dependabot[bot]
f9e956522d
Bumps the actions group with 3 updates: [github/codeql-action](https://github.com/github/codeql-action), [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) and [redhat-plumbers-in-action/gather-pull-request-metadata](https://github.com/redhat-plumbers-in-action/gather-pull-request-metadata). Updates `github/codeql-action` from 4.35.4 to 4.36.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...7211b7c8077ea37d8641b6271f6a365a22a5fbfa) Updates `aws-actions/configure-aws-credentials` from 6.1.1 to 6.1.2 - [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases) - [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md) - [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/d979d5b3a71173a29b74b5b88418bfda9437d885...acca2b1b2070338fb9fd1ca27ecee81d687e58e5) Updates `redhat-plumbers-in-action/gather-pull-request-metadata` from 1.9.1 to 1.10.0 - [Release notes](https://github.com/redhat-plumbers-in-action/gather-pull-request-metadata/releases) - [Commits](https://github.com/redhat-plumbers-in-action/gather-pull-request-metadata/compare/62fc85c7acd15db62a0bdf007c8dbeda86eaf3b6...ecc2e46fe4f0b2e9a7b236d6012bc9f74af318d0) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: aws-actions/configure-aws-credentials dependency-version: 6.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: redhat-plumbers-in-action/gather-pull-request-metadata dependency-version: 1.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
75 lines
2.3 KiB
YAML
75 lines
2.3 KiB
YAML
---
|
|
# vi: ts=2 sw=2 et:
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
# See: https://google.github.io/oss-fuzz/getting-started/continuous-integration/
|
|
|
|
name: CIFuzz
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '**/meson.build'
|
|
- '.github/workflows/**'
|
|
- 'meson_options.txt'
|
|
- 'src/**'
|
|
- 'test/fuzz/**'
|
|
- 'tools/oss-fuzz.sh'
|
|
push:
|
|
branches:
|
|
- main
|
|
jobs:
|
|
Fuzzing:
|
|
runs-on: ubuntu-24.04
|
|
if: github.repository == 'systemd/systemd'
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ matrix.sanitizer }}-${{ matrix.architecture }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
sanitizer: [address, undefined, memory]
|
|
architecture: [x86_64]
|
|
include:
|
|
- sanitizer: address
|
|
architecture: i386
|
|
permissions:
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Build Fuzzers
|
|
id: build
|
|
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
|
|
with:
|
|
oss-fuzz-project-name: 'systemd'
|
|
dry-run: false
|
|
allowed-broken-targets-percentage: 0
|
|
# keep-unaffected-fuzz-targets should be removed once https://github.com/google/oss-fuzz/issues/7011 is fixed
|
|
keep-unaffected-fuzz-targets: true
|
|
sanitizer: ${{ matrix.sanitizer }}
|
|
architecture: ${{ matrix.architecture }}
|
|
output-sarif: true
|
|
- name: Run Fuzzers
|
|
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
|
|
with:
|
|
oss-fuzz-project-name: 'systemd'
|
|
fuzz-seconds: 600
|
|
dry-run: false
|
|
sanitizer: ${{ matrix.sanitizer }}
|
|
output-sarif: true
|
|
- name: Upload Crash
|
|
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
|
|
if: failure() && steps.build.outcome == 'success'
|
|
with:
|
|
name: ${{ matrix.sanitizer }}-${{ matrix.architecture }}-artifacts
|
|
path: ./out/artifacts
|
|
- name: Upload Sarif
|
|
if: always() && steps.build.outcome == 'success'
|
|
uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa
|
|
with:
|
|
# Path to SARIF file relative to the root of the repository
|
|
sarif_file: cifuzz-sarif/results.sarif
|
|
checkout_path: cifuzz-sarif
|