ClusterFuzzLite (batch) #69
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ClusterFuzzLite (batch) | |
| # Scheduled deeper fuzzing sweep over all 12 harnesses (SOTA 2026-06 §6). | |
| # `batch` mode runs every fuzzer for a fixed budget; pair with a corpus | |
| # storage repo to carry coverage across runs (see ClusterFuzzLite docs — | |
| # set `storage-repo` once a private corpus repo + deploy key exist). | |
| # CORPUS (fuzz F1, 2026-07-02): the large hash-named local corpus is git-IGNORED | |
| # (fuzz/corpus/.gitignore) and does NOT reach CI clones; only the hand-authored, | |
| # valid `seed_*` files are committed. Those seeds matter for the 4-byte-SELECTOR-gated | |
| # targets (multisend_decode selector 0x8d80ff0a, tx_erc20_parse_calldata transfer/ | |
| # transferFrom): seedless, the fuzzer cannot assemble a valid selector, so the decoder | |
| # body is never entered and coverage-guided fuzzing is near-vacuous. The committed seeds | |
| # push each past its selector gate into the record walk / field decode. The | |
| # non-selector-gated targets (rlp/eip1559/apdu/hid/erc7730) reach coverage seedless. | |
| on: | |
| schedule: | |
| - cron: '41 3 * * *' # 03:41 UTC daily | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| Batch: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Build fuzzers | |
| uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 | |
| with: | |
| language: rust | |
| sanitizer: address | |
| # PRIVATE repo: ClusterFuzzLite's helper clones the project repo | |
| # internally — without a token the clone fails ("could not read | |
| # Username"). The scoped GITHUB_TOKEN (contents: read) authenticates it. | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run fuzzers | |
| uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| fuzz-seconds: 1800 | |
| mode: 'batch' | |
| sanitizer: address | |
| output-sarif: true |