gh-143572: Run 'python3-libraries' fuzzer in CI using CIFuzz #143749

sethmlarson · 2026-01-12T19:39:38Z

Created a list of files and directories that should trigger a re-run of the python3-libraries fuzzers. Now that the Python repository is the home for this fuzzer it should be easier for Python core developers to fix issues with the fuzzer in case there are issues.

Issue: Begin running CIFuzz on standard library modules #143572

.github/workflows/build.yml

Misc/NEWS.d/next/Tools-Demos/2026-01-12-13-37-14.gh-issue-143572.WKV_Jk.rst

Tools/build/compute-changes.py

.github/workflows/reusable-context.yml

.github/workflows/build.yml

hugovk

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

.github/workflows/build.yml

sethmlarson · 2026-01-12T21:13:36Z

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

I agree with this, we can change most of our uses to "stdlib" within this PR except for oss-fuzz-project-name. I can handle that in a separate PR since we'll have to wait for OSS-Fuzz maintainers to rename the project.

sethmlarson · 2026-01-12T22:15:44Z

Thanks @StanFromIreland and @hugovk for the reviews! I've moved to a reusable workflows approach. I'll try pushing a commit modifying one of the libraries to check that the workflow fires correctly.

Tools/build/compute-changes.py

webknjaz · 2026-01-13T15:28:03Z

.github/workflows/reusable-cifuzz.yml

+permissions:
+  contents: read
+  security-events: write


I'm 99% sure this is required in the calling jobs in build.yml too. But maybe there's an exception for in-tree workflows. I haven't tested this in a while, though.

If jobs.<job_id>.permissions is not specified in the calling job, the called workflow will have the default permissions for the GITHUB_TOKEN.

(https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#supported-keywords-for-jobs-that-call-a-reusable-workflow)

GITHUB_TOKEN permissions can only be the same or more restrictive in nested workflows. For example, in the workflow chain A > B > C, if workflow A has package: read token permission, then B and C cannot have package: write permission.

(https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#access-and-permissions-for-nested-workflows)

I think, the above implies that the calling workflow should at least allow the minimum privileges needed here.

webknjaz · 2026-01-13T15:30:43Z

.github/workflows/reusable-cifuzz.yml

+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, undefined, memory]


Could pass this through inputs instead of having a matrix here? The idea of reusable-*.yml modules was that the matrices are kept on the top layer (build.yml) where the context is, while the steps are in single-job matrix-less reusable workflows.

The calling side for this would be #143749 (comment)

webknjaz · 2026-01-13T15:31:26Z

.github/workflows/reusable-cifuzz.yml

+  cifuzz:
+    name: CIFuzz
+    runs-on: ubuntu-latest
+    timeout-minutes: 60


I recommend having timeout-minutes in the inputs too. This allows having all the numbers surfaced in build.yml.

webknjaz · 2026-01-13T15:34:02Z

.github/workflows/reusable-context.yml

+        value: ${{ jobs.compute-changes.outputs.run-ci-fuzz }}  # bool
+      run-ci-fuzz-stdlib:
+        description: Whether to run the CIFuzz job for 'python3-libraries' fuzzer
        value: ${{ jobs.compute-changes.outputs.run-ci-fuzz }}  # bool


@sethmlarson did you mark @StanFromIreland's suggestion as resolved by accident?

Suggested change

value: ${{ jobs.compute-changes.outputs.run-ci-fuzz }} # bool

value: ${{ jobs.compute-changes.outputs.run-ci-fuzz-stdlib }} # bool

EDIT: corrected the referenced output name in my suggestion too

Ah, I thought I had fixed that instance but I guess not? Thanks for catching this.

webknjaz · 2026-01-13T15:36:29Z

.github/workflows/build.yml

+    uses: ./.github/workflows/reusable-cifuzz.yml
+    with:
+      oss-fuzz-project-name: cpython3
+  cifuzz-stdlib:
+    needs: build-context
+    if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'


Suggested change

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

permissions:

security-events: write

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

permissions:

security-events: write

(https://github.com/python/cpython/pull/143749/files#r2686916751)

Can we try https://github.com/python/cpython/pull/143749/files#r2687006554 first, though?

