Skip to content

ci: Replace JDK 17 with JDK 21 in pipelines #239

ci: Replace JDK 17 with JDK 21 in pipelines

ci: Replace JDK 17 with JDK 21 in pipelines #239

# This file exists over using one workflow and a matrix because matrices don't give you an easy way to use different
# secrets. The way that exists, having the secret's key name be a value, only works within `with` and not in `env`
# blocks (see https://github.com/orgs/community/discussions/26302#discussioncomment-3905492). This is a problem because
# we need to load the secret in `env` in order to check that it's there, so we can know if we want to run the fuzzing
# job. And we need _that_ because any PRs that come in from forks may not have these secrets defined and thus would
# cause our CI to fail if we let the steps run.
name: CI Fuzz Featured Project
# Set an action secret called "FEATURED_CI_FUZZ_API_TOKEN" with an API token
# generated in CI Fuzz web interface.
on:
workflow_dispatch:
push:
branches: [ main ]
pull_request:
branches: [ main ]
env:
PROJECT_NAME: projects/Jazzer-2bd02dc5
# The fuzzing server gRPC URL.
FUZZING_SERVER_ADDRESS: grpc.code-intelligence.com:443
# The fuzzing server HTTP URL.
WEB_APP_ADDRESS: https://app.code-intelligence.com
# Directory in which the repository will be cloned.
CHECKOUT_DIR: checkout-dir/
CIFUZZ_DOWNLOAD_URL: "https://github.com/CodeIntelligenceTesting/cifuzz/releases/latest/download/cifuzz_installer_linux_amd64"
CIFUZZ_INSTALL_DIR: ./cifuzz
FUZZING_ARTIFACT: fuzzing-artifact.tar.gz
jobs:
setup:
runs-on: ubuntu-latest
# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
env:
ci_fuzz_token: ${{ secrets.FEATURED_CI_FUZZ_API_TOKEN }}
steps:
- id: checkout
name: Checkout Repository
uses: actions/checkout@v3
with:
path: ${{ env.CHECKOUT_DIR }}
- id: install-cifuzz
name: Install cifuzz
run: |
curl --fail --silent --show-error --location -o cifuzz_installer "$CIFUZZ_DOWNLOAD_URL"
chmod u+x cifuzz_installer
./cifuzz_installer --install-dir $CIFUZZ_INSTALL_DIR
- name: Mount Bazel disk cache
uses: actions/cache@v3
with:
path: "/home/runner/.cache/bazel-disk"
key: bazel-disk-cache-linux-8
- name: Set Build Buddy config
run: $CHECKOUT_DIR/.github/scripts/echoBuildBuddyConfig.sh ${{ secrets.BUILDBUDDY_API_KEY }} >> $GITHUB_ENV
shell: bash
- id: build-jazzer
name: Build Jazzer deps
run: cd $CHECKOUT_DIR && bazel build //deploy:jazzer-junit-project //deploy:jazzer-project //deploy:jazzer-api-project //selffuzz:jazzer_selffuzz //selffuzz:jazzer_api_selffuzz
- id: build-fuzzers
name: Build Fuzzers
run: |
export cifuzz_DIR="$GITHUB_WORKSPACE/$CIFUZZ_INSTALL_DIR/share/cmake"
cd $CHECKOUT_DIR/selffuzz/
$GITHUB_WORKSPACE/$CIFUZZ_INSTALL_DIR/bin/cifuzz bundle \
--commit $GITHUB_SHA \
--branch $GITHUB_REF_NAME \
--output $GITHUB_WORKSPACE/$CHECKOUT_DIR/$FUZZING_ARTIFACT
shell: "bash"
- id: start-fuzzing
name: Start Fuzzing
uses: CodeIntelligenceTesting/github-actions/start-fuzzing@v5
if: ${{ env.ci_fuzz_token != '' }}
with:
ci_fuzz_api_token: ${{ secrets.FEATURED_CI_FUZZ_API_TOKEN }}
fuzzing_server_address: ${{ env.FUZZING_SERVER_ADDRESS }}
fuzzing_artifact: ${{ env.CHECKOUT_DIR }}/${{ env.FUZZING_ARTIFACT }}
checkout_directory: ${{ env.CHECKOUT_DIR }}/selffuzz
project: ${{ env.PROJECT_NAME }}
- id: monitor-fuzzing
name: Fuzzing
uses: CodeIntelligenceTesting/github-actions/monitor-fuzzing@v5
if: ${{ env.ci_fuzz_token != '' }}
with:
ci_fuzz_api_token: ${{ secrets.FEATURED_CI_FUZZ_API_TOKEN }}
test_collection_run: ${{ steps.start-fuzzing.outputs.test_collection_run }}
fuzzing_server_address: ${{ env.FUZZING_SERVER_ADDRESS }}
dashboard_address: ${{ env.WEB_APP_ADDRESS }}
project: ${{ env.PROJECT_NAME }}
- id: save-results
name: Save Fuzz Test Results
uses: CodeIntelligenceTesting/github-actions/save-results@v5
if: ${{ env.ci_fuzz_token != '' && (success() || failure()) }}
with:
ci_fuzz_api_token: ${{ secrets.FEATURED_CI_FUZZ_API_TOKEN }}
test_collection_run: ${{ steps.start-fuzzing.outputs.test_collection_run }}
fuzzing_server_address: ${{ env.FUZZING_SERVER_ADDRESS }}
dashboard_address: ${{ env.WEB_APP_ADDRESS }}
project: ${{ env.PROJECT_NAME }}
- id: upload-artifact
uses: actions/upload-artifact@v3
if: ${{ env.ci_fuzz_token != '' && (success() || failure()) }}
with:
name: ci_fuzz_results-featured
path: |
findings.json
coverage.json
web_app_address.txt