fuzzer-fix-automation.yml

name: Fuzzer Fix Automation

# Distinct from the caller's `fuzzer-fix-<issue>` group: this reusable workflow runs inside the caller's run, so sharing the name would make it cancel its own parent (cancel-in-progress).
concurrency:
  group: fuzzer-fix-automation-${{ inputs.issue_number || github.run_id }}
  cancel-in-progress: true

on:
  workflow_dispatch:
    inputs:
      issue_number:
        description: "Issue number to analyze and fix"
        required: true
        # Use string, not number: a `number` input is rendered as a float in
        # expression interpolation (e.g. `8189` becomes `8189.0`), which breaks
        # `gh issue view`, the fix branch name, and every issue comment.
        type: string
  workflow_call:
    inputs:
      issue_number:
        description: "Issue number to analyze and fix"
        required: true
        # See the workflow_dispatch note above: string avoids the `8189.0`
        # float rendering. The `issues` caller passes
        # `github.event.issue.number`, which coerces cleanly to a string.
        type: string

env:
  NIGHTLY_TOOLCHAIN: nightly-2026-09-10

jobs:
  attempt-fix:
    name: "Attempt to Fix Fuzzer Crash"
    # A called reusable workflow inherits the caller's github.event_name, so the
    # job sees the caller's event, never "workflow_call". Allow each caller:
    # - workflow_dispatch: a manual run of this workflow or of fuzz.yml.
    # - schedule: the in-pipeline attempt-fix-* jobs in fuzz.yml.
    # - issues: fuzzer-issue-autofix.yml.
    if: |
      github.event_name == 'workflow_dispatch' ||
      github.event_name == 'schedule' ||
      github.event_name == 'issues'

    runs-on: ubuntu-latest
    timeout-minutes: 120

    environment:
      # The GitHub App private key lives only in this environment, so only this
      # job can mint an App installation token. Using the App token (not
      # GITHUB_TOKEN) means the draft PR opened below triggers normal CI.
      name: claude-automation
      deployment: false

    permissions:
      # actions: read is needed for `gh run download` of the crash artifact.
      actions: read
      contents: write
      pull-requests: write
      issues: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
        with:
          # Don't leave the built-in GITHUB_TOKEN in git config; the fix is
          # committed and pushed with the App token so its PR triggers CI.
          persist-credentials: false

      - name: Fetch issue details
        id: fetch_issue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ISSUE_DATA=$(gh issue view ${{ inputs.issue_number }} --repo ${{ github.repository }} --json number,title,body,labels)
          echo "issue_number=${{ inputs.issue_number }}" >> $GITHUB_OUTPUT
          echo "issue_title=$(echo "$ISSUE_DATA" | jq -r '.title')" >> $GITHUB_OUTPUT
          echo "issue_body<<EOF" >> $GITHUB_OUTPUT
          echo "$ISSUE_DATA" | jq -r '.body' >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Setup Rust
        uses: ./.github/actions/setup-rust
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}
          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}

      - name: Install llvm
        uses: aminya/setup-cpp@v1
        with:
          compiler: llvm

      - uses: ./.github/actions/setup-fuzz-linker

      - name: Install cargo-fuzz
        uses: taiki-e/cache-cargo-install-action@66c9585ef5ca780ee69399975a5e911f47905995
        with:
          tool: cargo-fuzz

      - name: Extract crash details from issue
        id: extract
        shell: bash
        run: |
          # Extract crash details from the fetched issue body
          cat > issue_body.txt <<'ISSUE_EOF'
          ${{ steps.fetch_issue.outputs.issue_body }}
          ISSUE_EOF

          # Extract target name from issue body
          TARGET=$(grep -oP '(?<=\*\*Target\*\*: `)[^`]+' issue_body.txt || echo "file_io")
          echo "target=$TARGET" >> $GITHUB_OUTPUT

