name: Proto Fuzz Smoke

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  # Pinned for reproducibility; bump deliberately alongside `fuzz/Cargo.lock`.
  CARGO_FUZZ_VERSION: 0.13.1
  CARGO_FUZZ_SHA256: 86edc9b8f20c29ff07c3e5fcd67bc3f0784b3b960a5428635060f20d50555461
  FUZZ_TOOLCHAIN: nightly-x86_64-unknown-linux-gnu
  FUZZ_TARGET: x86_64-unknown-linux-gnu

jobs:
  fuzz-smoke:
    name: cargo fuzz smoke
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Install stable Rust toolchain
        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
        with:
          cache: false

      - name: Install nightly Rust toolchain
        # Installed alongside, but deliberately not made the directory
        # default: cargo-fuzz itself is built with the default stable
        # toolchain below, and only `fuzz build`/`fuzz run` are run with
        # the GNU-host nightly below. Building cargo-fuzz's own dependency
        # tree under a nightly override can trip build scripts (e.g. rustix) that gate
        # unstable internal attributes on detecting a nightly compiler.
        run: rustup toolchain install "${FUZZ_TOOLCHAIN}" --profile minimal --no-self-update

      - name: Install cargo-fuzz
        run: |
          set -euo pipefail
          archive="cargo-fuzz-${CARGO_FUZZ_VERSION}-x86_64-unknown-linux-musl.tar.gz"
          curl --fail --show-error --location --retry 3 \
            "https://github.com/rust-fuzz/cargo-fuzz/releases/download/${CARGO_FUZZ_VERSION}/${archive}" \
            --output "$archive"
          echo "${CARGO_FUZZ_SHA256}  ${archive}" | sha256sum --check --status -
          tar -xzf "$archive" cargo-fuzz
          install -Dm755 cargo-fuzz "${RUNNER_TEMP}/bin/cargo-fuzz"
          echo "${RUNNER_TEMP}/bin" >> "$GITHUB_PATH"

      - name: Build all fuzz targets
        # libFuzzer sanitizers require dynamically linked GNU binaries; the
        # runner's default Rust host can be static musl.
        run: RUSTUP_TOOLCHAIN="${FUZZ_TOOLCHAIN}" cargo fuzz build --target "${FUZZ_TARGET}"
        working-directory: fuzz

      - name: Run bounded fuzz smoke for every target
        # A single job building once and running each target sequentially
        # avoids recompiling the fuzz workspace per target. Ten seconds per
        # target is enough to catch a broken harness or an obvious
        # regression; this is not meant to be exhaustive fuzzing.
        run: |
          set -euo pipefail
          for target in decode_request decode_open_reply decode_echo_reply decode_params decode_varint; do
            echo "::group::fuzz smoke: ${target}"
            RUSTUP_TOOLCHAIN="${FUZZ_TOOLCHAIN}" cargo fuzz run --target "${FUZZ_TARGET}" "${target}" -- \
              -max_total_time=10 \
              -timeout=5
            echo "::endgroup::"
          done
        working-directory: fuzz