name: Fuzz

# Mutation fuzzing of open/render/edit/save (`cargo xtask fuzz`), nightly and on demand. Findings
# are uploaded as an artifact; each real one becomes a synthetic regression test.
on:
  schedule:
    - cron: "17 3 * * *"
  workflow_dispatch:

# The token is only used to check out the code: no job writes to the repository.
permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

concurrency:
  group: fuzz-${{ github.ref }}
  cancel-in-progress: true

jobs:
  fuzz:
    name: fuzz (mutation, 15 min)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@686976e191b89faba57d3206551f0f330d8cb249 # stable
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          key: fuzz
      - name: Fetch the pdf.js corpus (seeds)
        run: cargo xtask corpus
      - name: Fuzz
        run: cargo xtask fuzz --time 900 --seed ${{ github.run_number }}
      - name: Upload findings
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: fuzz-findings
          path: fuzz-out/findings
          if-no-files-found: ignore