python / python/library-fuzzers

Should we stop fuzzing everything but `main`?

Open
#56 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Originally, I think it was intended that CI Fuzz only runs on PRs targeting main:

https://github.com/python/cpython/blob/0a179e748bcf158bdcdd47f0e57a1983993f4610/Modules/_xxtestfuzz/README.rst?plain=1#L16-L18

Some time ago, however, this changed and they were backported all the way to 3.13's CI. But, this causes us many false positives, e.g., https://github.com/python/cpython/actions/runs/27207159005/job/80325961063?pr=151151, as targets are written with main in mind. Generally the issues are varying exception types, which aren't terribly difficult to add and maintain here, but other cases need not be so simple. This raises the question, should we even run CIFuzz on branches other than main?

CC @python/fuzzers

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Modules/_xxtestfuzz/README.rst lines and inspect the referenced GitHub Actions run. Compare the intended main-only CI Fuzz behavior with the current behavior on backported branches, then establish whether non-main branches should be excluded. Done means the project has a decided policy and the corresponding CI behavior is addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, python
Domain
ci-cd, testing
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.