Feature: add other fuzzing platforms to the Fuzzing check

[laurentsimon]

Our current check only looks for OSS-Fuzz integration. We want to expand our list of supported platforms.

Which fuzzing platforms to support remains an open question. Suggestions welcome!

[oliverchang]

Another one to add would be clusterfuzzlite which is launching soon: https://github.com/google/clusterfuzzlite.

[laurentsimon]

Thanks Oliver. To detect clusterfuzzlite, we need to check for a workflow which uses google/clusterfuzzlite/actions/run_fuzzers action, is this correct?
Do you expect users to enable it on PRs or push to main or something else?

[inferno-chromium]

If this is simple enough, should add this in check soon.

[naveensrinivasan]

What about results of this check from this Fuzz?

[naveensrinivasan]

On a different note should we add this check to scorecard?

[oliverchang]

Thanks Oliver. To detect clusterfuzzlite, we need to check for a workflow which uses google/clusterfuzzlite/actions/run_fuzzers action, is this correct? Do you expect users to enable it on PRs or push to main or something else?

Yep! Just check for the google/clusterfuzzlite/actions/run_fuzzers action. I think we can be flexible about where it's enabled (PR or push or otherwise) so we don't need to check that.

What about results of this check from this Fuzz?
On a different note should we add this check to scorecard?

@naveensrinivasan Could you clarify what you mean here? Are you suggesting a more detailed check beyond just checking if Fuzzing is enabled?

[naveensrinivasan]

Thanks Oliver. To detect clusterfuzzlite, we need to check for a workflow which uses google/clusterfuzzlite/actions/run_fuzzers action, is this correct? Do you expect users to enable it on PRs or push to main or something else?

Yep! Just check for the google/clusterfuzzlite/actions/run_fuzzers action. I think we can be flexible about where it's enabled (PR or push or otherwise) so we don't need to check that.

What about results of this check from this Fuzz?
On a different note should we add this check to scorecard?

@naveensrinivasan Could you clarify what you mean here? Are you suggesting a more detailed check beyond just checking if Fuzzing is enabled?

Yes , how do we report the results of these fuzz runs?

[laurentsimon]

Thanks Oliver. To detect clusterfuzzlite, we need to check for a workflow which uses google/clusterfuzzlite/actions/run_fuzzers action, is this correct? Do you expect users to enable it on PRs or push to main or something else?

Yep! Just check for the google/clusterfuzzlite/actions/run_fuzzers action. I think we can be flexible about where it's enabled (PR or push or otherwise) so we don't need to check that.

great! Do you have cycles to add it before you officially release clusterfuzzlite? Or shall we add this to v4 milestone (~EOY)?

[oliverchang]

Thanks Oliver. To detect clusterfuzzlite, we need to check for a workflow which uses google/clusterfuzzlite/actions/run_fuzzers action, is this correct? Do you expect users to enable it on PRs or push to main or something else?

Yep! Just check for the google/clusterfuzzlite/actions/run_fuzzers action. I think we can be flexible about where it's enabled (PR or push or otherwise) so we don't need to check that.

great! Do you have cycles to add it before you officially release clusterfuzzlite? Or shall we add this to v4 milestone (~EOY)?

I can probably knock this one out in the next week or so.

[laurentsimon]

Awesome. I've created #1148 and added to v4 milestone.

[github-actions]

Stale issue message

[laurentsimon]

@naveensrinivasan is there a special command/keyword we can use to say "this issue should not be closed automatically by the bot"?