Repository navigation
ci: add nightly ClusterFuzzLite fuzzing and corpus pruning - #1128
Conversation
✅ Deploy Preview for urunc ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
| @@ -0,0 +1,4 @@ | |||
| FROM gcr.io/oss-fuzz-base/base-builder-go | |||
| RUN git clone --depth 1 https://github.com/urunc-dev/urunc | |||
There was a problem hiding this comment.
we can do a copy instead of cloning here.
| name: urunc fuzzing (nightly) | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
Let's drop this and make it run like nightly testing https://github.com/urunc-dev/urunc/blob/main/.github/workflows/ci_nightly.yml#L6
| @@ -0,0 +1,4 @@ | |||
| FROM gcr.io/oss-fuzz-base/base-builder-go | |||
There was a problem hiding this comment.
We should pin this to a specific version and sha.
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| language: go | ||
| mode: batch | ||
| fuzz-seconds: 1800 |
There was a problem hiding this comment.
Let's add one more option here output-sarif: true
| schedule: | ||
| - cron: '30 1 * * *' | ||
|
|
||
| permissions: |
There was a problem hiding this comment.
We should also give security-events: write permissions to report fuzzing failures.
1843669 to
c652b1e
Compare
|
Made the necessary changes :) |
|
Hello @pocopepe , you will need to add the license headers as well. |
c652b1e to
6d2d108
Compare
|
Hi @cmainas, added the license headers |
|
Thank you @pocopepe , there are also some conflicts that need to get resolved. |
6d2d108 to
87915c7
Compare
|
Hey hey @cmainas, Sorry about the delay, I just patched it. |
87915c7 to
cb6f8f3
Compare
|
Hello @pocopepe , please do not forget to change the runners to 24.04 and rebase over main due to some new conflicts. |
Refs: urunc-dev#852 Signed-off-by: viju <avijusanjai@gmail.com>
cb6f8f3 to
e18aa06
Compare
|
Hi @cmainas, thanks for the review. I've pushed in the final changes |
Description
Sets up ClusterFuzzLite with a 30 min nightly fuzzing run and a 10 min daily corpus prune. Targets are listed manually in
build.shfor now, matching what runc does, with plans to detect them automatically once the preliminary testing is over.The token gets
actions: readso ClusterFuzzLite can fetch the stored corpus from the workflow's artifacts between runs. TheDockerfileclones main like runc's, so runs fuzz main rather than the PR.The
pull_requesttrigger is only there so it runs on this draft, and goes away once we switch to nightly.Related issues
How was this tested?
Ran the same build in the OSS-Fuzz Go builder image locally:
FuzzGetUnikernelConfigbuilt and fuzzed with no crashLLM usage
Opus 5.5 was used in final checks and cleaning up the code.
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).