OpenFGA MCP

name: "Testing: Fuzzing" on: schedule: # Run fuzzing every night at 2 AM UTC - cron: "0 2 * * *" workflow_dispatch: inputs: duration: description: "Fuzzing duration in seconds" required: false default: "300" type: string pull_request: paths: - "src/**" - "tests/Fuzzing/**" - ".github/workflows/test-fuzzing.yml" permissions: contents: read jobs: fuzz: name: Run Tests runs-on: ubuntu-latest timeout-minutes: 30 permissions: contents: read security-events: write # For uploading results to security tab steps: - name: Harden the runner (Audit all outbound calls) uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0 with: egress-policy: audit - name: Checkout code uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - name: Setup PHP uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # 2.35.4 with: php-version: "8.3" extensions: mbstring, intl coverage: none tools: composer:v2 - name: Install dependencies run: | composer require --dev nikic/php-fuzzer composer install --prefer-dist --no-progress - name: Create fuzzing corpus directory run: mkdir -p tests/Fuzzing/corpus - name: Download existing corpus continue-on-error: true uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 with: name: fuzzing-corpus path: tests/Fuzzing/corpus - name: Run fuzzing tests env: FUZZING_DURATION: ${{ github.event.inputs.duration || '300' }} run: | # Set memory limit for fuzzing export ASAN_OPTIONS=allocator_may_return_null=1 # Run fuzzing with timeout timeout "${FUZZING_DURATION}s" php tests/Fuzzing/run-fuzzers.php || EXIT_CODE=$? # Exit code 124 means timeout (expected), anything else is a real error if [ "${EXIT_CODE:-0}" -ne 0 ] && [ "${EXIT_CODE:-0}" -ne 124 ]; then echo "Fuzzing failed with exit code: ${EXIT_CODE}" exit "${EXIT_CODE}" fi - name: Upload crash artifacts if: failure() uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: fuzzing-crashes-${{ github.run_id }} path: tests/Fuzzing/crashes/ retention-days: 30 - name: Upload updated corpus if: always() uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: fuzzing-corpus path: tests/Fuzzing/corpus/ retention-days: 7 - name: Generate SARIF report if: failure() run: | php tests/Fuzzing/generate-sarif.php > fuzzing-results.sarif - name: Upload SARIF results if: failure() uses: github/codeql-action/upload-sarif@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1 with: sarif_file: fuzzing-results.sarif category: fuzzing