name: Fuzz

# Mutation fuzzing of open/render/edit/save (`cargo xtask fuzz`), nightly and on demand. Findings
# are uploaded as an artifact; each real one becomes a synthetic regression test.
on:
  schedule:
    - cron: "17 3 * * *"
  workflow_dispatch:

# The token is only used to check out the code: no job writes to the repository.
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

concurrency:
  group: fuzz-${{ github.ref }}
  cancel-in-progress: true

jobs:
  fuzz:
    name: fuzz (mutation, 15 min)
    runs-on: ubuntu-latest
    steps:
      - name: Harden runner
        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: step-security/dtolnay-rust-toolchain@8dd607977d06adf4ed49b190381e74c17a9dd25f # v1.0.0
        with:
          toolchain: stable
      - uses: step-security/rust-cache@8871c8ba063416da7c32246932ea6ae08700453e # v2.9.2
        with:
          key: fuzz
      - name: Fetch the pdf.js corpus (seeds)
        run: cargo xtask corpus
      - name: Fuzz
        run: cargo xtask fuzz --time 900 --seed ${{ github.run_number }}
      - name: Upload findings
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: fuzz-findings
          path: fuzz-out/findings
          if-no-files-found: ignore