security-events: write
    concurrency:
      group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}
      cancel-in-progress: true
    strategy:
      fail-fast: false
      matrix:
        sanitizer:
          - address
          - undefined
    steps:
      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          language: c
          github-token: ${{ secrets.GITHUB_TOKEN }}
          sanitizer: ${{ matrix.sanitizer }}
      - name: Run Fuzzers (${{ matrix.sanitizer }})
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 300
          mode: 'code-change'
          sanitizer: ${{ matrix.sanitizer }}
          output-sarif: true

  BatchFuzzing:
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        sanitizer:
          - address
          - undefined
    steps:
      - name: Build Fuzzers (${{ matrix.sanitizer }})
        id: build
        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
        with:
          language: c
          sanitizer: ${{ matrix.sanitizer }}
      - name: Run Fuzzers (${{ matrix.sanitizer }})
        id: run
        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fuzz-seconds: 3600
          mode: 'batch'
          sanitizer: ${{ matrix.sanitizer }}
          output-sarif: true