Add fuzzing test for yaml.Marshal and yaml.Unmarshal
#137
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds fuzzing test capabilities to the go-yaml package to validate that yaml.Marshal and yaml.Unmarshal functions work without panics using Go's standard fuzzing framework.
- Implements a fuzzing test that seeds with existing YAML test data and validates round-trip marshal/unmarshal operations
- Adds make target for easy fuzzing execution with configurable duration
- Sets up weekly CI workflow to run fuzzing tests automatically
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| fuzz_test.go | Implements the main fuzzing test function with seed corpus setup from existing test data |
| README.md | Documents the new make fuzz command for running fuzzing tests |
| GNUmakefile | Adds fuzz target with configurable time parameter for running fuzzing tests |
| .github/workflows/fuzz.yaml | Creates CI workflow to run fuzzing tests weekly on Saturdays |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| - name: Upload failing inputs as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| path: testdata/fuzz |
There was a problem hiding this comment.
The artifact upload path testdata/fuzz appears to be hardcoded and may not match where Go's fuzzing framework actually stores failing inputs. Go typically stores fuzz failures in testdata/fuzz/FuzzFunctionName/ directories. Consider using a wildcard pattern like testdata/fuzz/** or verify the correct path.
| path: testdata/fuzz | |
| path: testdata/fuzz/** |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - name: Set up Go | ||
| uses: actions/setup-go@v6 | ||
| with: | ||
| go-version: stable | ||
| - name: Run fuzzing test for 10 minutes | ||
| run: make fuzz time=600s | ||
| - name: Upload failing inputs as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| path: testdata/fuzz | ||
| if-no-files-found: ignore |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
There was a problem hiding this comment.
agree, you probably need to set write permission for artifacts
rhysd
force-pushed
the
fuzz
branch
2 times, most recently
from
39ff61e to
cfaf346
Compare
.github/workflows/fuzz.yaml
Outdated
| permissions: | ||
| contents: read # for actions/checkout to fetch code |
There was a problem hiding this comment.
please change it to read-all, because it is unclear what permissions are in use for other types
| permissions: | |
| contents: read # for actions/checkout to fetch code | |
| permissions: read-all |
.github/workflows/fuzz.yaml
Outdated
| fuzz: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
we changed all other workflows to pin the actions to sha, could you please check the changes in main branch and update this one?
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
| - name: Set up Go | ||
| uses: actions/setup-go@v6 | ||
| with: | ||
| go-version: stable | ||
| - name: Run fuzzing test for 10 minutes | ||
| run: make fuzz time=600s | ||
| - name: Upload failing inputs as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| path: testdata/fuzz | ||
| if-no-files-found: ignore |
There was a problem hiding this comment.
agree, you probably need to set write permission for artifacts
Co-authored-by: ccoVeille <[email protected]>
|
I apologize for the lack of response because I was working on other projects. I rebased this branch onto the latest main branch and addressed all comments. |
3 participants
This PR adds a fuzzing test for go-yaml package using Go's standard fuzzing framework.
yaml.Unmarshalandyaml.Marshalwork without panicsmaketask to run fuzzing test in one command (make fuzz)