          # Extract crash file name
          CRASH_FILE=$(grep -oP '(?<=\*\*Crash File\*\*: `)[^`]+' issue_body.txt || echo "")
          echo "crash_file=$CRASH_FILE" >> $GITHUB_OUTPUT

          # Extract artifact URL
          ARTIFACT_URL=$(grep -oP 'https://[^\s]+/artifacts/[0-9]+' issue_body.txt | head -1 || echo "")
          echo "artifact_url=$ARTIFACT_URL" >> $GITHUB_OUTPUT

          echo "Extracted: target=$TARGET, crash_file=$CRASH_FILE"
          rm -f issue_body.txt

      - name: Validate issue details
        id: validate
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ISSUE_NUM="${{ inputs.issue_number }}"

          # Check if issue exists and has fuzzer label
          ISSUE_LABELS=$(gh issue view "$ISSUE_NUM" --repo ${{ github.repository }} --json labels --jq '.labels[].name')

          if ! echo "$ISSUE_LABELS" | grep -q "fuzzer"; then
            echo "❌ Issue #$ISSUE_NUM does not have 'fuzzer' label"
            exit 1
          fi

          echo "✅ Issue #$ISSUE_NUM has 'fuzzer' label"

          # Check if we have required crash details
          if [ -z "${{ steps.extract.outputs.crash_file }}" ]; then
            echo "❌ Could not extract crash file name from issue"
            exit 1
          fi

          if [ -z "${{ steps.extract.outputs.artifact_url }}" ]; then
            echo "❌ Could not extract artifact URL from issue"
            exit 1
          fi

          echo "✅ Extracted crash details: target=${{ steps.extract.outputs.target }}, crash_file=${{ steps.extract.outputs.crash_file }}"

      - name: Download and verify crash artifact
        id: download
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Extract run ID from artifact URL
          ARTIFACT_URL="${{ steps.extract.outputs.artifact_url }}"
          RUN_ID=$(echo "$ARTIFACT_URL" | grep -oP 'runs/\K[0-9]+')
          ARTIFACT_ID=$(echo "$ARTIFACT_URL" | grep -oP 'artifacts/\K[0-9]+')

          echo "Downloading artifact $ARTIFACT_ID from run $RUN_ID"

          # Download by artifact ID, not by name. A re-run of the fuzz workflow uploads a
          # second artifact with the same name, and `gh run download --name` then gets the
          # artifact of the latest attempt, which does not contain this crash file.
          gh api "repos/${{ github.repository }}/actions/artifacts/$ARTIFACT_ID/zip" > crash-artifact.zip
          unzip -q crash-artifact.zip
          rm crash-artifact.zip

          # Verify crash file exists
          CRASH_FILE_PATH="${{ steps.extract.outputs.target }}/${{ steps.extract.outputs.crash_file }}"
          if [ ! -f "$CRASH_FILE_PATH" ]; then
            echo "❌ Crash file not found: $CRASH_FILE_PATH"
            ls -la "${{ steps.extract.outputs.target }}/" || true
            exit 1
          fi

          echo "✅ Downloaded crash file: $CRASH_FILE_PATH"
          echo "crash_file_path=$CRASH_FILE_PATH" >> $GITHUB_OUTPUT

      - name: Build fuzzer target
        id: build
        run: |
          echo "Building fuzzer target: ${{ steps.extract.outputs.target }} (debug mode for faster build)"

          # Build the fuzzer target in debug mode (faster than release)
          if cargo +$NIGHTLY_TOOLCHAIN fuzz build --dev --sanitizer=none "${{ steps.extract.outputs.target }}" 2>&1 | tee fuzzer_build.log; then
            echo "✅ Fuzzer target built successfully"
            echo "build_success=true" >> $GITHUB_OUTPUT
          else
            echo "❌ Fuzzer target failed to build"
            echo "build_success=false" >> $GITHUB_OUTPUT

            # Show the build errors
            echo "Build errors:"
            tail -50 fuzzer_build.log
            exit 1
          fi

      - name: Reproduce crash
        id: reproduce
        continue-on-error: true
        run: |
          echo "Attempting to reproduce crash with fuzzer (debug mode)..."

