Run the CI fuzz job on the stable toolchain
What the developer wrote
Authored by auto-pr-bot
Run the CI fuzz job on the stable toolchain
@matt asked:
> Failing to build this time.
>
> ```
> error: cannot install package `honggfuzz 0.5.62`, it requires rustc 1.85 or newer, while the currently active rustc version is 1.75.0
> `honggfuzz 0.5.61` supports rustc 1.70
> ```
>
> @auto-pr-bot please fix.
The `fuzz` job doesn't compile anything we ship, it builds the fuzz
targets against `honggfuzz` and then runs them. That the targets build on
our MSRV is checked by the `fuzz_sanity` job, which compiles both fuzz
crates with 1.75 on every push, so there is nothing the `fuzz` job adds
by using the MSRV toolchain itself.
What it does add is a dependency on `honggfuzz` still supporting our
MSRV. It doesn't: 0.5.62 requires rustc 1.85, so the job can only install
progressively older releases of a tool we merely need to run, and each
`honggfuzz` MSRV bump breaks the job until someone moves the pin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Requested-by: @matt
Link: https://git.rust-bitcoin.org/lightningdevkit/rust-lightning/issues/4968
What changed, and why it matters
This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility issue with the honggfuzz fuzzing tool. It does not change any shipped code, user-facing behavior, or security-sensitive logic.
No security action required. Treat as a normal CI maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch updates two GitHub/Forgejo workflow files so that the fuzz CI job uses rustup default stable (Forgejo) and TOOLCHAIN: stable (GitHub) instead of the project’s MSRV (1.75). The commit message explains that the fuzz job only builds and runs fuzz targets against honggfuzz, and that MSRV compatibility of the fuzz crates is already verified by a separate fuzz_sanity job. The change is a response to honggfuzz 0.5.62 requiring Rust 1.85, which broke the pinned-toolchain job. No application code is modified.
Changed components
.github/workflows/build.yml.forgejo/workflows/build.ymlInspect captured patch +3 / −3
### .forgejo/workflows/build.yml
@@ -261,9 +261,9 @@ jobs:
steps:
- name: Checkout source code
uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- - name: Install Rust 1.75 toolchain
+ - name: Install Rust stable toolchain
run: |
- rustup default 1.75
+ rustup default stable
- name: Clone fuzzing corpus
# Clone from this Forgejo instance (rather than the GitHub copy) so
# that new entries are detected against the repository the corpus
### .github/workflows/build.yml
@@ -232,7 +232,7 @@ jobs:
fuzz:
runs-on: self-hosted
env:
- TOOLCHAIN: 1.75
+ TOOLCHAIN: stable
steps:
- name: Checkout source code
uses: actions/checkout@v4Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.