fuzz: fix coverage report to include library crates
What the developer wrote
Authored by Joost Jager
fuzz: fix coverage report to include library crates
Since cargo-llvm-cov 0.7.0, only workspace members are instrumented
by default. Since the fuzz crate is a standalone workspace, library
crates like lightning were not instrumented, and the coverage report
was empty.
Add --dep-coverage to instrument the library path dependencies.
This alone is not sufficient for the report: --dep-coverage's report
filtering only supports crates.io deps, not path deps (per a TODO in
cargo-llvm-cov source). Add --no-default-ignore-filename-regex to
include all instrumented code, then use a custom --ignore-filename-regex
to exclude unwanted paths (cargo registry, rustup toolchains, fuzz
harness).
AI tools were used in preparing this commit.
What changed, and why it matters
This commit fixes a fuzzing coverage report script. It changes which Rust library crates are included when measuring how thoroughly the fuzz tests exercise the code. There is no change to the actual Lightning protocol code, wallet logic, or network behavior, and no security vulnerability is being patched.
No security action required; treat as a normal tooling/maintenance commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change is confined to contrib/generate_fuzz_coverage.sh. It updates cargo llvm-cov invocations to pass –dep-coverage for the workspace’s path-dependency library crates and adjusts filename filters so the generated HTML/Codecov reports include those crates. This is a tooling/reporting fix only; no production source code is modified.
Changed components
contrib/generate_fuzz_coverage.shInspect captured patch +9 / −2
diff --git a/contrib/generate_fuzz_coverage.sh b/contrib/generate_fuzz_coverage.sh
index 22826ca..6be9956 100755
--- a/contrib/generate_fuzz_coverage.sh
+++ b/contrib/generate_fuzz_coverage.sh
@@ -57,7 +57,11 @@ mkdir -p "$OUTPUT_DIR"
# dont run this command when running in CI
if [ "$OUTPUT_CODECOV_JSON" = "0" ]; then
- cargo llvm-cov --html --ignore-filename-regex "fuzz/" --output-dir "$OUTPUT_DIR"
+ cargo llvm-cov --html \
+ --dep-coverage lightning,lightning-invoice,lightning-liquidity,lightning-rapid-gossip-sync,lightning-persister \
+ --no-default-ignore-filename-regex \
+ --ignore-filename-regex "(\.cargo/registry|\.rustup/toolchains|/fuzz/)" \
+ --output-dir "$OUTPUT_DIR"
echo "Coverage report generated in $OUTPUT_DIR/html/index.html"
else
# Clean previous coverage artifacts to ensure a fresh run.
@@ -78,7 +82,10 @@ else
fi
echo "Replaying imported corpus (if found) via tests to generate coverage..."
- cargo llvm-cov -j8 --codecov --ignore-filename-regex "fuzz/" \
+ cargo llvm-cov -j8 --codecov \
+ --dep-coverage lightning,lightning-invoice,lightning-liquidity,lightning-rapid-gossip-sync,lightning-persister \
+ --no-default-ignore-filename-regex \
+ --ignore-filename-regex "(\.cargo/registry|\.rustup/toolchains|/fuzz/)" \
--output-path "$OUTPUT_DIR/fuzz-codecov.json" --tests
echo "Fuzz codecov report available at $OUTPUT_DIR/fuzz-codecov.json"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.