fuzz.yml

name: Fuzzing

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Run fuzzing weekly on Sundays at midnight UTC
    - cron: "0 0 * * 0"
  workflow_dispatch:
    inputs:
      fuzz_duration:
        description: "Fuzzing duration in seconds per target (push=120, PR=300, dispatch default=600)"
        required: false
        default: "600"

permissions:
  contents: read

jobs:
  atheris-fuzz:
    name: Python Fuzzing (Atheris) - ${{ matrix.shard_name }}
    runs-on: ubuntu-latest
    timeout-minutes: 90
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard_name: Shard 1/3
            shard_id: 1
            shard_key: shard-1-of-3
          - shard_name: Shard 2/3
            shard_id: 2
            shard_key: shard-2-of-3
          - shard_name: Shard 3/3
            shard_id: 3
            shard_key: shard-3-of-3

    env:
      MEOW_TEST_MODE: "1"
      MEOW_PRODUCTION_MODE: "0" # Required alongside MEOW_TEST_MODE to allow export_key() in tests
      MEOW_CRYPTO_BACKEND: rust

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - uses: dtolnay/rust-toolchain@d0592fe69e35bc8f12e3dbaf9ad2694d976cb8e3 # stable
        with:
          toolchain: stable

      - name: Install dependencies
        # Editable install (-e .) for local source - can't hash-pin
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            libzbar0 libgl1 libglib2.0-0 \
            build-essential pkg-config libssl-dev \
            libpcsclite-dev libudev-dev
          pip install --require-hashes -r requirements-pip.lock
          pip install --require-hashes -r requirements-ci.lock
          pip install --require-hashes -r requirements.lock
          pip install --require-hashes -r requirements-dev.lock || true
          pip install --no-deps -e .

      - name: Build and install Rust crypto backend
        run: |
          cd rust_crypto
          maturin build --release --out dist
          python -m pip install --force-reinstall --no-deps dist/*.whl
          cd ..

      - name: Create corpus directories
        run: |
          mkdir -p fuzz/corpus/manifest
          mkdir -p fuzz/corpus/qr
          mkdir -p fuzz/corpus/fountain
          mkdir -p fuzz/crashes

      - name: Seed corpus with valid samples
        run: |
          python fuzz/seed_corpus.py

      - name: Set fuzz duration
        run: |
          echo "DURATION=${{ github.event_name == 'push' && '120' || github.event.inputs.fuzz_duration || '300' }}" >> "$GITHUB_ENV"

      - name: Run Atheris shard targets
        run: |
          run_target() {
            local label="$1"
            shift
            echo "=== $label ==="
            timeout "${DURATION}s" "$@" || RC=$?
            RC=${RC:-0}
            [ "$RC" -eq 0 ] || [ "$RC" -eq 124 ] || exit "$RC"
            unset RC
          }

          case "${{ matrix.shard_id }}" in
            1)
              run_target "Fuzz manifest parser" python fuzz/fuzz_manifest.py fuzz/corpus/manifest
              run_target "Fuzz fountain decoder" python fuzz/fuzz_fountain.py fuzz/corpus/fountain
              run_target "Fuzz crypto operations" python fuzz/fuzz_crypto.py fuzz/corpus/manifest
              run_target "Fuzz guard page memory safety" python fuzz/fuzz_windows_guard.py
              run_target "Fuzz mouse gesture auth" python fuzz/fuzz_mouse_gesture.py
              run_target "Fuzz tamper detection" python fuzz/fuzz_tamper_detection.py
              run_target "Fuzz adversarial stego rotation" python fuzz/fuzz_adversarial_stego.py
              ;;
            2)
              run_target "Fuzz ratchet (frame encrypt/decrypt)" python fuzz/fuzz_ratchet.py
              run_target "Fuzz manifest signing (Ed25519/ML-DSA)" python fuzz/fuzz_manifest_signing.py
              run_target "Fuzz PQ ratchet beacon" python fuzz/fuzz_pq_ratchet_beacon.py
              run_target "Fuzz master ratchet" python fuzz/fuzz_master_ratchet.py
              run_target "Fuzz Schrodinger encode/decode" python fuzz/fuzz_schrodinger.py
              run_target "Fuzz crypto backend (Rust FFI)" python fuzz/fuzz_crypto_backend.py
              run_target "Fuzz Shamir secret sharing" python fuzz/fuzz_shamir.py
              ;;
            3)
              run_target "Fuzz memory guard operations" python fuzz/fuzz_memory_guard.py
              run_target "Fuzz dual stream encoding" python fuzz/fuzz_dual_stream.py
              run_target "Fuzz multi-layer stego" python fuzz/fuzz_stego_multilayer.py
              run_target "Fuzz PQ hybrid PQXDH (ML-KEM-768/1024 + X25519)" python fuzz/fuzz_pq_hybrid.py
              run_target "Fuzz X25519 forward secrecy" python fuzz/fuzz_x25519_fs.py
              run_target "Fuzz time-lock duress & content expiry" python fuzz/fuzz_timelock_expiry.py
              run_target "Fuzz forensic cleanup" python fuzz/fuzz_forensic_cleanup.py
              ;;
            *)
              echo "Unknown shard: ${{ matrix.shard_id }}"
              exit 1
              ;;
          esac

