gh-143572: Run 'python3-libraries' fuzzer in CI using CIFuzz

[sethmlarson]

Created a list of files and directories that should trigger a re-run of the python3-libraries fuzzers. Now that the Python repository is the home for this fuzzer it should be easier for Python core developers to fix issues with the fuzzer in case there are issues.

• Issue: Begin running CIFuzz on standard library modules #143572

[hugovk]

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

[sethmlarson]

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

I agree with this, we can change most of our uses to "stdlib" within this PR except for oss-fuzz-project-name. I can handle that in a separate PR since we'll have to wait for OSS-Fuzz maintainers to rename the project.

[sethmlarson]

Thanks @StanFromIreland and @hugovk for the reviews! I've moved to a reusable workflows approach. I'll try pushing a commit modifying one of the libraries to check that the workflow fires correctly.

[webknjaz]

Suggested change

	uses: ./.github/workflows/reusable-cifuzz.yml
	with:
	oss-fuzz-project-name: cpython3
	cifuzz-stdlib:
	needs: build-context
	if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
	permissions:
	security-events: write
	uses: ./.github/workflows/reusable-cifuzz.yml
	with:
	oss-fuzz-project-name: cpython3
	cifuzz-stdlib:
	needs: build-context
	if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
	permissions:
	security-events: write

(https://github.com/python/cpython/pull/143749/files#r2686916751)

[webknjaz]

Can we try https://github.com/python/cpython/pull/143749/files#r2687006554 first, though?

[hugovk]

Yes, looks like it is needed the calling jobs in build.yml, because the CI didn't start:

The workflow is not valid. .github/workflows/build.yml (Line: 639, Col: 3): Error calling workflow 'python/cpython/.github/workflows/reusable-cifuzz.yml@98b701b'. The workflow is requesting 'security-events: write', but is only allowed 'security-events: none'.

https://github.com/python/cpython/actions/runs/20936855037?pr=143749

Maybe we try this smaller change to validate the permissions, before refactoring the matrix?

[sethmlarson]

I'm attempting the large matrix approach here: 3958c5d

[sethmlarson]

It seems to have mostly worked? I don't understand why the matrix values are empty, though.

[webknjaz]

I'll take a look but will likely have more clarity tomorrow.

[hugovk]

(I resolved the conflict)

[sethmlarson]

@webknjaz I'm not sure why actionlint is refusing the contains([...], 'true') syntax used, checking on the allowed function definitions it seemed like this would be allowed?

[sethmlarson]

With the latest commit we got a run, but the values of oss-fuzz-project-name and sanitizer aren't being forwarded (the reusable workflow is seeing an empty string?) from the job matrix into the reusable workflow. I don't think I'm doing anything different than any of the other reusable workflows that use a matrix and forward parameters?

[webknjaz]

@webknjaz I'm not sure why actionlint is refusing the contains([...], 'true') syntax used, checking on the allowed function definitions it seemed like this would be allowed?

Not sure. Might be a bug in actionlint. Or maybe I misunderstood that this'd work from the docs 🤷‍♂️

[webknjaz]

With the latest commit we got a run, but the values of oss-fuzz-project-name and sanitizer aren't being forwarded (the reusable workflow is seeing an empty string?) from the job matrix into the reusable workflow. I don't think I'm doing anything different than any of the other reusable workflows that use a matrix and forward parameters?

Sounds like maybe I messed up the suggested conditionals or something. I'll double-check the current diff.

[webknjaz]

The parens are redundant here:

Suggested change

	(
	needs.build-context.outputs.run-ci-fuzz == 'true'
	|| needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
	)
	needs.build-context.outputs.run-ci-fuzz == 'true'
	|| needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

[webknjaz]

This would need the same treatment as other matrices.

Suggested change

	name: CIFuzz
	# ${{ '' } is a hack to nest jobs under the same sidebar category.
	name: CIFuzz${{ '' }} # zizmor: ignore[obfuscation]

[webknjaz]

The only thing I can think of is that maybe empty strings mess up exclusions in GHA (is it possible they exclude all the matrix factors?). Let's try my initial suggestion first and go from there...

Suggested change

	&& ''
	|| 'cpython3'
	}}
	- oss-fuzz-project-name: >-
	${{
	needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
	&& ''
	&& 'dummy sentinel 🤪'
	|| 'cpython3'
	}}
	- oss-fuzz-project-name: >-
	${{
	needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
	&& 'dummy sentinel 🤪'

[webknjaz]

Another difference is that the original trick uses interpolation in the main matrix definition and here we use it in exclusions.

[webknjaz]

@sethmlarson I'm logging off now but meanwhile, could you restart the entire workflow ticking that debug checkbox in the rerun modal? I don't have privileges to do this myself yet.