From a9d6f0951ef027625a48f7d403aaf0c597668e03 Mon Sep 17 00:00:00 2001 From: Cole Speelman Date: Wed, 2 Sep 2026 20:30:44 -0400 Subject: [PATCH] test: isolate release fuzz evidence from runner state --- PUBLIC-SNAPSHOT.json | 2 +- PUBLIC-SNAPSHOT.sha256 | 4 ++-- scripts/native-gate.sh | 17 +++++++++++------ scripts/release-check.sh | 16 ++++++++++------ 4 files changed, 24 insertions(+), 15 deletions(-) diff --git a/PUBLIC-SNAPSHOT.json b/PUBLIC-SNAPSHOT.json index f6eefa3..8824c05 100644 --- a/PUBLIC-SNAPSHOT.json +++ b/PUBLIC-SNAPSHOT.json @@ -1 +1 @@ -{"schema_version":2,"project":"sandwich-hime","export_policy":"exact-allowlist-v1","export_mode":"release","file_count":125,"allowlist_sha256":"b320a95ca85f48941ee956fde1eda46e0d9bc664da21d13c5f65a8f623063ed5","manifest_sha256":"e200f0397b8c511e1185d4f726448c95203fc8110856f92c1e00a5ef68a5dce6"} +{"schema_version":2,"project":"sandwich-hime","export_policy":"exact-allowlist-v1","export_mode":"release","file_count":125,"allowlist_sha256":"b320a95ca85f48941ee956fde1eda46e0d9bc664da21d13c5f65a8f623063ed5","manifest_sha256":"b3a0794eb5757d35ed3f32e0b1c131be16aff417e7bee20db36c124963cbd6b8"} diff --git a/PUBLIC-SNAPSHOT.sha256 b/PUBLIC-SNAPSHOT.sha256 index b456f66..7817104 100644 --- a/PUBLIC-SNAPSHOT.sha256 +++ b/PUBLIC-SNAPSHOT.sha256 @@ -111,12 +111,12 @@ b188917e258890e6b6e4840a6fd946fc9a77cabc2068da3764f221e4a6a5df97 ./sando/write_ 2d152851bc77f6eb5ca842a8021cde386a3cae91db819cd99cedc31b3b62518f ./scripts/README.md 81ab4c10a436bc9b345828a55c2fe446f297fa6cfd1debfe95e1082b6e28c969 ./scripts/check-licenses.sh 3adba1428df83d6180d4fa3c683f0604dc7cdc0c4358f3dae7595189cc40f949 ./scripts/export-public-snapshot.sh -1fe46704864c453ea146947393c7de67ca1265f7c43c42082a419c59f0c6eeac ./scripts/native-gate.sh +f391ac912cdeb6b139d4feaec29a992cb53faea0fc4bbe805fd380450b238f7c ./scripts/native-gate.sh a038a002f0c895fef38a7265bcb7df01efdda57de5c4d36d0dc7c8e377798a95 ./scripts/package-macos.sh 7d1e3606f3159e0d5d222bb5b02171ad90bb2c42b0e041042dcf8e6b7692c40a ./scripts/package-native.sh 1fddbdf81e86f4310a603cedd0f24a39d6c62d810c7e1e2e6c5f7bff1d1d4198 ./scripts/public-snapshot-lib.sh b320a95ca85f48941ee956fde1eda46e0d9bc664da21d13c5f65a8f623063ed5 ./scripts/public-snapshot.allow -b3c9504cb2feb8444bbf5fcc461feec388cbe4ff803c6dd09d99194ecd1442dc ./scripts/release-check.sh +8fa4ee6c6ae80c261a8f5c1ff18a89185b4ce6472ccb577e1daf61afaa146e14 ./scripts/release-check.sh 494cf5573cc6a891d4243ec01a98c43263de75090cb3b55c9c398e545b1ec1a8 ./scripts/sign-notarize-macos.sh 7c65325664e95df1a63262bc440a599fb799b36123a68c5cc26cfb81ddd08efa ./scripts/test-public-snapshot.sh 39a80708b1c1a64c837032c6570e77dea28b2c6e6058eea40efac63ad5827431 ./scripts/verify-consumer.sh diff --git a/scripts/native-gate.sh b/scripts/native-gate.sh index 80d9e81..000cc4b 