Yes, looks like it is needed the calling jobs in build.yml, because the CI didn't start:

The workflow is not valid. .github/workflows/build.yml (Line: 639, Col: 3): Error calling workflow 'python/cpython/.github/workflows/reusable-cifuzz.yml@98b701b'. The workflow is requesting 'security-events: write', but is only allowed 'security-events: none'.

https://github.com/python/cpython/actions/runs/20936855037?pr=143749

Maybe we try this smaller change to validate the permissions, before refactoring the matrix?

webknjaz · 2026-01-13T15:50:21Z

.github/workflows/build.yml

+    uses: ./.github/workflows/reusable-cifuzz.yml
+    with:
+      oss-fuzz-project-name: cpython3
+  cifuzz-stdlib:
+    needs: build-context
+    if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'
+    uses: ./.github/workflows/reusable-cifuzz.yml
+    with:
+      oss-fuzz-project-name: python3-libraries


Though, it's probably nicer to try collapsing these into a single matrix:

Suggested change

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: python3-libraries

if: >-

contains(

[

needs.build-context.outputs.run-ci-fuzz,

needs.build-context.outputs.run-ci-fuzz-stdlib

],

'true'

)

permissions:

security-events: write

strategy:

fail-fast: false

matrix:

sanitizer:

- address

- undefined

- memory

oss-fuzz-project-name:

- cpython3

- python3-libraries

exclude:

- oss-fuzz-project-name: >-

${{

needs.build-context.outputs.run-ci-fuzz == 'true'

&& 'dummy sentinel 🤪'

|| 'cpython3'

}}

- oss-fuzz-project-name: >-

${{

needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

&& 'dummy sentinel 🤪'

|| 'python3-libraries'

}}

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: ${{ matrix.oss-fuzz-project-name }}

sanitizer: ${{ matrix.sanitizer }}

timeout-minutes: 60

(an untested idea borrowed from

cpython/.github/workflows/build.yml

Lines 212 to 223 in 03f8d3b

is-fork: # only used for the exclusion trick

- ${{ github.repository_owner != 'python' }}

free-threading:

- false

- true

exclude:

- os: ghcr.io/cirruslabs/macos-runner:sonoma

is-fork: true

- os: macos-14

is-fork: false

- os: macos-13

free-threading: true

)

hugovk · 2026-01-13T16:10:56Z

(I resolved the conflict)

Run 'python3-libraries' fuzzer in CI using CIFuzz

2623d60

sethmlarson requested review from AA-Turner, ezio-melotti and hugovk as code owners January 12, 2026 19:39

bedevere-app bot added the awaiting review label Jan 12, 2026

bedevere-app bot mentioned this pull request Jan 12, 2026

Begin running CIFuzz on standard library modules #143572

Open

Add outputs to compute-changes job

88a5b0a

StanFromIreland reviewed Jan 12, 2026

View reviewed changes

hugovk reviewed Jan 12, 2026

View reviewed changes

.github/workflows/build.yml Outdated Show resolved Hide resolved

.github/workflows/build.yml Outdated Show resolved Hide resolved

.github/workflows/build.yml Outdated Show resolved Hide resolved

Move to reusable workflow approach

55ff6a4

sethmlarson added the skip news label Jan 12, 2026

picnixz reviewed Jan 12, 2026

View reviewed changes

Tools/build/compute-changes.py Show resolved Hide resolved

webknjaz reviewed Jan 13, 2026

View reviewed changes

Merge branch 'main' into detect-library-fuzzers-for-prs

2a9672f

	value: ${{ jobs.compute-changes.outputs.run-ci-fuzz }} # bool
	value: ${{ jobs.compute-changes.outputs.run-ci-fuzz-stdlib }} # bool

	is-fork: # only used for the exclusion trick
	- ${{ github.repository_owner != 'python' }}
	free-threading:
	- false
	- true
	exclude:
	- os: ghcr.io/cirruslabs/macos-runner:sonoma
	is-fork: true
	- os: macos-14
	is-fork: false
	- os: macos-13
	free-threading: true

Uh oh!

gh-143572: Run 'python3-libraries' fuzzer in CI using CIFuzz #143749

Are you sure you want to change the base?

gh-143572: Run 'python3-libraries' fuzzer in CI using CIFuzz #143749

Conversation

sethmlarson commented Jan 12, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

hugovk left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sethmlarson commented Jan 12, 2026

Uh oh!

sethmlarson commented Jan 12, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webknjaz Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

webknjaz Jan 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hugovk commented Jan 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sethmlarson commented Jan 12, 2026 •

edited by bedevere-app bot

Loading

webknjaz Jan 13, 2026 •

edited

Loading

webknjaz Jan 13, 2026 •

edited

Loading