          # Run fuzzer with crash file (debug mode, no sanitizer, full backtrace)
          RUST_BACKTRACE=full timeout 30s cargo +$NIGHTLY_TOOLCHAIN fuzz run --dev --sanitizer=none "${{ steps.extract.outputs.target }}" "${{ steps.download.outputs.crash_file_path }}" -- -runs=1 -rss_limit_mb=0 2>&1 | tee crash_reproduction.log

          FUZZ_EXIT_CODE=${PIPESTATUS[0]}

          if [ $FUZZ_EXIT_CODE -eq 0 ]; then
            echo "⚠️  Fuzzer did not crash - may have been fixed already"
            echo "crash_reproduced=false" >> $GITHUB_OUTPUT
          else
            echo "✅ Crash reproduced (exit code: $FUZZ_EXIT_CODE)"
            echo "crash_reproduced=true" >> $GITHUB_OUTPUT
          fi

      - name: Check if crash still exists
        if: steps.reproduce.outputs.crash_reproduced == 'false'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ISSUE_NUM="${{ inputs.issue_number }}"

          gh issue comment "$ISSUE_NUM" --repo ${{ github.repository }} --body "## 🤖 Automated Analysis

          I attempted to reproduce this crash but the fuzzer completed successfully without crashing.

          **This likely means the issue has already been fixed.**

          ### Verification Steps

          I ran:
          \`\`\`bash
          cargo +nightly fuzz run --sanitizer=none ${{ steps.extract.outputs.target }} ${{ steps.download.outputs.crash_file_path }} -- -runs=1 -rss_limit_mb=0
          \`\`\`

          The fuzzer exited with code 0 (success).

          ### Next Steps

          - Verify if a recent commit fixed this issue
          - If confirmed fixed, close this issue
          - If not fixed, the crash may be non-deterministic and requires further investigation"

          echo "Crash could not be reproduced - skipping fix attempt"
          exit 0

      - name: Generate short-lived GitHub App token
        id: app-token
        if: steps.reproduce.outputs.crash_reproduced == 'true'
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - name: Attempt to fix crash with Claude
        id: claude
        if: steps.reproduce.outputs.crash_reproduced == 'true'
        env:
          ISSUE_NUMBER: ${{ inputs.issue_number }}
          ISSUE_TITLE: ${{ steps.fetch_issue.outputs.issue_title }}
          ISSUE_BODY: ${{ steps.fetch_issue.outputs.issue_body }}
          TARGET: ${{ steps.extract.outputs.target }}
          CRASH_FILE: ${{ steps.extract.outputs.crash_file }}
          CRASH_FILE_PATH: ${{ steps.download.outputs.crash_file_path }}
          ARTIFACT_URL: ${{ steps.extract.outputs.artifact_url }}
        uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b  # v1.0.247
        with:
          # This job runs in the claude-automation environment, so the OIDC subject is
          # `environment:claude-automation`. Only the `vortex-claude-write` rule matches
          # that subject. The `vortex-claude-ci` rule fails the token exchange with 401.
          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_WRITE }}
          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
          anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
          # Use the App token (not GITHUB_TOKEN) so the committed fix branch and
          # its draft PR trigger normal pull_request CI workflows.
          github_token: ${{ steps.app-token.outputs.token }}
          show_full_output: true
          prompt: |
            # Fuzzer crash fix for issue #${{ env.ISSUE_NUMBER }}

            The fuzz target `${{ env.TARGET }}` crashes on the input at
            `${{ env.CRASH_FILE_PATH }}`. The crash is already reproduced, and
            `crash_reproduction.log` has the output with `RUST_BACKTRACE=full`.

