feat: upgrade wasmtime from 45.0.2 to 46.0.1 #206
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Fuzz Testing | |
| on: | |
| schedule: | |
| - cron: '0 2 * * *' # Daily at 2 AM UTC | |
| workflow_dispatch: | |
| inputs: | |
| duration: | |
| description: 'Fuzz duration per target in seconds' | |
| required: false | |
| default: '3600' | |
| type: string | |
| target: | |
| description: 'Specific target to fuzz (or "all")' | |
| required: false | |
| default: 'all' | |
| type: choice | |
| options: | |
| - all | |
| - module_parse | |
| - wit_deserialize | |
| - memory_access | |
| - func_call | |
| - module_serialize | |
| - error_message | |
| - wit_serialize | |
| - jni_callback | |
| java_duration: | |
| description: 'Java fuzz duration in seconds' | |
| required: false | |
| default: '1800' | |
| type: string | |
| push: | |
| paths: | |
| - 'wasmtime4j-native/fuzz/**' | |
| - 'wasmtime4j-tests/fuzz/**' | |
| - '.github/workflows/fuzz.yml' | |
| branches: [master] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| # Quick smoke test on push to fuzz-related files | |
| smoke-test: | |
| if: github.event_name == 'push' | |
| name: Fuzz Smoke Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@nightly | |
| - name: Install cargo-fuzz | |
| run: cargo install cargo-fuzz | |
| - name: Compile and run quick fuzz (60s each) | |
| working-directory: wasmtime4j-native | |
| run: | | |
| for target in module_parse wit_deserialize memory_access func_call module_serialize error_message wit_serialize jni_callback; do | |
| echo "::group::Fuzzing $target" | |
| cargo +nightly fuzz run $target -- -max_total_time=60 || true | |
| echo "::endgroup::" | |
| done | |
| - name: Upload crash artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: fuzz-crashes-smoke | |
| path: wasmtime4j-native/fuzz/artifacts/ | |
| if-no-files-found: ignore | |
| # Java fuzz smoke test on push | |
| java-fuzz-smoke: | |
| if: github.event_name == 'push' | |
| name: Java Fuzz Smoke Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '23' | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Build native library | |
| run: cargo build --release | |
| - name: Build Java | |
| run: | | |
| COMMON_ARGS="-B -P skip-native -q -DskipQuality -Dmaven.javadoc.skip=true -Dgpg.skip=true -Dcheckstyle.skip=true -Dspotless.check.skip=true" | |
| ./mvnw install $COMMON_ARGS -Dmaven.test.skip=true -pl '!:wasmtime4j-tests-stress' | |
| ./mvnw test-compile $COMMON_ARGS -pl wasmtime4j-tests/fuzz | |
| - name: Run Java fuzz tests (60s) | |
| run: ./mvnw verify -P fuzz -pl wasmtime4j-tests/fuzz -Dfuzz.duration=60 -DskipQuality -Dcheckstyle.skip=true | |
| - name: Upload crash artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: java-fuzz-crashes-smoke | |
| path: wasmtime4j-tests/fuzz/**/hs_err_*.log | |
| if-no-files-found: ignore | |
| # Full fuzz testing (scheduled or manual) | |
| fuzz: | |
| if: github.event_name != 'push' | |
| name: Fuzz ${{ matrix.target }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - module_parse | |
| - wit_deserialize | |
| - memory_access | |
| - func_call | |
| - module_serialize | |
| - error_message | |
| - wit_serialize | |
| - jni_callback | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@nightly | |
| - name: Install cargo-fuzz | |
| run: cargo install cargo-fuzz | |
| - name: Cache fuzz corpus | |
| uses: actions/cache@v4 | |
| with: | |
| path: wasmtime4j-native/fuzz/corpus/${{ matrix.target }} | |
| key: fuzz-corpus-${{ matrix.target }}-${{ github.sha }} | |
| restore-keys: fuzz-corpus-${{ matrix.target }}- | |
| - name: Generate seed corpus | |
| working-directory: wasmtime4j-native/fuzz | |
| run: | | |
| if [ -x generate_corpus.sh ]; then | |
| ./generate_corpus.sh | |
| fi | |
| - name: Determine fuzz duration | |
