fuzz.yml

name: Fuzz

# Continuous fuzzing of the source chunker — the most exposed parser in CodeRAG
# (it ingests arbitrary file bytes from any watched repo and must never crash).
# The harness in fuzz/ is an Atheris target; here it runs for a bounded burst on
# PRs that touch the chunker, and a longer burst on a weekly schedule. The same
# harness is OSS-Fuzz / ClusterFuzzLite-compatible via .clusterfuzzlite/.
on:
  pull_request:
    branches: [master]
    paths:
      - "coderag/chunking/**"
      - "coderag/_lines.py"
      - "coderag/types.py"
      - "fuzz/**"
      - ".github/workflows/fuzz.yml"
  schedule:
    - cron: "15 4 * * 1"
  workflow_dispatch:

# Least privilege: the job only needs to read the repo.
permissions:
  contents: read

concurrency:
  group: fuzz-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  atheris:
    name: Atheris (chunker)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          # Atheris ships manylinux wheels for 3.11, so no clang build needed.
          python-version: "3.11"

      - name: Set up uv (fast installs + cache)
        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
        with:
          enable-cache: true

      - name: Install CodeRAG + Atheris
        run: uv pip install --system -e . atheris

      # Bounded run: a short, deterministic burst on PRs; a longer time-boxed run
      # on the weekly schedule. A crash or a broken invariant fails the job.
      - name: Fuzz the chunker
        run: |
          if [ "${{ github.event_name }}" = "schedule" ]; then
            python fuzz/fuzz_chunk_file.py -max_total_time=600
          else
            python fuzz/fuzz_chunk_file.py -atheris_runs=50000
          fi