Skip to content

Add CIFuzz Github Action #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
floitsch merged 2 commits into from
Jul 23, 2023
Merged

Add CIFuzz Github Action #203

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dcba134
Add CIFuzz Github Action
DavidKorczynski Jul 11, 2023
12602a9
pin hashes and fix permission
DavidKorczynski Jul 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions .github/workflows/cifuzz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: CIFuzz
on: [pull_request]
permissions:
contents: read
jobs:
Fuzzing:
runs-on: ubuntu-latest
permissions:
security-events: write
steps:
- name: Build Fuzzers
id: build
uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@a790ab47e189e5e3b4941b991f4784ec769a9e70
Copy link

@jonathanmetzman jonathanmetzman Jul 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pinning may temporarily work with CIFuzz, but you will need to update the pinned version if you update double-conversion in OSS-Fuzz.

Copy link
Contributor Author

@DavidKorczynski DavidKorczynski Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@floitsch let me know what you think -- I pinned due to your request #203 (comment) but given the feedback from @jonathanmetzman let me know which you prefer. There aren't many updates in https://github.com/google/oss-fuzz/tree/master/projects/double-conversion which may speak for keeping the hashes.

Copy link
Collaborator

@floitsch floitsch Jul 12, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are almont no updates for double-conversion's oss-fuzz. I think we can pin the version.

The hash-pinning was recommended by @joycebrum.

I can get convinced either way: given the limited permissions there isn't a lot of risk (not that I think that the oss-fuzz repository would get taken over), but with the limited amount of changes pinning should also be fine.

Copy link

@jonathanmetzman jonathanmetzman Jul 12, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually I was wrong, even updates to the integration are not affected by pinning. Pinning will prevent you from getting updates to CIFuzz though.
I'll explain:
The main thing that gets pinned are these files: https://github.com/google/oss-fuzz/blob/master/infra/cifuzz/actions/build_fuzzers/action.yml https://github.com/google/oss-fuzz/blob/master/infra/build_fuzzers.Dockerfile (and by extension the CIFuzz source code)
That's because once build_fuzzers.Dockerfile gets built, it pulls from gcr.io/oss-fuzz-base/cifuzz-base See here) which is continuously updated and contains your build integration.

I don't think CIFuzz is unique in not pinning the docker image it inherits from, so in many cases, including this one, pinning is providing no security.

Pinning is not providing any security here. I think some breakages outweighs no security, but I'm happy to try to support your usage either way.

with:
oss-fuzz-project-name: 'double-conversion'
language: c++
- name: Run Fuzzers
uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@a790ab47e189e5e3b4941b991f4784ec769a9e70
with:
oss-fuzz-project-name: 'double-conversion'
language: c++
fuzz-seconds: 300
output-sarif: true
- name: Upload Crash
uses: actions/upload-artifact@65d862660abb392b8c4a3d1195a2108db131dd05
if: failure() && steps.build.outcome == 'success'
with:
name: artifacts
path: ./out/artifacts
- name: Upload Sarif
if: always() && steps.build.outcome == 'success'
uses: github/codeql-action/upload-sarif@863a05b28b49528fa4af4d5126d7ffcc6db2b2ee
with:
# Path to SARIF file relative to the root of the repository
sarif_file: cifuzz-sarif/results.sarif
checkout_path: cifuzz-sarif
category: CIFuzz