nordisk/dwarves

pipelines/fuzz-private.runa.ron

// fuzz-private.runa.ron — the nightly fuzz run of a PRIVATE sibling's cargo-fuzz crate (lane
// MON-OSSF, 2026-10-31): monetize-impl's vendors (Stripe, Klarna, Swish) beside monetize.
// `cargo ci-verbs fuzz --private monetize-impl` fuzzes <checkout>/../monetize-impl, the private
// checkout the forge mounts read-only for a pipeline that names it in `private`; such a
// pipeline publishes its verdict only (`publish = "verdict-only"`), so neither the private code
// nor its fuzz output (a crashing input, its log) leaves dwarf. 300 s per target, the corpus
// kept between nights ($DWARVES_CI_FUZZ_CORPUS/monetize-impl); RED on a crash. 04:00 UTC with
// the open fuzz runs (the forge runs one pipeline at a time).
Pipeline(
    name: "fuzz-private",
    triggers: [
        Cron("0 4 * * *"),
        Manual,
    ],
    stages: [
        Stage(
            name: "fuzz",
            steps: [
                Xtask(cmd: "fuzz", alias: "ci-verbs", repo: "dwarves", args: ["--seconds", "300", "--private", "monetize-impl"]),
            ],
        ),
    ],
)