            Find the root cause. If the fix is local and clear, such as a missing
            bounds check, missing validation, an unhandled edge case or an off-by-one,
            make the smallest fix and add a regression test that uses the crash input.
            If the fix needs an architecture change or domain knowledge that you do not
            have, do not change the code. Explain the cause and suggest an approach.

            A later step commits your changes to files that git already tracks and
            opens a draft pull request. Thus, do not run git or open a pull request.
            Put the regression test in an existing test file, and put the crash bytes
            in the test itself, because the downloaded crash file is not committed.

            To run the target again, use
            `cargo +$NIGHTLY_TOOLCHAIN fuzz run --dev --sanitizer=none ${{ env.TARGET }} <crash_file> -- -rss_limit_mb=0`.
            The `--dev` flag makes the build faster. Follow `AGENTS.md` and the nested
            `AGENTS.md` files that apply to the code that you change.

            Maintainers review your work on the issue, and the run can stop at the turn
            limit. Thus, post a comment with `gh issue comment ${{ env.ISSUE_NUMBER }}`
            after each stage: after the analysis, after the fix and after the test.
            Each comment must contain the related code in fenced blocks, so that each
            comment is complete without the others. The analysis shows the root cause,
            the crash location and the code at that location. The fix comment shows the
            full changed function or section. The last comment shows the fix, the full
            regression test and the test result, or, if you did not fix the crash, why
            a person must fix it and the approach that you suggest.
          claude_args: |
            --model claude-opus-5-5
            --max-turns 120
            --allowedTools "Read,Write,Edit,Glob,Grep,Bash(cargo:*),Bash(gh issue comment:*),Bash(gh run download:*),Bash(curl:*),Bash(find:*),Bash(ls:*),Bash(cat:*),Bash(RUST_BACKTRACE=* cargo:*)"

      - name: Verify Claude posted comments
        if: steps.reproduce.outputs.crash_reproduced == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          ISSUE_NUM="${{ inputs.issue_number }}"

          # Check for comments from claude-code[bot]
          COMMENT_COUNT=$(gh api "repos/${{ github.repository }}/issues/$ISSUE_NUM/comments" \
            --jq '[.[] | select(.user.login == "claude-code[bot]" or .user.type == "Bot")] | length')

          if [ "$COMMENT_COUNT" -eq 0 ]; then
            echo "⚠️ WARNING: Claude did not post any comments on issue #$ISSUE_NUM"
            echo "This may indicate Claude encountered an error early on"
            exit 1
          else
            echo "✅ Claude posted $COMMENT_COUNT comment(s) on issue #$ISSUE_NUM"

            # Show summary of what was posted
            echo "Comment titles:"
            gh api "repos/${{ github.repository }}/issues/$ISSUE_NUM/comments" \
              --jq '.[] | select(.user.login == "claude-code[bot]" or .user.type == "Bot") | "- " + (.body | split("\n") | .[0])'
          fi

      - name: Commit and push fix branch
        id: commit
        if: steps.reproduce.outputs.crash_reproduced == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          REPO: ${{ github.repository }}
          ISSUE_NUMBER: ${{ inputs.issue_number }}
          ISSUE_TITLE: ${{ steps.fetch_issue.outputs.issue_title }}
        run: |
          # claude-code-action only auto-creates a branch when it has an issue/PR
          # event to anchor to. This workflow runs via workflow_dispatch /
          # workflow_call, so we commit Claude's edits ourselves. `git add -u`
          # stages only modifications to already-tracked files, which captures the
          # source fix and regression test while ignoring the downloaded crash
          # artifacts, build outputs, and logs this job leaves untracked.
          git config user.name "vortex-claude[bot]"
          git config user.email "274007616+vortex-claude[bot]@users.noreply.github.com"

          git add -u
          # Never commit lockfile churn from the fuzz build.
          git reset -q -- '*Cargo.lock' 2>/dev/null || true

          if git diff --cached --quiet; then
            echo "No tracked source changes to commit — Claude produced no persistable fix."
            echo "pushed=false" >> "$GITHUB_OUTPUT"
            exit 0
          fi

          branch="fuzzer-fix/issue-${ISSUE_NUMBER}"
          git checkout -b "$branch"

          crash_desc="${ISSUE_TITLE#Fuzzing Crash: }"
          git commit -s \
            -m "fix(fuzz): $crash_desc (#$ISSUE_NUMBER)" \
            -m "Automated fix for fuzzer issue #$ISSUE_NUMBER."

