use ClusterFuzzLite instead

Co-authored-by: AdamKorcz <[email protected]>

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,4 @@
+FROM gcr.io/oss-fuzz-base/base-builder-go
+COPY . $SRC/spicedb
+WORKDIR $SRC/spicedb
+COPY ./.clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,10 @@
+#!/bin/bash -eu
+
+go install github.com/AdamKorcz/go-118-fuzz-build@latest
+go get github.com/AdamKorcz/go-118-fuzz-build/utils
+
+# Workaround https://github.com/AdamKorcz/go-118-fuzz-build/issues/2
+mv $SRC/spicedb/pkg/schemadsl/parser/parser_test.go $SRC/spicedb/pkg/schemadsl/parser/parser_test_fuzz.go
+
+compile_native_go_fuzzer github.com/authzed/spicedb/pkg/schemadsl/parser FuzzParser FuzzParser
+

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: "go"

.github/workflows/fuzzing.yaml

@@ -1,40 +1,34 @@
-name: "Fuzzing Testing"
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - "!dependabot/*"
-      - "main"
+---
+name: "ClusterFuzzLite PR fuzzing"
+on:
   pull_request:
-    branches: ["*"]
+    paths:
+      - '**'
+permissions: "read-all"
 jobs:
   fuzz:
     runs-on: "ubuntu-latest"
+    concurrency:
+      group: "${{ github.workflow }}-${{ matrix.sanitizer }}-${{ github.ref }}"
+      cancel-in-progress: true
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer:
+          - "address"
     steps:
-      - name: "Build Fuzzers"
+      - name: "Build Fuzzers (${{ matrix.sanitizer }})"
         id: "build"
-        uses: "google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master"
+        uses: "google/clusterfuzzlite/actions/build_fuzzers@v1"
         with:
-          oss-fuzz-project-name: "spicedb"
           language: "go"
-          dry-run: "true"
-      - name: "Run Fuzzers"
-        uses: "google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master"
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+          sanitizer: "${{ matrix.sanitizer }}"
+      - name: "Run Fuzzers (${{ matrix.sanitizer }})"
+        id: "run"
+        uses: "google/clusterfuzzlite/actions/run_fuzzers@v1"
         with:
-          oss-fuzz-project-name: "spicedb"
-          language: "go"
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
           fuzz-seconds: 300
-          dry-run: "true"
-      - name: "Upload Crash"
-        uses: "actions/upload-artifact@v3"
-        if: failure() && steps.build.outcome == 'success'
-        with:
-          name: "artifacts"
-          path: "./out/artifacts"
-
-  go-test-fuzz:
-    name : "go test -fuzz"
-    runs-on: "ubuntu-latest"
-    steps:
-      - uses: "jidicula/[email protected]"
-        with:
-          fuzz-time: 30s
+          mode: "code-change"
+          sanitizer: "${{ matrix.sanitizer }}"

pkg/schemadsl/parser/parser_test.go

@@ -170,3 +170,9 @@ func getParseTree(currentNode *testNode, indentation int) string {
 
 	return parseTree
 }
+
+func FuzzParser(f *testing.F) {
+	f.Fuzz(func(t *testing.T, path, in string) {
+		_ = Parse(createAstNode, input.Source(path), in)
+	})
+}