Persist fuzz corpus between CI runs
What the developer wrote
Authored by Anyitechs
Persist fuzz corpus between CI runs
Implements a persistent, global fuzz corpus cache.
PRs perform a "read-only" restore from the `main` cache
to seed fuzzer runs. The `main` branch performs a
"read-write" to save new findings and grow the corpus.
What changed, and why it matters
This commit changes the project's GitHub Actions CI workflow to save and reuse fuzz testing data between runs. It is a build/test infrastructure improvement with no direct security vulnerability or code change to the Lightning library itself.
No security action required. Review as normal CI infrastructure change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch adds two GitHub Actions cache steps to .github/workflows/build.yml. On non-main branches (PRs), it restores the fuzz corpus read-only from the main branch cache to seed fuzzer runs. On the main branch, it restores the latest main corpus and saves a new cache keyed by the current commit SHA. This is purely a CI optimization for honggfuzz corpus persistence.
Changed components
.github/workflows/build.ymlInspect captured patch +23 / −0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2ff428c..3c50b2a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -267,6 +267,29 @@ jobs:
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ # This is read-only for PRs. It seeds the fuzzer for a more effective run.
+ # NOTE: The `key` is unique and will always miss, forcing a fallback to
+ # the `restore-keys` to find the latest global cache from the `main` branch.
+ - name: Restore persistent fuzz corpus (PR)
+ if: ${{ github.ref != 'refs/heads/main' }}
+ uses: actions/cache/restore@v4
+ with:
+ path: fuzz/hfuzz_workspace
+ key: fuzz-corpus-${{ github.ref }}-${{ github.sha }}
+ restore-keys: |
+ fuzz-corpus-refs/heads/main-
+ # The `restore-keys` performs a prefix search to find the most recent
+ # cache from a previous `main` run. We then save with a new, unique
+ # `key` (using the SHA) to ensure the cache is always updated,
+ # as caches are immutable.
+ - name: Restore/Save persistent honggfuzz corpus (Main)
+ if: ${{ github.ref == 'refs/heads/main' }}
+ uses: actions/cache@v4
+ with:
+ path: fuzz/hfuzz_workspace
+ key: fuzz-corpus-refs/heads/main-${{ github.sha }}
+ restore-keys: |
+ fuzz-corpus-refs/heads/main-
- name: Sanity check fuzz targets on Rust ${{ env.TOOLCHAIN }}
run: |
cd fuzz
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.