Commit 623a6e5
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,47 @@ | |||
| 1 | + name: ASan fuzz | ||
| 2 | + | ||
| 3 | + on: | ||
| 4 | + workflow_dispatch: | ||
| 5 | + inputs: | ||
| 6 | + profile: | ||
| 7 | + description: "Hypothesis profile" | ||
| 8 | + default: "long" | ||
| 9 | + type: choice | ||
| 10 | + options: | ||
| 11 | + - ci | ||
| 12 | + - long | ||
| 13 | + | ||
| 14 | + jobs: | ||
| 15 | + asan-fuzz: | ||
| 16 | + runs-on: ubuntu-latest | ||
| 17 | + timeout-minutes: 120 | ||
| 18 | + steps: | ||
| 19 | + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | ||
| 20 | + - name: Set up uv | ||
| 21 | + uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | ||
| 22 | + with: | ||
| 23 | + enable-cache: true | ||
| 24 | + - name: Install poetry | ||
| 25 | + run: uv tool install poetry | ||
| 26 | + - name: Set up Python | ||
| 27 | + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5 | ||
| 28 | + with: | ||
| 29 | + python-version: "3.13" | ||
| 30 | + cache: "poetry" | ||
| 31 | + - name: Install dependencies | ||
| 32 | + env: | ||
| 33 | + REQUIRE_CYTHON: 1 | ||
| 34 | + run: poetry install --only=main,dev | ||
| 35 | + - name: Rebuild the extensions with AddressSanitizer | ||
| 36 | + env: | ||
| 37 | + REQUIRE_CYTHON: 1 | ||
| 38 | + CFLAGS: "-fsanitize=address -g -O1" | ||
| 39 | + LDFLAGS: "-fsanitize=address" | ||
| 40 | + run: poetry run python setup.py build_ext --inplace --force | ||
| 41 | + - name: Fuzz the parser under ASan | ||
| 42 | + env: | ||
| 43 | + HYPOTHESIS_PROFILE: ${{ inputs.profile }} | ||
| 44 | + run: | | ||
| 45 | + export LD_PRELOAD=$(gcc -print-file-name=libasan.so) | ||
| 46 | + export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1 | ||
| 47 | + poetry run pytest --timeout=1800 -v --no-cov tests/test_fuzz_incoming.py tests/test_protocol.py | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -46,6 +46,27 @@ jobs: | |||
| 46 | 46 | didn't match the configured pattern. Please ensure that the subject | |
| 47 | 47 | starts with a lowercase character. | |
| 48 | 48 | ||
| 49 | + # The ASan fuzz workflow only runs on manual dispatch; this gate keeps a | ||
| 50 | + # failed run from rotting silently by blocking CI until it is green again. | ||
| 51 | + asan-status: | ||
| 52 | + name: Last ASan fuzz run | ||
| 53 | + runs-on: ubuntu-latest | ||
| 54 | + permissions: | ||
| 55 | + actions: read | ||
| 56 | + steps: | ||
| 57 | + - name: Fail if the most recent ASan fuzz run on master failed | ||
| 58 | + env: | ||
| 59 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| 60 | + run: | | ||
| 61 | + conclusion=$(gh api \ | ||
| 62 | + "repos/${{ github.repository }}/actions/workflows/asan.yml/runs?branch=master&status=completed&per_page=1" \ | ||
| 63 | + --jq '.workflow_runs[0].conclusion // "none"') | ||
| 64 | + echo "Most recent ASan fuzz run on master: $conclusion" | ||
| 65 | + if [ "$conclusion" = "failure" ]; then | ||
| 66 | + echo "The most recent ASan fuzz run failed; fix the regression or re-run the workflow." >&2 | ||
| 67 | + exit 1 | ||
| 68 | + fi | ||
| 69 | + | ||
| 49 | 70 | test: | |
| 50 | 71 | strategy: | |
| 51 | 72 | fail-fast: false | |
0 commit comments