feat(ci): add go-fuzz reusable workflow#129
Merged
Conversation
Add reusable workflow for Go fuzz testing with configurable command, Go version, artifact upload on failure, and dry_run support.
WalkthroughAdds a new reusable GitHub Actions workflow Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/go-fuzz.yml:
- Around line 78-90: The dry-run branch for inputs.dry_run only prints a summary
and never invokes the fuzz tool, so it doesn't validate the resolved inputs or
surface command-level issues; update the Dry run summary step to also run the
fuzz command in preview/verbose mode by invoking the same command used in the
"Run Fuzz Tests" step but with tool-native preview flags (e.g., add a dedicated
preview input or append --dry-run/--debug/--check/--plan/--diff as supported) so
that ${{ inputs.fuzz_command }} is exercised during dry runs; ensure you print
all resolved inputs/computed variables (runner_type, go_version, fuzz_command,
fuzz_artifacts_path, artifacts_retention_days) with ::notice:: annotations and
keep the real execution in the "Run Fuzz Tests" step unchanged so dry_run
validates configuration safely without performing full test runs.
- Around line 92-98: The artifact upload step is gated on global failure() which
is true for any earlier failure; add an id to the fuzz step (e.g., id: fuzz) and
change the upload step's condition to check that specific step's outcome (e.g.,
if: ${{ !inputs.dry_run && steps.fuzz.outcome == 'failure' }}), so artifacts are
only uploaded when the fuzz step (referenced as steps.fuzz) actually failed.
In `@docs/go-fuzz.md`:
- Around line 23-64: The examples reference a release tag that doesn't include
the new workflow (go-fuzz.yml@v1.12.0); update the snippet references so they
don't point to a tag that lacks the file — either change the production and
custom examples to use `@develop` (or a branch ref like `@feat/`<branch>) until a
release is made, or replace `@v1.12.0` with the actual first published tag that
contains go-fuzz.yml; ensure the with keys (go_version, dry_run, fuzz_command,
fuzz_artifacts_path) remain unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5092ade0-4ef1-402a-924c-e91e457fcaf9
📒 Files selected for processing (2)
.github/workflows/go-fuzz.ymldocs/go-fuzz.md
bedatty
commented
Mar 10, 2026
bedatty
dismissed
coderabbitai[bot]’s stale review
All comments addressed — 1 applied (artifact upload scope), 2 dismissed with justification (dry_run preview and version tag).
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/go-fuzz.yml (1)
17-20:⚠️ Potential issue | 🟠 Major
dry_runstill skips the only real validation path.This branch only prints a summary and never exercises a preview/debug variant of the fuzz invocation, so caller misconfiguration in
fuzz_commandstill won't surface until a real run. Withfuzz_commandmodeled as an opaque shell string, the workflow also has no safe way to append tool-native preview flags itself. Either own thego testinvocation in this workflow, or add a dedicatedfuzz_preview_commandinput and execute that here; also emit each resolved value via::notice::instead of plainecho.
As per coding guidelines, "Whendry_run: true, use::notice::annotations to indicate dry run state, print every resolved input and computed variable, enable tool-native verbose/preview flags (--dry-run --debug,--check,--plan,--diff), and never skip silently."Also applies to: 78-91
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/go-fuzz.yml around lines 17 - 20, The workflow currently treats fuzz_command as an opaque string (default 'make fuzz-ci') and when dry_run is true it only echoes a summary, so misconfigurations aren't validated; add a new input fuzz_preview_command (or replace opaque string by owning the go test invocation) and, when dry_run is true, run the preview invocation with tool-native preview/verbose flags (e.g., --dry-run/--debug/--check/--plan/--diff as supported) instead of skipping, emit every resolved input and computed variable using ::notice:: (not plain echo), and ensure the logic that handles dry_run prints the resolved fuzz_command and fuzz_preview_command via ::notice:: so callers can validate the full command string before real execution.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/go-fuzz.yml:
- Around line 93-99: The upload step "Upload Fuzz Artifacts" is never reached
because the current if: expression implicitly requires earlier success; change
the condition to explicitly allow runs on failed workflow status by using the
failure() check. Update the step's if expression (the one using inputs.dry_run
and steps.fuzz.outcome) to include failure(), e.g. combine !inputs.dry_run with
failure() (and you may keep steps.fuzz.outcome == 'failure' if you want both
checks) so the "Upload Fuzz Artifacts" step will run when the fuzz step
(steps.fuzz) fails.
