Add scheduled ingestion service #101
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ClusterFuzzLite — coverage-guided fuzzing for EDDI | |
| # Detected by OpenSSF Scorecard as the "Fuzzing" check | |
| # Fuzz targets: PathNavigator (OGNL replacement), MatchingUtilities (behavior rule conditions) | |
| # | |
| # Modes: | |
| # - PR: code-change fuzzing (5 min) — catches regressions in changed code | |
| # - Weekly: batch fuzzing (30 min) — deep continuous fuzzing for rare crashes | |
| name: ClusterFuzzLite | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - 'src/main/java/**' | |
| - 'src/test/java/**/Fuzz*.java' | |
| - 'src/test/java/**/*Fuzz*.java' | |
| - '.clusterfuzzlite/**' | |
| schedule: | |
| - cron: '0 4 * * 0' # Sunday 4am UTC — weekly deep fuzz | |
| permissions: {} | |
| jobs: | |
| # ─── PR mode: fuzz only changed code paths ───────────────────── | |
| pr-fuzzing: | |
| name: Fuzz (PR) | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| security-events: write # Upload SARIF findings | |
| steps: | |
| - name: Build Fuzzers | |
| id: build | |
| uses: google/clusterfuzzlite/actions/build_fuzzers@52ecc61cb587ee99c26825a112a21abf19c7448c # v1 | |
| with: | |
| language: jvm | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| sanitizer: address | |
| # Keep all fuzz targets even if the PR only touches vendored copies | |
| # in .clusterfuzzlite/ (not the original src/ files) | |
| keep-unaffected-fuzz-targets: true | |
| - name: Run Fuzzers | |
| id: run | |
| uses: google/clusterfuzzlite/actions/run_fuzzers@52ecc61cb587ee99c26825a112a21abf19c7448c # v1 | |
| with: | |
| language: jvm | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| fuzz-seconds: 300 | |
| mode: code-change | |
| # ─── Weekly batch mode: deep continuous fuzzing ───────────────── | |
| batch-fuzzing: | |
| name: Fuzz (Weekly) | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'schedule' | |
| permissions: | |
| security-events: write | |
| steps: | |
| - name: Build Fuzzers | |
| id: build | |
| uses: google/clusterfuzzlite/actions/build_fuzzers@52ecc61cb587ee99c26825a112a21abf19c7448c # v1 | |
| with: | |
| language: jvm | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| sanitizer: address | |
| - name: Run Fuzzers | |
| id: run | |
| uses: google/clusterfuzzlite/actions/run_fuzzers@52ecc61cb587ee99c26825a112a21abf19c7448c # v1 | |
| with: | |
| language: jvm | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| fuzz-seconds: 1800 | |
| mode: batch |