From 101586c731594e0a4636e48fc40e33abda9fefaf Mon Sep 17 00:00:00 2001 From: ShihCheng Tu Date: Sat, 30 Aug 2025 22:34:27 +0800 Subject: [PATCH 1/5] Add cifuzz config for OSS-Fuzz --- .github/workflows/cifuzz.yml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 .github/workflows/cifuzz.yml diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml new file mode 100644 index 00000000000..4c997ca59f5 --- /dev/null +++ b/.github/workflows/cifuzz.yml @@ -0,0 +1,36 @@ +name: CIFuzz +on: [pull_request] +permissions: {} +jobs: + Fuzzing: + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: Build Fuzzers + id: build + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + with: + oss-fuzz-project-name: cirq + language: python + - name: Run Fuzzers + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + with: + oss-fuzz-project-name: cirq + language: python + fuzz-seconds: 600 + output-sarif: true + - name: Upload Crash + uses: actions/upload-artifact@v4 + if: failure() && steps.build.outcome == 'success' + with: + name: artifacts + path: ./out/artifacts + - name: Upload Sarif + if: always() && steps.build.outcome == 'success' + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: cifuzz-sarif/results.sarif + checkout_path: cifuzz-sarif + \ No newline at end of file From fd6861412103a75278450b3b58df27296cdf3331 Mon Sep 17 00:00:00 2001 From: Pavol Juhas Date: Thu, 13 Nov 2025 12:02:45 -0800 Subject: [PATCH 2/5] Trim trailing blank line --- .github/workflows/cifuzz.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 4c997ca59f5..b7e29198a07 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -33,4 +33,3 @@ jobs: # Path to SARIF file relative to the root of the repository sarif_file: cifuzz-sarif/results.sarif checkout_path: cifuzz-sarif - \ No newline at end of file From 31f8647feb24f4a22f9b747001ca7b25c2ba492f Mon Sep 17 00:00:00 2001 From: Pavol Juhas Date: Thu, 13 Nov 2025 12:12:50 -0800 Subject: [PATCH 3/5] Fix case of the "Cirq" project name for oss-fuzz Ref: https://github.com/ToastCheng/oss-fuzz/commit/30b813767b606af3d0a7455a261b01ed9aaa9a8d --- .github/workflows/cifuzz.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index b7e29198a07..f1149c6a1f7 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -11,12 +11,12 @@ jobs: id: build uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master with: - oss-fuzz-project-name: cirq + oss-fuzz-project-name: Cirq language: python - name: Run Fuzzers uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master with: - oss-fuzz-project-name: cirq + oss-fuzz-project-name: Cirq language: python fuzz-seconds: 600 output-sarif: true From b65f5486b5dddfdc8e7e828e58fe409b260ec386 Mon Sep 17 00:00:00 2001 From: Pavol Juhas Date: Mon, 24 Nov 2025 18:17:46 -0800 Subject: [PATCH 4/5] Revert "Fix case of the "Cirq" project name for oss-fuzz" Change project name back to lowercase as it needs to work as (lowercase-only) Docker image name. Refs: - https://github.com/quantumlib/Cirq/pull/7625#issuecomment-3567892199 - https://github.com/ToastCheng/oss-fuzz/commit/7deb0b7042b7765ea3827cc534fedfb359f051ca This reverts commit 31f8647feb24f4a22f9b747001ca7b25c2ba492f. --- .github/workflows/cifuzz.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index f1149c6a1f7..b7e29198a07 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -11,12 +11,12 @@ jobs: id: build uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master with: - oss-fuzz-project-name: Cirq + oss-fuzz-project-name: cirq language: python - name: Run Fuzzers uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master with: - oss-fuzz-project-name: Cirq + oss-fuzz-project-name: cirq language: python fuzz-seconds: 600 output-sarif: true From 39822da2ea9bfe259b3725569a99b503ffc10b48 Mon Sep 17 00:00:00 2001 From: ShihCheng Tu Date: Sat, 29 Nov 2025 19:02:50 +0800 Subject: [PATCH 5/5] Update fuzz CI config to better align the project --- .github/workflows/cifuzz.yml | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index b7e29198a07..f79de2821ee 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -1,34 +1,44 @@ name: CIFuzz -on: [pull_request] +run-name: >- + Perform fuzz testing on pull request ${{github.event.pull_request.number}} + by ${{github.actor}} +on: + pull_request: + workflow_dispatch: permissions: {} +concurrency: + # Cancel any previously-started but still active runs on the same branch. + cancel-in-progress: true + group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}} jobs: - Fuzzing: - runs-on: ubuntu-latest + fuzzing: + name: Fuzz testing + runs-on: ubuntu-24.04 permissions: security-events: write steps: - name: Build Fuzzers id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@c74d76768368951823cffca3bbd15eaa82093178 with: oss-fuzz-project-name: cirq language: python - name: Run Fuzzers - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@c74d76768368951823cffca3bbd15eaa82093178 with: oss-fuzz-project-name: cirq language: python fuzz-seconds: 600 output-sarif: true - - name: Upload Crash - uses: actions/upload-artifact@v4 + - name: Upload artifacts to workflow page if a failure occurred + uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0 if: failure() && steps.build.outcome == 'success' with: name: artifacts path: ./out/artifacts - - name: Upload Sarif + - name: Upload SARIF file to results page if: always() && steps.build.outcome == 'success' - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@8dca8a82e2fa1a2c8908956f711300f9c4a4f4f6 # v2 with: # Path to SARIF file relative to the root of the repository sarif_file: cifuzz-sarif/results.sarif