From 2d1323d2f0c7c74a984dd021d6fd0a2f40cb138e Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Fri, 10 Jul 2026 20:08:03 +0800 Subject: [PATCH] ci(fuzz): narrow PR triggers and cover all fuzz targets (#4664) Re-enable the Fuzz workflow (disabled_manually) with two changes that address the congestion that likely caused it to be disabled: - Narrow the PR trigger paths to fuzz/**, scripts/fuzz/** and fuzz.yml only. The broad crate paths (crates/ecstore|filemeta|utils) queued a ~45min fuzz-build on nearly every PR; coverage of those crates moves to the nightly schedule, which fuzzes against main. - Expand the smoke matrix, nightly matrix, run.sh default set and the fuzz-build staging/upload steps from 3 to all 5 buildable targets: archive_extract, bucket_validation, local_metadata, path_containment, policy_ingress. archive_extract and policy_ingress were previously in no matrix. The two *_storage_api.rs files are `mod` submodules of their parent targets (bucket_validation, path_containment), not standalone bins, so fuzz/Cargo.toml registers exactly 5 fuzz bins. Smoke jobs run one target per parallel matrix job (-max_total_time=60), so wall-clock stays per-target, well under the 15min budget for a fuzz-only PR. A TODO(ci-8) hook marks where scheduled-failure alerting will attach on the nightly job. Refs rustfs/backlog#1149 (ci-9, absorbed sec-13), rustfs/backlog#1155 --- .github/workflows/fuzz.yml | 29 ++++++++++++++++++++++------- scripts/fuzz/run.sh | 5 ++++- 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml index 7b1acef4b..498076c27 100644 --- a/.github/workflows/fuzz.yml +++ b/.github/workflows/fuzz.yml @@ -17,13 +17,16 @@ name: Fuzz on: pull_request: types: [ opened, synchronize, reopened, closed ] + # PR trigger is intentionally narrow: only changes to the fuzz harness + # itself gate a PR. Broad crate paths (ecstore/filemeta/utils/policy/…) + # are covered by the nightly `schedule` run below, which fuzzes against + # whatever landed on main. Widening these paths previously queued a + # ~45min fuzz-build on nearly every PR and is why this workflow was + # disabled; do not re-add crate paths here. paths: - "fuzz/**" - "scripts/fuzz/**" - ".github/workflows/fuzz.yml" - - "crates/ecstore/**" - - "crates/filemeta/**" - - "crates/utils/**" schedule: - cron: "0 2 * * *" workflow_dispatch: @@ -97,7 +100,11 @@ jobs: run: | binary_root="fuzz/prebuilt/${CARGO_BUILD_TARGET}/release" mkdir -p "${binary_root}" - for target in path_containment bucket_validation local_metadata; do + # Keep this list in sync with the smoke/nightly matrices and + # scripts/fuzz/run.sh default target set (all 5 buildable bins in + # fuzz/Cargo.toml). The *_storage_api.rs files are `mod` submodules + # of their parent targets, not standalone bins. + for target in archive_extract bucket_validation local_metadata path_containment policy_ingress; do install -Dm755 "fuzz/target/${CARGO_BUILD_TARGET}/release/${target}" "${binary_root}/${target}" done @@ -106,9 +113,11 @@ jobs: with: name: fuzz-prebuilt-binaries-${{ github.run_number }} path: | - fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/path_containment + fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/archive_extract fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/bucket_validation fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/local_metadata + fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/path_containment + fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/policy_ingress if-no-files-found: error retention-days: 1 compression-level: 0 @@ -127,8 +136,10 @@ jobs: timeout-minutes: 30 strategy: fail-fast: false + # One job per target runs in parallel, so wall-clock time is per-target + # (~60s fuzz + download/chmod overhead), not the sum across the matrix. matrix: - target: [path_containment, bucket_validation, local_metadata] + target: [archive_extract, bucket_validation, local_metadata, path_containment, policy_ingress] env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: @@ -170,6 +181,10 @@ jobs: nightly-fuzz-corpus: name: "Nightly / ${{ matrix.target }}" needs: fuzz-build + # TODO(ci-8): when the schedule-failure-issue composite action lands, + # add a step here (or a dependent job) that opens/updates a GitHub issue + # on nightly failure. ci-8 is the single alerting mechanism for all + # scheduled workflows; do not self-roll alerting in this workflow. if: > github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && @@ -179,7 +194,7 @@ jobs: strategy: fail-fast: false matrix: - target: [path_containment, bucket_validation, local_metadata] + target: [archive_extract, bucket_validation, local_metadata, path_containment, policy_ingress] env: FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" steps: diff --git a/scripts/fuzz/run.sh b/scripts/fuzz/run.sh index 656c86f99..c02f3c22b 100755 --- a/scripts/fuzz/run.sh +++ b/scripts/fuzz/run.sh @@ -47,7 +47,10 @@ PREBUILT_BINARY_DIR=${PREBUILT_BINARY_DIR:-} cd "$FUZZ_DIR" mkdir -p "$ARTIFACT_ROOT" -targets="path_containment bucket_validation local_metadata" +# All buildable fuzz bins registered in fuzz/Cargo.toml. Keep in sync with the +# smoke/nightly matrices in .github/workflows/fuzz.yml. The *_storage_api.rs +# files are `mod` submodules of their parent targets, not standalone bins. +targets="archive_extract bucket_validation local_metadata path_containment policy_ingress" if [ -n "$FUZZ_TARGET" ]; then targets="$FUZZ_TARGET" fi