name: Fuzz

# Nightly coverage-guided fuzzing of the snapshot import record walker
# (sdk/rust/fuzz). Deliberately not part of per-PR CI: a fixed nightly
# budget on a GitHub-hosted runner finds parser bugs without adding a
# second of PR latency or touching the shared self-hosted runners.

on:
  schedule:
    - cron: "17 3 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  fuzz:
    name: Fuzz snapshot import walker
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch tracks latest
        with:
          toolchain: nightly

      - uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2
        with:
          tool: cargo-fuzz

      # The sdk's build script requires a fresh guest agent binary at
      # build/agentd; mirror the check workflow's agentd steps.
      - name: Install build deps
        run: sudo apt-get update && sudo apt-get install -y musl-tools libcap-ng-dev

      - name: Build agentd (musl)
        run: |
          rustup target add --toolchain stable x86_64-unknown-linux-musl
          cargo +stable build --profile ci --manifest-path crates/agentd/Cargo.toml --target x86_64-unknown-linux-musl
          mkdir -p build
          cp target/x86_64-unknown-linux-musl/ci/agentd build/agentd

      - name: Fuzz unpack_archive (10 min budget)
        working-directory: sdk/rust
        run: |
          mkdir -p fuzz/corpus/unpack_archive
          cargo +nightly fuzz run --target x86_64-unknown-linux-gnu unpack_archive fuzz/corpus/unpack_archive fuzz/seeds/unpack_archive -- -max_total_time=600 -timeout=30

      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: fuzz-artifacts
          path: sdk/rust/fuzz/artifacts/
          if-no-files-found: ignore