.github/workflows/cifuzz.yml

# CIFuzz action for OSS-Fuzz set up of Liblouis.
# CIFuzz documentation:
# - https://google.github.io/oss-fuzz/getting-started/continuous-integration
# Liblouis OSS-Fuzz project:
# - https://github.com/google/oss-fuzz/blob/master/projects/liblouis
# This CI action will build the fuzzers using the Dockerfile and build.sh
# script from the Liblouis OSS-Fuzz project folder. It runs on GitHub's
# servers.

# NOTE: This fuzzer tests both table loading and translation of input. Only the
# translation deals with untrusted input, so only issues reported from the translation
# code are critical, see also SECURITY.md

# NOTE: For now this workflow is disabled (via the github user interface) because
# the fuzzing is run on the OSS-Fuzz infrastructure. It seems of little use to
# run the same thing twice.

name: CIFuzz
on:
  pull_request:
    branches: [ master ]
    paths:
      - '**.h'
      - '**.c'
      - 'liblouis/liblouis/liblouis.h.in'

permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  Fuzzing:
    runs-on: ubuntu-latest
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
      with:
        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

    - name: Build Fuzzers
      id: build
      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@027c5886032f59e952af751069dcb3d4cb134c73 # master
      with:
        oss-fuzz-project-name: 'liblouis'
        language: c
    - name: Run Fuzzers
      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@027c5886032f59e952af751069dcb3d4cb134c73 # master
      with:
        oss-fuzz-project-name: 'liblouis'
        fuzz-seconds: 300
        language: c
    - name: Upload Crash
      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      if: failure() && steps.build.outcome == 'success'
      with:
        name: artifacts
        path: ./out/artifacts