Search code, repositories, users, issues, pull requests...

Copy link

Contributor

@sethmlarson sethmlarson commented Jan 12, 2026 •

edited by bedevere-app bot

Loading

Created a list of files and directories that should trigger a re-run of the python3-libraries fuzzers. Now that the Python repository is the home for this fuzzer it should be easier for Python core developers to fix issues with the fuzzer in case there are issues.

Issue: Begin running CIFuzz on standard library modules #143572


 Run 'python3-libraries' fuzzer in CI using CIFuzz

2623d60

@sethmlarson sethmlarson requested review from AA-Turner, ezio-melotti and hugovk as code owners

January 12, 2026 19:39

@bedevere-app bedevere-app bot added the awaiting review label

@bedevere-app bedevere-app bot mentioned this pull request

Begin running CIFuzz on standard library modules #143572

Open


 Add outputs to compute-changes job

88a5b0a

StanFromIreland

StanFromIreland reviewed

.github/workflows/build.yml Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Tools-Demos/2026-01-12-13-37-14.gh-issue-143572.WKV_Jk.rst Outdated Show resolved Hide resolved

Tools/build/compute-changes.py Outdated Show resolved Hide resolved

.github/workflows/reusable-context.yml Outdated Show resolved Hide resolved

.github/workflows/build.yml Outdated Show resolved Hide resolved

.github/workflows/build.yml Show resolved Hide resolved

hugovk

hugovk reviewed

Copy link

Member

@hugovk hugovk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

.github/workflows/build.yml Outdated Show resolved Hide resolved

Copy link

Contributor Author

sethmlarson commented Jan 12, 2026

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

I agree with this, we can change most of our uses to "stdlib" within this PR except for oss-fuzz-project-name. I can handle that in a separate PR since we'll have to wait for OSS-Fuzz maintainers to rename the project.


 Move to reusable workflow approach

55ff6a4

@sethmlarson sethmlarson added the skip news label

Copy link

Contributor Author

sethmlarson commented Jan 12, 2026

Thanks @StanFromIreland and @hugovk for the reviews! I've moved to a reusable workflows approach. I'll try pushing a commit modifying one of the libraries to check that the workflow fires correctly.

picnixz

picnixz reviewed

Tools/build/compute-changes.py Show resolved Hide resolved

webknjaz

webknjaz reviewed

(https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#supported-keywords-for-jobs-that-call-a-reusable-workflow)

.github/workflows/reusable-cifuzz.yml Outdated

Comment on lines 12 to 14

permissions:

contents: read

security-events: write

Copy link

Contributor

@webknjaz webknjaz Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm 99% sure this is required in the calling jobs in build.yml too. But maybe there's an exception for in-tree workflows. I haven't tested this in a while, though.

If jobs.<job_id>.permissions is not specified in the calling job, the called workflow will have the default permissions for the GITHUB_TOKEN.

GITHUB_TOKEN permissions can only be the same or more restrictive in nested workflows. For example, in the workflow chain A > B > C, if workflow A has package: read token permission, then B and C cannot have package: write permission.

(https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations#access-and-permissions-for-nested-workflows)

I think, the above implies that the calling workflow should at least allow the minimum privileges needed here.

webknjaz

webknjaz reviewed

.github/workflows/reusable-cifuzz.yml Outdated Show resolved Hide resolved

webknjaz

webknjaz reviewed

.github/workflows/reusable-cifuzz.yml Outdated Show resolved Hide resolved

webknjaz

webknjaz reviewed

.github/workflows/reusable-context.yml Outdated Show resolved Hide resolved

webknjaz

webknjaz reviewed

(https://github.com/python/cpython/pull/143749/files#r2686916751)

.github/workflows/build.yml Outdated

Comment on lines 642 to 647

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

Copy link

Contributor

@webknjaz webknjaz Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

permissions:

security-events: write

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

permissions:

security-events: write

Copy link

Contributor

@webknjaz webknjaz Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we try https://github.com/python/cpython/pull/143749/files#r2687006554 first, though?

Copy link

Member

@hugovk hugovk Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, looks like it is needed the calling jobs in build.yml, because the CI didn't start:

The workflow is not valid. .github/workflows/build.yml (Line: 639, Col: 3): Error calling workflow 'python/cpython/.github/workflows/reusable-cifuzz.yml@98b701b'. The workflow is requesting 'security-events: write', but is only allowed 'security-events: none'.

https://github.com/python/cpython/actions/runs/20936855037?pr=143749

Maybe we try this smaller change to validate the permissions, before refactoring the matrix?

Copy link

Contributor Author

@sethmlarson sethmlarson Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm attempting the large matrix approach here: 3958c5d

webknjaz

webknjaz reviewed

.github/workflows/build.yml Outdated

Comment on lines 642 to 650

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: python3-libraries

Copy link

Contributor

@webknjaz webknjaz Jan 13, 2026 •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though, it's probably nicer to try collapsing these into a single matrix:

Suggested change

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: cpython3

cifuzz-stdlib:

needs: build-context

if: needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: python3-libraries

if: >-

contains(

[

needs.build-context.outputs.run-ci-fuzz,

needs.build-context.outputs.run-ci-fuzz-stdlib

'true'

)

permissions:

security-events: write

strategy:

fail-fast: false

matrix:

sanitizer:

- address

- undefined

- memory

oss-fuzz-project-name:

- cpython3

- python3-libraries

exclude:

- oss-fuzz-project-name: >-

${{

needs.build-context.outputs.run-ci-fuzz == 'true'

&& 'dummy sentinel 🤪'

|| 'cpython3'

}}

- oss-fuzz-project-name: >-

${{

needs.build-context.outputs.run-ci-fuzz-stdlib == 'true'

&& 'dummy sentinel 🤪'

|| 'python3-libraries'

}}

uses: ./.github/workflows/reusable-cifuzz.yml

with:

oss-fuzz-project-name: ${{ matrix.oss-fuzz-project-name }}

sanitizer: ${{ matrix.sanitizer }}

timeout-minutes: 60

(an untested idea borrowed from

cpython/.github/workflows/build.yml

Lines 212 to 223 in 03f8d3b

is-fork: # only used for the exclusion trick

- ${{ github.repository_owner != 'python' }}

free-threading:

- false

- true

exclude:

- os: ghcr.io/cirruslabs/macos-runner:sonoma

is-fork: true

- os: macos-14

is-fork: false

- os: macos-13

free-threading: true

)

@hugovk


 Merge branch 'main' into detect-library-fuzzers-for-prs

2a9672f

@hugovk

Copy link

Member

hugovk commented Jan 13, 2026

(I resolved the conflict)

@sethmlarson @webknjaz


 Move to matrix with excludes approach

3958c5d

Co-authored-by: 🇺🇦 Sviatoslav Sydorenko (Святослав Сидоренко) <578543+webknjaz@users.noreply.github.com>

Copy link

Contributor Author

sethmlarson commented Jan 13, 2026

@webknjaz I'm not sure why actionlint is refusing the contains([...], 'true') syntax used, checking on the allowed function definitions it seemed like this would be allowed?