---
Duplicate comments:
In @.github/workflows/go-fuzz.yml:
- Around line 17-20: The workflow currently treats fuzz_command as an opaque
string (default 'make fuzz-ci') and when dry_run is true it only echoes a
summary, so misconfigurations aren't validated; add a new input
fuzz_preview_command (or replace opaque string by owning the go test invocation)
and, when dry_run is true, run the preview invocation with tool-native
preview/verbose flags (e.g., --dry-run/--debug/--check/--plan/--diff as
supported) instead of skipping, emit every resolved input and computed variable
using ::notice:: (not plain echo), and ensure the logic that handles dry_run
prints the resolved fuzz_command and fuzz_preview_command via ::notice:: so
callers can validate the full command string before real execution.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: d262ca1f-1e0f-4d1b-85b2-c573b8786c31
📒 Files selected for processing (1)
.github/workflows/go-fuzz.yml
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (1)
.github/workflows/go-fuzz.yml (1)
103-109:⚠️ Potential issue | 🔴 CriticalInclude
failure()in the artifact-upload guard.This condition is still implicitly wrapped in
success(), so the step is skipped whenRun Fuzz Testsfails. The fuzz artifacts never upload on the path they are meant to handle.Suggested fix
- name: Upload Fuzz Artifacts - if: ${{ !inputs.dry_run && steps.fuzz.outcome == 'failure' }} + if: ${{ !inputs.dry_run && failure() && steps.fuzz.outcome == 'failure' }} uses: actions/upload-artifact@v7 with: name: fuzz-failures path: ${{ inputs.fuzz_artifacts_path }} retention-days: ${{ inputs.artifacts_retention_days }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/go-fuzz.yml around lines 103 - 109, The Upload Fuzz Artifacts step guard skips on job failure because it is implicitly wrapped in success(); update the if condition on the "Upload Fuzz Artifacts" step to include GitHub Actions' failure() check so artifacts upload when the fuzz step or the job fails—for example, change the if to include failure(), e.g. replace the existing condition using steps.fuzz.outcome with one that includes failure(): if: ${{ !inputs.dry_run && (failure() || steps.fuzz.outcome == 'failure') }}, keeping the existing inputs checks intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/go-fuzz.yml:
- Around line 87-96: The "Dry run summary" workflow step currently injects
caller-controlled inputs directly into the run script (echoing `${{ inputs.*
}}`), which is unsafe; change the step to pass each input via the step's env
mapping (e.g., map runner_type, go_version, fuzz_command, fuzz_artifacts_path,
artifacts_retention_days, timeout_minutes into environment variables) and in the
run script reference those env vars rather than interpolating inputs, printing
them with a safe formatter such as printf and "%q" (or printf "%s\n" "$VAR") to
avoid shell injection and preserve newlines/quotes; ensure all occurrences of
`${{ inputs.* }}` in the "Dry run summary" step are removed from the run block
and replaced by the corresponding environment variable references.
In `@docs/go-fuzz.md`:
- Line 8: Add a short "Rationale" section to docs/go-fuzz.md that explains why
we use the third-party actions actions/checkout, actions/setup-go, and
actions/upload-artifact (what each provides in the workflow: checking out code,
installing Go toolchain, and collecting failure artifacts), and call out that
these actions must be pinned to a specific tag or SHA (not `@main/`@master) with a
brief note on why each action/version was chosen (stability, community
maintenance, or required features) so callers understand the dependency choices
and upgrade surface.
- Around line 72-75: The fenced YAML block showing the example for fuzz_command
lacks surrounding blank lines which triggers markdownlint MD031; update the
documentation around the 'fuzz_command' example by inserting a blank line before
the opening ```yaml fence and a blank line after the closing ``` fence so the
nested code block is properly separated and renders correctly.
---
Duplicate comments:
In @.github/workflows/go-fuzz.yml:
- Around line 103-109: The Upload Fuzz Artifacts step guard skips on job failure
because it is implicitly wrapped in success(); update the if condition on the
"Upload Fuzz Artifacts" step to include GitHub Actions' failure() check so
artifacts upload when the fuzz step or the job fails—for example, change the if
to include failure(), e.g. replace the existing condition using
steps.fuzz.outcome with one that includes failure(): if: ${{ !inputs.dry_run &&
(failure() || steps.fuzz.outcome == 'failure') }}, keeping the existing inputs
checks intact.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: b1100acf-3d63-4a47-a977-67372cb165b0
📒 Files selected for processing (2)
.github/workflows/go-fuzz.ymldocs/go-fuzz.md
bedatty
dismissed stale reviews from coderabbitai[bot] and coderabbitai[bot]
All comments addressed — failure() bug acknowledged, will fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Add a new reusable workflow
go-fuzz.ymlfor running Go fuzz tests across repositories.Features:
dry_runsupport for previewing configuration without executing testsworkflow_dispatchfor manual testingFiles added:
.github/workflows/go-fuzz.yml— reusable workflowdocs/go-fuzz.md— documentationType of Change
feat: New workflow or new input/output/step in an existing workflowBreaking Changes
None.
Testing
Caller repo / workflow run: flowker will consume this via
@develop(PR pending)Related Issues
N/A
Summary by CodeRabbit
New Features
Documentation