Upload CI generated fuzz corpus coverage to codecov
What the developer wrote
Authored by Anyitechs
Upload CI generated fuzz corpus coverage to codecov
Because each CI job runs on a fresh runner and can't share data
between jobs. We rely on Github Actions upload-artifact and
download-artifact to share the CI generated fuzz corpus, then
replay them in the `contrib/generate_fuzz_coverage.sh` script
to generate the coverage report.
What changed, and why it matters
This commit changes the project's automated testing pipeline so that fuzz-testing data generated in one CI job is saved and reused in a later coverage-reporting job. It does not change the actual Lightning protocol code, wallet logic, or any code that end users run. There is no indication this introduces a security vulnerability.
No security action required. This is a CI/test-infrastructure change. Routine review of the workflow permissions and artifact retention settings is good practice, but the commit itself does not warrant a security response.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies .github/workflows/build.yml and contrib/generate_fuzz_coverage.sh. It adds a dependency so the coverage job waits for the fuzz job, uploads the fuzz/hfuzz_workspace directory as a GitHub Actions artifact named hfuzz-corpus, and downloads that artifact before replaying the corpus through cargo llvm-cov to produce a Codecov JSON report. The shell script now cleans prior coverage artifacts, copies files from hfuzz_workspace/<target>/input/* into test_cases/<target>/, and runs the test suite to generate coverage. No application source code is changed.
Changed components
.github/workflows/build.ymlcontrib/generate_fuzz_coverage.shInspect captured patch +31 / −3
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b643058..2ff428c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -110,6 +110,7 @@ jobs:
run: CI_ENV=1 CI_MINIMIZE_DISK_USAGE=1 ./ci/ci-tx-sync-tests.sh
coverage:
+ needs: fuzz
strategy:
fail-fast: false
runs-on: self-hosted
@@ -133,6 +134,11 @@ jobs:
# Maybe if codecov wasn't broken we wouldn't need to do this...
./codecov --verbose upload-process --disable-search --fail-on-error -f target/codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'tests'
cargo clean
+ - name: Download honggfuzz corpus
+ uses: actions/download-artifact@v4
+ with:
+ name: hfuzz-corpus
+ path: fuzz/hfuzz_workspace
- name: Run fuzz coverage generation
run: |
./contrib/generate_fuzz_coverage.sh --output-dir `pwd` --output-codecov-json
@@ -268,6 +274,11 @@ jobs:
cargo clean
- name: Run fuzzers
run: cd fuzz && ./ci-fuzz.sh && cd ..
+ - name: Upload honggfuzz corpus
+ uses: actions/upload-artifact@v4
+ with:
+ name: hfuzz-corpus
+ path: fuzz/hfuzz_workspace
linting:
runs-on: ubuntu-latest
diff --git a/contrib/generate_fuzz_coverage.sh b/contrib/generate_fuzz_coverage.sh
index 694ff65..09d3765 100755
--- a/contrib/generate_fuzz_coverage.sh
+++ b/contrib/generate_fuzz_coverage.sh
@@ -62,9 +62,26 @@ if [ "$OUTPUT_CODECOV_JSON" = "0" ]; then
cargo llvm-cov --html --ignore-filename-regex "fuzz/" --output-dir "$OUTPUT_DIR"
echo "Coverage report generated in $OUTPUT_DIR/html/index.html"
else
- cargo llvm-cov -j8 --codecov --ignore-filename-regex "fuzz/" --output-path "$OUTPUT_DIR/fuzz-codecov.json"
- echo "Fuzz codecov report available at $OUTPUT_DIR/fuzz-codecov.json"
-fi
+ # Clean previous coverage artifacts to ensure a fresh run.
+ cargo llvm-cov clean --workspace
+ # Import honggfuzz corpus if the artifact was downloaded.
+ if [ -d "hfuzz_workspace" ]; then
+ echo "Importing corpus from hfuzz_workspace..."
+ for target_dir in hfuzz_workspace/*; do
+ [ -d "$target_dir" ] || continue
+ src_name="$(basename "$target_dir")"
+ dest="${src_name%_target}"
+ mkdir -p "test_cases/$dest"
+ # Copy corpus files into the test_cases directory
+ find "$target_dir" -maxdepth 2 -type f -path "$target_dir/input/*" \
+ -print0 | xargs -0 -I{} cp -n {} "test_cases/$dest/"
+ done
+ fi
+ echo "Replaying imported corpus (if found) via tests to generate coverage..."
+ cargo llvm-cov -j8 --codecov --ignore-filename-regex "fuzz/" \
+ --output-path "$OUTPUT_DIR/fuzz-codecov.json" --tests
+ echo "Fuzz codecov report available at $OUTPUT_DIR/fuzz-codecov.json"
+fi
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.