Bump step-security/harden-runner from 2.7.0 to 2.9.0 #34
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) the JPEG XL Project Authors. All rights reserved. | |
| # | |
| # Use of this source code is governed by a BSD-style | |
| # license that can be found in the LICENSE file. | |
| # CI on pull-requests to run the fuzzer from oss-fuzz. See: | |
| # | |
| # https://google.github.io/oss-fuzz/getting-started/continuous-integration/ | |
| name: CIFuzz | |
| on: | |
| merge_group: | |
| pull_request: | |
| types: [opened, reopened, labeled, unlabeled, synchronize] | |
| paths: | |
| - '**.c' | |
| - '**.cc' | |
| - '**.cmake' | |
| - '**.h' | |
| - '**CMakeLists.txt' | |
| - .github/workflows/fuzz.yml | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| fuzzing: | |
| # TODO(szabadka) Enable by default after there is a separate jpegli project | |
| # on oss-fuzz. | |
| if: ${{ contains(github.event.pull_request.labels.*.name, 'CI:fuzz') }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout source | |
| uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3 | |
| id: checkout | |
| with: | |
| # The build_fuzzers action checks out the code to the storage/libjxl | |
| # directory already, but doesn't check out the submodules. This step | |
| # is a workaround for checking out the submodules. | |
| path: storage/libjxl | |
| submodules: true | |
| - name: Build Fuzzers | |
| id: build | |
| uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@71ecd5d4e4bf9a6edc19c9fa6d2422fb528bca4f # master | |
| with: | |
| oss-fuzz-project-name: 'libjxl' | |
| language: c++ | |
| - name: Run Fuzzers | |
| uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@71ecd5d4e4bf9a6edc19c9fa6d2422fb528bca4f # master | |
| with: | |
| oss-fuzz-project-name: 'libjxl' | |
| language: c++ | |
| fuzz-seconds: 600 | |
| - name: Upload Crash | |
| uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2 | |
| if: failure() && steps.build.outcome == 'success' | |
| with: | |
| name: artifacts | |
| path: ./out/artifacts |