name: Runtime security checks

on:
  push:
  pull_request:
  schedule:
    - cron: '17 4 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  parser-fuzz:
    name: Sanitizers and HTTP parser fuzzing
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Install Clang
        run: |
          sudo apt-get update
          sudo apt-get install --yes --no-install-recommends clang

      - name: Run C runtime harnesses with ASan and UBSan
        run: sh scripts/runtime-c-sanitizers.sh

      - name: Verify fuzz regression promotion and replay
        run: sh tests/fuzz-regression-pipeline.sh

      - name: Run seeded coverage-guided parser fuzzing
        env:
          YAZA_FUZZ_REQUIRE_LIBFUZZER: '1'
          YAZA_FUZZ_BINARY: ${{ runner.temp }}/yaza-fuzz-runtime
          UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
        run: |
          set -eu
          corpus_dir="${RUNNER_TEMP}/yaza-fuzz-corpus"
          artifact_dir="${RUNNER_TEMP}/yaza-fuzz-artifacts"
          mkdir -p "$corpus_dir" "$artifact_dir"
          sh scripts/seed-http-fuzz-corpus.sh "$corpus_dir"
          sh scripts/fuzz-runtime.sh "$corpus_dir" \
            -runs=50000 -max_len=65535 -timeout=2 \
            -artifact_prefix="${artifact_dir}/"

      - name: Preserve fuzz findings
        if: failure()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: yaza-http-parser-fuzz-findings
          path: ${{ runner.temp }}/yaza-fuzz-artifacts/
          if-no-files-found: ignore