fuzz.yml

# .github/workflows/fuzz — nightly ACTIVE fuzzing of the edge's adversarial-input parsers.
# Per-PR CI runs only the deterministic seed corpus (ci.yml); time-bounded fuzzing lives here so its
# nondeterministic, runner-contention-sensitive failures never flake an unrelated PR.

name: fuzz
on:
  schedule:
    - cron: "0 6 * * *" # nightly 06:00 UTC
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  fuzz:
    runs-on: ubuntu-latest
    defaults: { run: { working-directory: edge } }
    strategy:
      fail-fast: false
      matrix:
        target:
          - FuzzParseClientHello
          - FuzzParsePreface
          - FuzzH2FrameScanner
          - FuzzParseSYN
          - FuzzParseQUICInitial
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
        with: { go-version: "1.26" }
      - name: fuzz ${{ matrix.target }}
        run: go test ./internal/fingerprint/ -run '^$' -fuzz '^${{ matrix.target }}$' -fuzztime 180s
      # A found crasher is written under testdata/fuzz/<target>/; surface it so it can be added as a seed.
      - if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fuzz-crasher-${{ matrix.target }}
          path: edge/internal/fingerprint/testdata/fuzz/
          if-no-files-found: ignore