java-sdk/.github/workflows/fuzz.yaml at main · opentdf/java-sdk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
name: "Fuzz"

# Coverage-guided fuzzing of the Jazzer targets in sdk/src/test/java/io/opentdf/platform/sdk/Fuzzing.java.
# Fuzzing takes the full maxDuration per target, so it runs after merges to main that touch the fuzzed code
# rather than on pull requests. The corpus Jazzer builds is cached between runs so that each run picks up
# where the last one stopped.

on:
  push:
    branches:
      - main
    paths:
      - "sdk/src/**"
      - "**/pom.xml"
      - ".github/workflows/fuzz.yaml"
  workflow_dispatch:

# a burst of merges queues a single run of the latest commit instead of one run each
concurrency:
  group: fuzz

permissions:
  contents: read

jobs:
  fuzz:
    name: "Fuzz ${{ matrix.target }}"
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        target:
          - fuzzZipRead
          - fuzzTDF
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Cache Maven packages
        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: ~/.m2
          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
          restore-keys: ${{ runner.os }}-m2
      - name: Set up JDK
        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
        with:
          java-version: "17"
          distribution: "temurin"
          server-id: github
      - name: Restore fuzzing corpus
        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: sdk/.cifuzz-corpus
          key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
          restore-keys: fuzz-corpus-${{ matrix.target }}-
      - name: Generate sources
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BUF_INPUT_HTTPS_USERNAME: opentdf-bot
          BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }}
        run: mvn --batch-mode clean generate-sources -Denforcer.skip
      - name: Fuzz
        env:
          JAZZER_FUZZ: "1"
        run: |
          # the default non-fips profile needs the sdk-fips-bc jar installed
          mvn --batch-mode install -pl sdk-fips-bc -am \
            -Dmaven.antrun.skip \
            -Dmaven.test.skip \
            -Denforcer.skip
          mvn --batch-mode test -pl sdk \
            -Dmaven.antrun.skip \
            -Denforcer.skip \
            -Dtest='Fuzzing#${{ matrix.target }}' \
            -Dsurefire.failIfNoSpecifiedTests=false
      - name: Save fuzzing corpus
        if: always()
        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
        with:
          path: sdk/.cifuzz-corpus
          key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
      - name: Upload findings
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: fuzz-findings-${{ matrix.target }}
          # Jazzer writes the input that triggered a finding next to the checked in inputs. Commit it there
          # once fixed so that it replays as a regression test
          path: |
            sdk/src/test/resources/io/opentdf/platform/sdk/FuzzingInputs/${{ matrix.target }}/crash-*
            sdk/target/surefire-reports/
          if-no-files-found: ignore