100755 --- a/scripts/native-gate.sh +++ b/scripts/native-gate.sh @@ -38,13 +38,18 @@ mkdir -p -- "$output" ./scripts/check-licenses.sh ./scripts/test-public-snapshot.sh HIMESAN_RACE=1 ./scripts/verify.sh -go test ./internal/compiler -run '^$' -fuzz '^FuzzCompileNeverPanics$' -fuzztime=15s -parallel=1 -go test ./internal/compiler -run '^$' -fuzz '^FuzzGoDelimiterNeverPanics$' -fuzztime=15s -parallel=1 -go test ./internal/lsp -run '^$' -fuzz '^FuzzFrameReaderNeverPanics$' -fuzztime=15s -parallel=1 -go test ./internal/lsp -run '^$' -fuzz '^FuzzDocumentPositionNeverPanics$' -fuzztime=15s -parallel=1 ( - cd sando - go test -run '^$' -fuzz '^FuzzWriteURLPolicy$' -fuzztime=15s -parallel=1 + fuzz_cache=$(mktemp -d "${TMPDIR:-/tmp}/himesan-fuzz-cache.XXXXXXXX") + trap 'rm -rf -- "$fuzz_cache"' EXIT HUP INT TERM + export GOCACHE="$fuzz_cache" + go test ./internal/compiler -run '^$' -fuzz '^FuzzCompileNeverPanics$' -fuzztime=15s -parallel=1 + go test ./internal/compiler -run '^$' -fuzz '^FuzzGoDelimiterNeverPanics$' -fuzztime=15s -parallel=1 + go test ./internal/lsp -run '^$' -fuzz '^FuzzFrameReaderNeverPanics$' -fuzztime=15s -parallel=1 + go test ./internal/lsp -run '^$' -fuzz '^FuzzDocumentPositionNeverPanics$' -fuzztime=15s -parallel=1 + ( + cd sando + go test -run '^$' -fuzz '^FuzzWriteURLPolicy$' -fuzztime=15s -parallel=1 + ) ) go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... ( diff --git a/scripts/release-check.sh b/scripts/release-check.sh index e148e6a..fd2f0b2 100755 --- a/scripts/release-check.sh +++ b/scripts/release-check.sh @@ -245,13 +245,17 @@ done HIMESAN_RACE=1 ./scripts/verify.sh printf '\n==> bounded compiler fuzz gates\n' -go test ./internal/compiler -run '^$' -fuzz '^FuzzCompileNeverPanics$' -fuzztime=20s -parallel=1 -go test ./internal/compiler -run '^$' -fuzz '^FuzzGoDelimiterNeverPanics$' -fuzztime=20s -parallel=1 -go test ./internal/lsp -run '^$' -fuzz '^FuzzFrameReaderNeverPanics$' -fuzztime=20s -parallel=1 -go test ./internal/lsp -run '^$' -fuzz '^FuzzDocumentPositionNeverPanics$' -fuzztime=20s -parallel=1 ( - cd sando - go test -run '^$' -fuzz '^FuzzWriteURLPolicy$' -fuzztime=20s -parallel=1 + export GOCACHE="$artifact_dir/fuzz-go-build-cache" + mkdir -p "$GOCACHE" + go test ./internal/compiler -run '^$' -fuzz '^FuzzCompileNeverPanics$' -fuzztime=20s -parallel=1 + go test ./internal/compiler -run '^$' -fuzz '^FuzzGoDelimiterNeverPanics$' -fuzztime=20s -parallel=1 + go test ./internal/lsp -run '^$' -fuzz '^FuzzFrameReaderNeverPanics$' -fuzztime=20s -parallel=1 + go test ./internal/lsp -run '^$' -fuzz '^FuzzDocumentPositionNeverPanics$' -fuzztime=20s -parallel=1 + ( + cd sando + go test -run '^$' -fuzz '^FuzzWriteURLPolicy$' -fuzztime=20s -parallel=1 + ) ) printf '\n==> vulnerability scan (pinned golang.org/x/vuln v1.6.0)\n'