ci: split fuzz sanity check into separate parallel job
What the developer wrote
Authored by Joost Jager
ci: split fuzz sanity check into separate parallel job
The sanity check (cargo test on fuzz targets) doesn't use the
restored corpus and was blocking the actual fuzz run. Move it to
a separate fuzz_sanity job so both run in parallel.
AI tools were used in preparing this commit.
What changed, and why it matters
This is a routine GitHub Actions CI workflow change. It moves a pre-fuzz sanity check (running cargo test on fuzz targets) out of the main fuzz job into its own parallel job so the actual fuzz run is no longer blocked waiting for the sanity check. There is no change to application code, cryptography, networking, or any user-facing behavior.
No security action needed. Review as normal CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit refactors .github/workflows/build.yml. It creates a new fuzz_sanity job that checks out the repo, installs Rust 1.75, and runs ‘cargo test –quiet –color always –lib –bins -j8’ in the fuzz directory. The existing fuzz job loses that same step (and its trailing cargo clean). The notify-failure job’s needs list is updated to include fuzz_sanity. This is purely an infrastructure/parallelization change.
Changed components
.github/workflows/build.ymlInspect captured patch +16 / −6
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b7bae91..f50c9b8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -205,6 +205,21 @@ jobs:
- name: Simulate docs.rs build
run: ci/check-docsrs.sh
+ fuzz_sanity:
+ runs-on: self-hosted
+ env:
+ TOOLCHAIN: 1.75
+ steps:
+ - name: Checkout source code
+ uses: actions/checkout@v4
+ - name: Install Rust ${{ env.TOOLCHAIN }} toolchain
+ run: |
+ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile=minimal --default-toolchain ${{ env.TOOLCHAIN }}
+ - name: Sanity check fuzz targets on Rust ${{ env.TOOLCHAIN }}
+ run: |
+ cd fuzz
+ cargo test --quiet --color always --lib --bins -j8
+
fuzz:
runs-on: self-hosted
env:
@@ -238,11 +253,6 @@ jobs:
key: fuzz-corpus-refs/heads/main-${{ github.sha }}
restore-keys: |
fuzz-corpus-refs/heads/main-
- - name: Sanity check fuzz targets on Rust ${{ env.TOOLCHAIN }}
- run: |
- cd fuzz
- cargo test --verbose --color always --lib --bins -j8
- cargo clean
- name: Run fuzzers
run: cd fuzz && ./ci-fuzz.sh && cd ..
- name: Upload honggfuzz corpus
@@ -308,7 +318,7 @@ jobs:
TOR_PROXY="127.0.0.1:9050" RUSTFLAGS="--cfg=tor" cargo test --verbose --color always -p lightning-net-tokio
notify-failure:
- needs: [build-workspace, build-features, build-bindings, build-nostd, build-cfg-flags, build-sync, fuzz, linting, rustfmt, check_release, check_docs, benchmark, ext-test, tor-connect, coverage]
+ needs: [build-workspace, build-features, build-bindings, build-nostd, build-cfg-flags, build-sync, fuzz_sanity, fuzz, linting, rustfmt, check_release, check_docs, benchmark, ext-test, tor-connect, coverage]
if: failure() && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.