| id: duration | |
| run: | | |
| if [ "${{ github.event_name }}" = "schedule" ]; then | |
| echo "seconds=3600" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "seconds=${{ inputs.duration || '300' }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run fuzzer | |
| working-directory: wasmtime4j-native | |
| run: | | |
| echo "Fuzzing ${{ matrix.target }} for ${{ steps.duration.outputs.seconds }}s" | |
| cargo +nightly fuzz run ${{ matrix.target }} \ | |
| fuzz/corpus/${{ matrix.target }} \ | |
| -- -max_total_time=${{ steps.duration.outputs.seconds }} | |
| - name: Upload crash artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: fuzz-crashes-${{ matrix.target }} | |
| path: wasmtime4j-native/fuzz/artifacts/${{ matrix.target }}/ | |
| if-no-files-found: ignore | |
| - name: Upload updated corpus | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: fuzz-corpus-${{ matrix.target }} | |
| path: wasmtime4j-native/fuzz/corpus/${{ matrix.target }}/ | |
| if-no-files-found: ignore | |
| # Full Java fuzz testing (scheduled or manual) | |
| java-fuzz: | |
| if: github.event_name != 'push' | |
| name: Java Fuzz Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: '23' | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: Build native library | |
| run: cargo build --release | |
| - name: Build Java | |
| run: | | |
| COMMON_ARGS="-B -P skip-native -q -DskipQuality -Dmaven.javadoc.skip=true -Dgpg.skip=true -Dcheckstyle.skip=true -Dspotless.check.skip=true" | |
| ./mvnw install $COMMON_ARGS -Dmaven.test.skip=true -pl '!:wasmtime4j-tests-stress' | |
| ./mvnw test-compile $COMMON_ARGS -pl wasmtime4j-tests/fuzz | |
| - name: Determine fuzz duration | |
| id: duration | |
| run: | | |
| if [ "${{ github.event_name }}" = "schedule" ]; then | |
| echo "seconds=1800" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "seconds=${{ inputs.java_duration || '1800' }}" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run Java fuzz tests | |
| run: ./mvnw verify -P fuzz -pl wasmtime4j-tests/fuzz -Dfuzz.duration=${{ steps.duration.outputs.seconds }} -DskipQuality -Dcheckstyle.skip=true | |
| - name: Upload crash artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: java-fuzz-crashes | |
| path: wasmtime4j-tests/fuzz/**/hs_err_*.log | |
| if-no-files-found: ignore | |
| # Create issue on crash during scheduled runs | |
| notify-crashes: | |
| if: github.event_name == 'schedule' && failure() | |
| needs: [fuzz, java-fuzz] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: write | |
| steps: | |
| - name: Create issue for crashes | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const today = new Date().toISOString().split('T')[0]; | |
| const title = `Fuzz testing found crashes - ${today}`; | |
| // Check if issue already exists today | |
| const { data: issues } = await github.rest.issues.listForRepo({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| state: 'open', | |
| labels: 'fuzz-crash', | |
| per_page: 10 | |
| }); | |
| if (issues.some(i => i.title.includes(today))) return; | |
| await github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: title, | |
| body: [ | |
| '## Fuzz Testing Crash Report', | |
| '', | |
| `**Run:** ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`, | |
| `**Date:** ${new Date().toISOString()}`, | |
| '', | |
| '### Next steps', | |
| '1. Download crash artifacts from the workflow run', | |
| '2. Reproduce: `cargo +nightly fuzz run <target> <crash_file>`', | |
| '3. Minimize: `cargo +nightly fuzz tmin <target> <crash_file>`', | |
| '4. Save minimized input to `wasmtime4j-native/fuzz/regressions/<target>/`', | |
| '5. Fix the bug and verify the regression input no longer crashes', | |
| ].join('\n'), | |
| labels: ['fuzz-crash', 'bug'] | |
| }); |