ci: build and run minimal fuzzers in GitHub CI

To prevent bitrot, we would like to regularly exercise the fuzz tests in order to make sure they still link & run properly. We already compile the fuzz test objects as part of the default `make` target, but we do not link the executables due to the fuzz tests needing specific compilers and compiler features. This has lead to frequent build breakages for the fuzz tests. To remedy this, we can add a CI step to actually link the fuzz executables, and run them (with finite input rather than the default infinite random input mode) to verify that they execute properly. Since the main use of the fuzz tests is via OSS-Fuzz [1], and OSS-Fuzz only runs tests on Linux [2], we only set up a CI test for the fuzzers on Linux. [1] https://github.com/google/oss-fuzz [2] https://google.github.io/oss-fuzz/further-reading/fuzzer-environment/ Signed-off-by: Josh Steadmon <steadmon@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Josh Steadmon committed Jan 19, 2024 at 13:38 UTC c4a9cf1df38439ff40b8d64d8982a9cdcd345396
3 files changed +33
.github/workflows/main.yml
+11
@@ -309,6 +309,17 @@ jobs:
309 with:
310 name: failed-tests-${{matrix.vector.jobname}}
311 path: ${{env.FAILED_TEST_ARTIFACTS}}
312 + fuzz-smoke-test:
313 + name: fuzz smoke test
314 + needs: ci-config
315 + if: needs.ci-config.outputs.enabled == 'yes'
316 + env:
317 + CC: clang
318 + runs-on: ubuntu-latest
319 + steps:
320 + - uses: actions/checkout@v3
321 + - run: ci/install-dependencies.sh
322 + - run: ci/run-build-and-minimal-fuzzers.sh
323 dockerized:
324 name: ${{matrix.vector.jobname}} (${{matrix.vector.image}})
325 needs: ci-config
Makefile
+3
@@ -749,6 +749,9 @@ SCRIPTS = $(SCRIPT_SH_GEN) \
749
750 ETAGS_TARGET = TAGS
751
752 +# If you add a new fuzzer, please also make sure to run it in
753 +# ci/run-build-and-minimal-fuzzers.sh so that we make sure it still links and
754 +# runs in the future.
755 FUZZ_OBJS += oss-fuzz/dummy-cmd-main.o
756 FUZZ_OBJS += oss-fuzz/fuzz-commit-graph.o
757 FUZZ_OBJS += oss-fuzz/fuzz-pack-headers.o
ci/run-build-and-minimal-fuzzers.sh new
+19
@@ -0,0 +1,19 @@
1 +#!/bin/sh
2 +#
3 +# Build and test Git's fuzzers
4 +#
5 +
6 +. ${0%/*}/lib.sh
7 +
8 +group "Build fuzzers" make \
9 + CC=clang \
10 + CXX=clang++ \
11 + CFLAGS="-fsanitize=fuzzer-no-link,address" \
12 + LIB_FUZZING_ENGINE="-fsanitize=fuzzer,address" \
13 + fuzz-all
14 +
15 +for fuzzer in commit-graph date pack-headers pack-idx ; do
16 + begin_group "fuzz-$fuzzer"
17 + ./oss-fuzz/fuzz-$fuzzer -verbosity=0 -runs=1 || exit 1
18 + end_group "fuzz-$fuzzer"
19 +done