From 249948a9f1e0f1f641e447d9ae7c29788a400c4b Mon Sep 17 00:00:00 2001 From: Stan Ulbrych Date: Wed, 11 Nov 2026 16:42:21 +0000 Subject: [PATCH] [3.15] Remove CIFuzz GitHub Action --- .github/CODEOWNERS | 1 - .github/workflows/build.yml | 52 ----------- .github/workflows/reusable-cifuzz.yml | 49 ----------- .github/workflows/reusable-context.yml | 8 -- Lib/test/test_tools/test_compute_changes.py | 19 +--- Tools/build/compute-changes.py | 97 +-------------------- 6 files changed, 3 insertions(+), 223 deletions(-) delete mode 100644 .github/workflows/reusable-cifuzz.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 39fc2bacf90ba6d..53a1ee102d3fd05 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -134,7 +134,6 @@ Tools/check-c-api-docs/ @ZeroIntensity # Fuzzing Modules/_xxtestfuzz/ @python/fuzzers Lib/test/test_xxtestfuzz.py @python/fuzzers -.github/workflows/reusable-cifuzz.yml @python/fuzzers # Limited C API & Stable ABI Doc/c-api/stable.rst @encukou diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2f8f97b34d25b5a..63a26585a9e8276 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -651,50 +651,6 @@ jobs: run: | "$BUILD_DIR/cross-python/bin/python3" -m test test_sysconfig test_site test_embed - cifuzz: - # ${{ '' } is a hack to nest jobs under the same sidebar category. - name: CIFuzz${{ '' }} # zizmor: ignore[obfuscation] - needs: build-context - if: >- - needs.build-context.outputs.run-ci-fuzz == 'true' - || needs.build-context.outputs.run-ci-fuzz-stdlib == 'true' - permissions: - contents: read - security-events: write - strategy: - fail-fast: false - matrix: - sanitizer: - - address - oss-fuzz-project-name: - - cpython3 - - python3-libraries - include: - - sanitizer: undefined - oss-fuzz-project-name: cpython3 - - sanitizer: memory - oss-fuzz-project-name: cpython3 - exclude: - # Note that the 'no-exclude' sentinel below is to prevent - # an empty string value from excluding all jobs and causing - # GHA to create a 'default' matrix entry with all empty values. - - oss-fuzz-project-name: >- - ${{ - needs.build-context.outputs.run-ci-fuzz == 'true' - && 'no-exclude' - || 'cpython3' - }} - - oss-fuzz-project-name: >- - ${{ - needs.build-context.outputs.run-ci-fuzz-stdlib == 'true' - && 'no-exclude' - || 'python3-libraries' - }} - uses: ./.github/workflows/reusable-cifuzz.yml - with: - oss-fuzz-project-name: ${{ matrix.oss-fuzz-project-name }} - sanitizer: ${{ matrix.sanitizer }} - all-required-green: # This job does nothing and is only used for the branch protection name: All required checks pass runs-on: ubuntu-latest @@ -718,7 +674,6 @@ jobs: - build-asan - build-san - cross-build-linux - - cifuzz if: always() steps: @@ -731,7 +686,6 @@ jobs: build-windows-msi, build-ubuntu-ssltests, test-hypothesis, - cifuzz, allowed-skips: >- ${{ !fromJSON(needs.build-context.outputs.run-docs) && 'check-docs,' || '' }} ${{ @@ -749,12 +703,6 @@ jobs: || '' }} ${{ !fromJSON(needs.build-context.outputs.run-windows-tests) && 'build-windows,' || '' }} - ${{ - !fromJSON(needs.build-context.outputs.run-ci-fuzz) - && !fromJSON(needs.build-context.outputs.run-ci-fuzz-stdlib) - && 'cifuzz,' || - '' - }} ${{ !fromJSON(needs.build-context.outputs.run-macos) && 'build-macos,' || '' }} ${{ !fromJSON(needs.build-context.outputs.run-ubuntu) diff --git a/.github/workflows/reusable-cifuzz.yml b/.github/workflows/reusable-cifuzz.yml deleted file mode 100644 index a70b75eebc4a989..000000000000000 --- a/.github/workflows/reusable-cifuzz.yml +++ /dev/null @@ -1,49 +0,0 @@ -# CIFuzz job based on https://google.github.io/oss-fuzz/getting-started/continuous-integration/ -name: Reusable CIFuzz - -on: - workflow_call: - inputs: - oss-fuzz-project-name: - description: OSS-Fuzz project name - required: true - type: string - sanitizer: - description: OSS-Fuzz sanitizer - required: true - type: string - -permissions: - contents: read - -jobs: - cifuzz: - name: ${{ inputs.oss-fuzz-project-name }} (${{ inputs.sanitizer }}) - runs-on: ubuntu-latest - timeout-minutes: 60 - steps: - - name: Build fuzzers (${{ inputs.sanitizer }}) - id: build - uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@ed23f8af80ff82b25ca67cd9b101e690b8897b3f # master - with: - oss-fuzz-project-name: ${{ inputs.oss-fuzz-project-name }} - sanitizer: ${{ inputs.sanitizer }} - - name: Run fuzzers (${{ inputs.sanitizer }}) - uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@ed23f8af80ff82b25ca67cd9b101e690b8897b3f # master - with: - fuzz-seconds: 600 - oss-fuzz-project-name: ${{ inputs.oss-fuzz-project-name }} - output-sarif: true - sanitizer: ${{ inputs.sanitizer }} - - name: Upload crash - if: failure() && steps.build.outcome == 'success' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: ${{ inputs.sanitizer }}-artifacts - path: ./out/artifacts - - name: Upload SARIF - if: always() && steps.build.outcome == 'success' - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 - with: - sarif_file: cifuzz-sarif/results.sarif - checkout_path: cifuzz-sarif diff --git a/.github/workflows/reusable-context.yml b/.github/workflows/reusable-context.yml index ccd1d8c4007aaec..d58c00e37457521 100644 --- a/.github/workflows/reusable-context.yml +++ b/.github/workflows/reusable-context.yml @@ -20,12 +20,6 @@ on: # yamllint disable-line rule:truthy run-android: description: Whether to run the Android tests value: ${{ jobs.compute-changes.outputs.run-android }} # bool - run-ci-fuzz: - description: Whether to run the CIFuzz job for 'cpython' fuzzer - value: ${{ jobs.compute-changes.outputs.run-ci-fuzz }} # bool - run-ci-fuzz-stdlib: - description: Whether to run the CIFuzz job for 'python3-libraries' fuzzer - value: ${{ jobs.compute-changes.outputs.run-ci-fuzz-stdlib }} # bool run-docs: description: Whether to build the docs value: ${{ jobs.compute-changes.outputs.run-docs }} # bool @@ -64,8 +58,6 @@ jobs: timeout-minutes: 10 outputs: run-android: ${{ steps.changes.outputs.run-android }} - run-ci-fuzz: ${{ steps.changes.outputs.run-ci-fuzz }} - run-ci-fuzz-stdlib: ${{ steps.changes.outputs.run-ci-fuzz-stdlib }} run-docs: ${{ steps.changes.outputs.run-docs }} run-ios: ${{ steps.changes.outputs.run-ios }} run-macos: ${{ steps.changes.outputs.run-macos }} diff --git a/Lib/test/test_tools/test_compute_changes.py b/Lib/test/test_tools/test_compute_changes.py index eb1ecd447a7ce0a..b0310ca4c7f434e 100644 --- a/Lib/test/test_tools/test_compute_changes.py +++ b/Lib/test/test_tools/test_compute_changes.py @@ -6,8 +6,7 @@ from pathlib import Path from unittest.mock import patch -from test.support import os_helper -from test.test_tools import basepath, skip_if_missing, imports_under_tool +from test.test_tools import skip_if_missing, imports_under_tool skip_if_missing("build") @@ -16,7 +15,6 @@ compute_changes = importlib.import_module("compute-changes") process_changed_files = compute_changes.process_changed_files -is_fuzzable_library_file = compute_changes.is_fuzzable_library_file Outputs = compute_changes.Outputs ANDROID_DIRS = compute_changes.ANDROID_DIRS IOS_DIRS = compute_changes.IOS_DIRS @@ -24,7 +22,6 @@ WASI_DIRS = compute_changes.WASI_DIRS RUN_TESTS_IGNORE = compute_changes.RUN_TESTS_IGNORE UNIX_BUILD_SYSTEM_FILE_NAMES = compute_changes.UNIX_BUILD_SYSTEM_FILE_NAMES -LIBRARY_FUZZER_PATHS = compute_changes.LIBRARY_FUZZER_PATHS class TestProcessChangedFiles(unittest.TestCase): @@ -46,20 +43,6 @@ def test_docs(self): self.assertTrue(result.run_docs) self.assertFalse(result.run_tests) - def test_ci_fuzz_stdlib(self): - with os_helper.change_cwd(basepath): - for p in LIBRARY_FUZZER_PATHS: - with self.subTest(p=p): - if p.is_dir(): - f = p / "file" - elif p.is_file(): - f = p - else: - continue - result = process_changed_files({f}) - self.assertTrue(result.run_ci_fuzz_stdlib) - self.assertTrue(is_fuzzable_library_file(f)) - def test_android(self): for d in ANDROID_DIRS: with self.subTest(d=d): diff --git a/Tools/build/compute-changes.py b/Tools/build/compute-changes.py index 53d7b8fe32f89e6..dcce554bff851b5 100644 --- a/Tools/build/compute-changes.py +++ b/Tools/build/compute-changes.py @@ -44,7 +44,6 @@ Path("Tools/build/regen-configure.sh"), }) -SUFFIXES_C_OR_CPP = frozenset({".c", ".h", ".cpp"}) SUFFIXES_DOCUMENTATION = frozenset({".rst", ".md"}) ANDROID_DIRS = frozenset({"Android"}) @@ -53,63 +52,9 @@ MACOS_DIRS = frozenset({"Mac"}) WASI_DIRS = frozenset({Path("Platforms", "WASI")}) -LIBRARY_FUZZER_PATHS = frozenset({ - # All C/CPP fuzzers. - Path("configure"), - Path(".github/workflows/reusable-cifuzz.yml"), - # ast - Path("Lib/ast.py"), - Path("Python/ast.c"), - # configparser - Path("Lib/configparser.py"), - # csv - Path("Lib/csv.py"), - Path("Modules/_csv.c"), - # decode - Path("Lib/encodings/"), - Path("Modules/_codecsmodule.c"), - Path("Modules/cjkcodecs/"), - Path("Modules/unicodedata.c"), - Path("Modules/unicodedata_db.h"), - # difflib - Path("Lib/difflib.py"), - # email - Path("Lib/email/"), - # html - Path("Lib/html/"), - Path("Lib/_markupbase.py"), - # http.client - Path("Lib/http/client.py"), - # json - Path("Lib/json/"), - Path("Modules/_json.c"), - # plist - Path("Lib/plistlib.py"), - # re - Path("Lib/re/"), - Path("Modules/_sre/"), - # tarfile - Path("Lib/tarfile.py"), - # tomllib - Path("Lib/tomllib/"), - # xml - Path("Lib/xml/"), - Path("Lib/_markupbase.py"), - Path("Modules/expat/"), - Path("Modules/pyexpat.c"), - # zipfile - Path("Lib/zipfile/"), - # zoneinfo - Path("Lib/zoneinfo/"), - Path("Modules/_zoneinfo.c"), -}) - - @dataclass(kw_only=True, slots=True) class Outputs: run_android: bool = False - run_ci_fuzz: bool = False - run_ci_fuzz_stdlib: bool = False run_docs: bool = False run_emscripten: bool = False run_ios: bool = False @@ -147,16 +92,6 @@ def compute_changes() -> None: if outputs.run_windows_tests: print("Run Windows tests") - if outputs.run_ci_fuzz: - print("Run CIFuzz tests") - else: - print("Branch too old for CIFuzz tests; or no C files were changed") - - if outputs.run_ci_fuzz_stdlib: - print("Run CIFuzz tests for stdlib") - else: - print("Branch too old for CIFuzz tests; or no stdlib files were changed") - if outputs.run_docs: print("Build documentation") @@ -209,18 +144,8 @@ def get_file_platform(file: Path) -> str | None: return None -def is_fuzzable_library_file(file: Path) -> bool: - return any( - (file.is_relative_to(needs_fuzz) and needs_fuzz.is_dir()) - or (file == needs_fuzz and file.is_file()) - for needs_fuzz in LIBRARY_FUZZER_PATHS - ) - - def process_changed_files(changed_files: Set[Path]) -> Outputs: run_tests = False - run_ci_fuzz = False - run_ci_fuzz_stdlib = False run_docs = False run_windows_tests = False run_windows_msi = False @@ -234,8 +159,8 @@ def process_changed_files(changed_files: Set[Path]) -> Outputs: doc_file = file.suffix in SUFFIXES_DOCUMENTATION or doc_or_misc if file.parent == GITHUB_WORKFLOWS_PATH: - if file.name in ("build.yml", "reusable-cifuzz.yml"): - run_tests = run_ci_fuzz = run_ci_fuzz_stdlib = run_windows_tests = True + if file.name == "build.yml": + run_tests = run_windows_tests = True has_platform_specific_change = False continue if file.name in ("reusable-docs.yml", "reusable-check-html-ids.yml"): @@ -272,18 +197,6 @@ def process_changed_files(changed_files: Set[Path]) -> Outputs: if file not in UNIX_BUILD_SYSTEM_FILE_NAMES: run_windows_tests = True - # The fuzz tests are pretty slow so they are executed only for PRs - # changing relevant files. - if file.suffix in SUFFIXES_C_OR_CPP: - run_ci_fuzz = True - if file.parts[:2] in { - ("configure",), - ("Modules", "_xxtestfuzz"), - }: - run_ci_fuzz = True - if not run_ci_fuzz_stdlib and is_fuzzable_library_file(file): - run_ci_fuzz_stdlib = True - # Check for changed documentation-related files if doc_file: run_docs = True @@ -318,8 +231,6 @@ def process_changed_files(changed_files: Set[Path]) -> Outputs: return Outputs( run_android=run_android, - run_ci_fuzz=run_ci_fuzz, - run_ci_fuzz_stdlib=run_ci_fuzz_stdlib, run_docs=run_docs, run_emscripten=run_emscripten, run_ios=run_ios, @@ -336,10 +247,6 @@ def process_target_branch(outputs: Outputs, git_branch: str) -> Outputs: if not git_branch: outputs.run_tests = True - # CIFuzz / OSS-Fuzz compatibility with older branches may be broken. - if git_branch != GITHUB_DEFAULT_BRANCH: - outputs.run_ci_fuzz = False - if os.environ.get("GITHUB_EVENT_NAME", "").lower() == "workflow_dispatch": outputs.run_docs = True outputs.run_windows_msi = True