OpenImageIO/.github/workflows/fuzz.yml at main · imageworks/OpenImageIO · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
# Copyright Contributors to the OpenImageIO project.
# SPDX-License-Identifier: Apache-2.0
# https://github.com/AcademySoftwareFoundation/OpenImageIO

name: Fuzz

on:
  schedule:
    # Nightly at 10:00 UTC — main fork only (filtered via job condition below)
    - cron: "0 10 * * *"
  push:
    # Run on any branch whose name contains "fuzz"
    branches:
      - '*fuzz*'
    paths:
      - 'src/**'
      - '!src/doc/**'
      - '.github/workflows/fuzz.yml'
      - '.github/workflows/build-steps.yml'
  pull_request:
    # Run on PRs only if the branch name contains "fuzz"
    branches:
      - '*fuzz*'
  workflow_dispatch:
    inputs:
      format:
        description: "Format name to fuzz (leave empty for all)"
        required: false
        default: ""

permissions: read-all

# Allow subsequent pushes to the same PR or REF to cancel any previous jobs.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true


jobs:
  fuzz:
    name: "Fuzz ${{ matrix.format }} (tier ${{ matrix.tier }})"
    # Scheduled runs only on the canonical fork; push runs anywhere (branch filter above ensures "fuzz" substring)
    if: github.event_name != 'schedule' || github.repository == 'AcademySoftwareFoundation/OpenImageIO'
    strategy:
      fail-fast: false
      matrix:
        include:
          # Tier 1: complex/high-risk formats — 60 min fuzz window each
          - { format: openexr,   tier: 1, max_total_time: 3600 }
          - { format: tiff,      tier: 1, max_total_time: 3600 }
          - { format: jpeg,      tier: 1, max_total_time: 3600 }
          - { format: png,       tier: 1, max_total_time: 3600 }
          - { format: dpx,       tier: 1, max_total_time: 3600 }
          - { format: psd,       tier: 1, max_total_time: 3600 }
          - { format: heif,      tier: 1, max_total_time: 3600 }
          - { format: jpegxl,    tier: 1, max_total_time: 3600 }
          - { format: jpeg2000,  tier: 1, max_total_time: 3600 }
          - { format: raw,       tier: 1, max_total_time: 3600 }
          # Tier 2: simpler formats — 30 min fuzz window each
          - { format: bmp,       tier: 2, max_total_time: 1800 }
          - { format: cineon,    tier: 2, max_total_time: 1800 }
          - { format: dds,       tier: 2, max_total_time: 1800 }
          - { format: dicom,     tier: 2, max_total_time: 1800 }
          - { format: fits,      tier: 2, max_total_time: 1800 }
          - { format: gif,       tier: 2, max_total_time: 1800 }
          - { format: hdr,       tier: 2, max_total_time: 1800 }
          - { format: ico,       tier: 2, max_total_time: 1800 }
          - { format: iff,       tier: 2, max_total_time: 1800 }
          - { format: pnm,       tier: 2, max_total_time: 1800 }
          - { format: rla,       tier: 2, max_total_time: 1800 }
          - { format: sgi,       tier: 2, max_total_time: 1800 }
          - { format: softimage, tier: 2, max_total_time: 1800 }
          - { format: targa,     tier: 2, max_total_time: 1800 }
          - { format: ffmpeg,    tier: 2, max_total_time: 1800 }
          - { format: webp,      tier: 2, max_total_time: 1800 }
          - { format: zfile,     tier: 2, max_total_time: 1800 }
          - { format: openvdb,   tier: 2, max_total_time: 1800 }
          - { format: ptex,      tier: 2, max_total_time: 1800 }
    uses: ./.github/workflows/build-steps.yml
    with:
      runner: ubuntu-latest
      nametag: fuzz-linux-clang
      container: aswf/ci-oiio:2027
      cc_compiler: clang
      cxx_compiler: clang++
      build_type: Release
      cxx_std: 20
      python_ver: "3.13"
      simd: "avx2,f16c"
      pybind11_ver: v3.0.0
      skip_tests: '1'
      fuzz_format: ${{ matrix.format }}
      fuzz_max_time: ${{ matrix.max_total_time }}
      # PNG is built locally because the container's system libpng is 1.6.37,
      # which leaks in png_handle_eXIf (fixed upstream in 1.6.40).
      setenvs: export SANITIZE=address,undefined
                      USE_PYTHON=0
                      OIIO_BUILD_FUZZ_TARGETS=ON
                      INSTALL_DOCS=OFF
                      OIIO_BUILD_TOOLS=OFF
                      OIIO_BUILD_TESTS=OFF
                      OpenImageIO_BUILD_LOCAL_DEPS="TIFF,libdeflate,PNG"

  #
  # Verify every format reported by oiio_fuzz_image --list-formats has a corpus
  # directory in src/fuzz/corpora/. Fails with a clear message when a new
  # format plugin is added without a corresponding corpus directory.
  #
  fuzz-corpus-lint:
    name: "Fuzz corpus coverage lint"
    if: github.event_name != 'schedule' || github.repository == 'AcademySoftwareFoundation/OpenImageIO'
    uses: ./.github/workflows/build-steps.yml
    with:
      runner: ubuntu-latest
      nametag: fuzz-corpus-lint
      container: aswf/ci-oiio:2027
      cc_compiler: clang
      cxx_compiler: clang++
      build_type: Release
      cxx_std: 20
      python_ver: "3.13"
      simd: "avx2,f16c"
      pybind11_ver: v3.0.0
      skip_tests: '1'
      fuzz_corpus_lint: true
      setenvs: export USE_PYTHON=0
                      OIIO_BUILD_FUZZ_TARGETS=ON
                      INSTALL_DOCS=OFF
                      OIIO_BUILD_TOOLS=OFF
                      OIIO_BUILD_TESTS=OFF