Repository navigation
Bump urllib3 from 2.7.0 to 2.8.0 in /requirements #449
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Fuzz | |
| # Canonicalization is security-critical (`v0.1 §2.3`): two distinct actions sharing a canonical | |
| # form share an approval, and nothing in a receipt would look wrong. `Policy.from_yaml` promises | |
| # in its docstring that anything malformed raises `PolicyError`. Both are properties rather than | |
| # examples, so both are fuzzed. `fuzz/properties.py` holds the invariants; this runs them. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| schedule: | |
| - cron: "23 4 * * 1" | |
| permissions: | |
| contents: read | |
| jobs: | |
| fuzz: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.11" | |
| - name: Install | |
| run: | | |
| pip install --require-hashes -r requirements/fuzz.txt | |
| pip install --no-deps --no-build-isolation -e . | |
| # The gate. No Atheris, so it cannot be skipped by a toolchain problem, and it fails on | |
| # a seed that regressed rather than on a campaign that happened to find one. | |
| - name: The seed corpus still holds | |
| run: | | |
| python fuzz/fuzz_canonical.py --corpus | |
| python fuzz/fuzz_policy.py --corpus | |
| # Atheris is a real dependency and a failure to install it is a red build, not a skip: | |
| # a fuzzing job that quietly stops fuzzing is the false green this repository keeps | |
| # finding in other costumes. | |
| - name: Install Atheris | |
| run: pip install --require-hashes -r requirements/atheris.txt | |
| # Bounded, or an unbounded `atheris.Fuzz()` hangs until the job timeout, which reads as a | |
| # broken build rather than as a finding. `-runs` is not used: wall-clock is what makes a | |
| # pull request's campaign the same size on a fast and a slow runner. | |
| - name: Campaign | |
| run: | | |
| python fuzz/fuzz_canonical.py -max_total_time=120 -print_final_stats=1 fuzz/corpus/canonical | |
| python fuzz/fuzz_policy.py -max_total_time=120 -print_final_stats=1 fuzz/corpus/policy | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: failure() | |
| with: | |
| name: crashes | |
| path: | | |
| crash-* | |
| timeout-* | |
| oom-* | |
| if-no-files-found: ignore | |
| retention-days: 14 |