          git push --force \
            "https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git" \
            "HEAD:refs/heads/$branch"

          echo "pushed=true" >> "$GITHUB_OUTPUT"
          echo "branch=$branch" >> "$GITHUB_OUTPUT"

      - name: Open draft pull request for fix branch
        # Only when a fix branch was pushed. The App token ensures the PR triggers
        # normal CI; a draft keeps the fuzzer firehose low-noise until a maintainer
        # marks it ready.
        if: steps.commit.outputs.pushed == 'true'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          REPO: ${{ github.repository }}
          BASE_BRANCH: ${{ github.event.repository.default_branch }}
          BRANCH_NAME: ${{ steps.commit.outputs.branch }}
          TARGET: ${{ steps.extract.outputs.target }}
          CRASH_FILE: ${{ steps.extract.outputs.crash_file }}
          ISSUE_NUMBER: ${{ inputs.issue_number }}
          ISSUE_TITLE: ${{ steps.fetch_issue.outputs.issue_title }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          existing_pr="$(
            gh pr list --repo "$REPO" --head "$BRANCH_NAME" --state all \
              --json url --jq '.[0].url // ""'
          )"

          if [[ -n "$existing_pr" ]]; then
            echo "Pull request already exists: $existing_pr"
            exit 0
          fi

          # Fuzzer issue titles look like "Fuzzing Crash: <variant> in <target>".
          # Drop that prefix so the PR title reads "fix(fuzz): <variant> in <target>"
          # instead of doubling up the "Fuzzing Crash:" wording.
          crash_desc="${ISSUE_TITLE#Fuzzing Crash: }"
          pr_title="fix(fuzz): $crash_desc (#$ISSUE_NUMBER)"

          # Deliberately no "Closes #N": the nightly close-fixed-fuzzer-issues
          # workflow re-runs the crash and closes the issue only once it no longer
          # reproduces, so merging this PR should not close the issue on its own.
          pr_body="$(cat <<EOF
          Automated draft fix for fuzzer issue #$ISSUE_NUMBER.

          - **Target**: \`$TARGET\`
          - **Crash file**: \`$CRASH_FILE\`

          Claude reproduced the crash, applied a minimal fix, and added a regression
          test. The full analysis, diff, and test output are posted on issue
          #$ISSUE_NUMBER.

          This is a **draft**: please review carefully before marking it ready. The
          linked issue is closed automatically by the nightly retest workflow once
          the crash no longer reproduces, so this PR does not close it on merge.

          [View Claude run]($RUN_URL)
          EOF
          )"

          # changelog/fix satisfies the required changelog-label check; create the owned fuzzer-fix label if missing so a fresh repo/fork doesn't error.
          gh label create "fuzzer-fix" --repo "$REPO" \
            --color "b60205" \
            --description "A fix auto-generated from a fuzzer issue" \
            2>/dev/null || true

          pr_url="$(
            gh pr create \
              --repo "$REPO" \
              --draft \
              --base "$BASE_BRANCH" \
              --head "$BRANCH_NAME" \
              --title "$pr_title" \
              --body "$pr_body" \
              --label "fuzzer-fix" \
              --label "changelog/fix"
          )"
          echo "Created draft pull request: $pr_url"

          gh issue comment "$ISSUE_NUMBER" --repo "$REPO" \
            --body "🔀 Opened a draft pull request with the proposed fix: $pr_url"