      # ── Crash gate (MUST fail the build on any crash) ───────────────────
      - name: Check for crashes
        run: |
          if [ -n "$(ls -A fuzz/crashes 2>/dev/null)" ]; then
            echo "🚨 Crashes found!"
            ls -la fuzz/crashes/
            exit 1
          else
            echo "✅ No crashes found"
          fi

      - name: Upload crash artifacts
        if: failure()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: fuzz-crashes-${{ matrix.shard_key }}-${{ github.run_id }}
          path: fuzz/crashes/
          retention-days: 30

  afl-fuzz:
    name: AFL++ Fuzzing (Native) - ${{ matrix.shard_name }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        include:
          - shard_name: Shard 1/3
            shard_id: 1
            shard_key: shard-1-of-3
          - shard_name: Shard 2/3
            shard_id: 2
            shard_key: shard-2-of-3
          - shard_name: Shard 3/3
            shard_id: 3
            shard_key: shard-3-of-3

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install AFL++
        run: |
          sudo apt-get update
          sudo apt-get install -y afl++ python3-dev

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - uses: dtolnay/rust-toolchain@d0592fe69e35bc8f12e3dbaf9ad2694d976cb8e3 # stable
        with:
          toolchain: stable

      - name: Install dependencies
        # Editable install for local source - can't hash-pin
        run: |
          sudo apt-get install -y \
            libzbar0 \
            build-essential pkg-config libssl-dev \
            libpcsclite-dev libudev-dev
          pip install --require-hashes -r requirements-pip.lock
          pip install --require-hashes -r requirements-ci.lock
          pip install --require-hashes -r requirements.lock
          pip install --no-deps -e ".[dev]"

      - name: Build and install Rust crypto backend
        run: |
          cd rust_crypto
          maturin build --release --out dist
          python -m pip install --force-reinstall --no-deps dist/*.whl
          cd ..

      - name: Create corpus
        run: |
          mkdir -p fuzz/afl-corpus
          mkdir -p fuzz/afl-output/${{ matrix.shard_key }}
          python fuzz/seed_corpus.py --afl

      - name: Run AFL++ shard
        run: |
          cd fuzz
          case "${{ matrix.shard_id }}" in
            1)
              echo "Running AFL shard 1/3 with default mutation strategy"
              ;;
            2)
              echo "Running AFL shard 2/3 with aggressive havoc expansion"
              export AFL_EXPAND_HAVOC_NOW=1
              ;;
            3)
              echo "Running AFL shard 3/3 with queue shuffling and trim disabled"
              export AFL_SHUFFLE_QUEUE=1
              export AFL_DISABLE_TRIM=1
              ;;
            *)
              echo "Unknown AFL shard: ${{ matrix.shard_id }}"
              exit 1
              ;;
          esac

          timeout ${{ github.event.inputs.fuzz_duration || '300' }}s \
            py-afl-fuzz -i afl-corpus -o afl-output/${{ matrix.shard_key }} -m none -- \
            python afl_fuzz_manifest.py || true

      - name: Check AFL++ results
        run: |
          if [ -d "fuzz/afl-output/${{ matrix.shard_key }}/default/crashes" ] && [ -n "$(ls -A fuzz/afl-output/${{ matrix.shard_key }}/default/crashes 2>/dev/null)" ]; then
            echo "🚨 AFL++ found crashes!"
            ls -la fuzz/afl-output/${{ matrix.shard_key }}/default/crashes/
            exit 1
          else
            echo "✅ No AFL++ crashes found"
          fi

      - name: Upload AFL++ results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: afl-results-${{ matrix.shard_key }}
          path: fuzz/afl-output/${{ matrix.shard_key }}/
          retention-days: 7