From c21ef7f52ed0ef61a15355c8e6427d69af9e049c Mon Sep 17 00:00:00 2001 From: LucaCappelletti94 Date: Mon, 9 Nov 2026 18:03:38 +0100 Subject: [PATCH] Remove CodeQL and ClusterFuzzLite from CI --- .clusterfuzzlite/Dockerfile | 4 -- .clusterfuzzlite/build.sh | 24 ------------ .clusterfuzzlite/project.yaml | 3 -- .github/codeql/codeql-config.yml | 9 ----- .github/workflows/cflite_batch.yml | 35 ----------------- .github/workflows/cflite_build.yml | 23 ------------ .github/workflows/cflite_pr.yml | 29 -------------- .github/workflows/cflite_prune.yml | 32 ---------------- .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 50 ------------------------- .github/workflows/sqlite3mc-release.yml | 2 +- README.md | 3 +- 12 files changed, 3 insertions(+), 213 deletions(-) delete mode 100644 .clusterfuzzlite/Dockerfile delete mode 100755 .clusterfuzzlite/build.sh delete mode 100644 .clusterfuzzlite/project.yaml delete mode 100644 .github/codeql/codeql-config.yml delete mode 100644 .github/workflows/cflite_batch.yml delete mode 100644 .github/workflows/cflite_build.yml delete mode 100644 .github/workflows/cflite_pr.yml delete mode 100644 .github/workflows/cflite_prune.yml delete mode 100644 .github/workflows/codeql.yml diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile deleted file mode 100644 index 4e8b42a..0000000 --- a/.clusterfuzzlite/Dockerfile +++ /dev/null @@ -1,4 +0,0 @@ -FROM gcr.io/oss-fuzz-base/base-builder-rust -COPY . $SRC/sqlite3mc-src -WORKDIR $SRC/sqlite3mc-src -COPY ./.clusterfuzzlite/build.sh $SRC/ diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh deleted file mode 100755 index 55918c8..0000000 --- a/.clusterfuzzlite/build.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -set -eu - -cd "$SRC/sqlite3mc-src" -# The base image's RUSTUP_TOOLCHAIN (nightly) is the one cargo fuzz needs. -cargo fuzz build -O --fuzz-dir fuzz - -targets=$(cargo fuzz list --fuzz-dir fuzz) -if [ -z "$targets" ]; then - echo "cargo fuzz list named no target" >&2 - exit 1 -fi - -target_dir=fuzz/target/x86_64-unknown-linux-gnu/release -for name in $targets; do - cp "$target_dir/$name" "$OUT/" -done - -# cifuzz unpacks _seed_corpus.zip before fuzzing. Only the real targets have one; -# fuzz/corpus/findings holds panicking draws nothing replays, not a seed corpus to ship. -for name in $targets; do - dir="fuzz/corpus/$name" - [ -d "$dir" ] && zip -j -q "$OUT/${name}_seed_corpus.zip" "$dir"/* -done diff --git a/.clusterfuzzlite/project.yaml b/.clusterfuzzlite/project.yaml deleted file mode 100644 index efa08f3..0000000 --- a/.clusterfuzzlite/project.yaml +++ /dev/null @@ -1,3 +0,0 @@ -language: rust -sanitizers: - - address diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml deleted file mode 100644 index 16454d5..0000000 --- a/.github/codeql/codeql-config.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -name: sqlite3mc-src CodeQL configuration - -queries: - - uses: security-extended - -# The vendored amalgamation is upstream C, analysed by its own project. -paths-ignore: - - sqlite3mc diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml deleted file mode 100644 index ba856ff..0000000 --- a/.github/workflows/cflite_batch.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: ClusterFuzzLite batch fuzzing - -"on": - schedule: - - cron: "0 6 * * *" - workflow_dispatch: - -permissions: read-all - -concurrency: - group: ${{ github.workflow }} - cancel-in-progress: false - -jobs: - batch: - name: Fuzz main for an hour - runs-on: ubuntu-latest - # The corpus lives on the clusterfuzzlite branch of this repository. - permissions: - contents: write - steps: - - name: Build fuzzers - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - language: rust - sanitizer: address - - name: Run fuzzers - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - fuzz-seconds: 3600 - mode: batch - sanitizer: address - storage-repo: ${{ github.server_url }}/${{ github.repository }}.git - storage-repo-branch: clusterfuzzlite diff --git a/.github/workflows/cflite_build.yml b/.github/workflows/cflite_build.yml deleted file mode 100644 index 5766a89..0000000 --- a/.github/workflows/cflite_build.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: ClusterFuzzLite continuous builds - -"on": - push: - branches: [main] - -permissions: read-all - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - build: - name: Build fuzzers for later crash triage - runs-on: ubuntu-latest - steps: - - name: Build fuzzers - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - language: rust - sanitizer: address - upload-build: true diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml deleted file mode 100644 index ea9fbc3..0000000 --- a/.github/workflows/cflite_pr.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: ClusterFuzzLite PR fuzzing - -"on": - pull_request: - -permissions: read-all - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - pr: - name: Fuzz the change for 10 minutes - runs-on: ubuntu-latest - steps: - - name: Build fuzzers - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - language: rust - github-token: ${{ secrets.GITHUB_TOKEN }} - sanitizer: address - - name: Run fuzzers - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - fuzz-seconds: 600 - mode: code-change - sanitizer: address diff --git a/.github/workflows/cflite_prune.yml b/.github/workflows/cflite_prune.yml deleted file mode 100644 index bc2d2ad..0000000 --- a/.github/workflows/cflite_prune.yml +++ /dev/null @@ -1,32 +0,0 @@ -name: ClusterFuzzLite corpus pruning - -"on": - schedule: - # An hour before batch fuzzing, so it starts from the pruned corpus. - - cron: "0 5 * * *" - -permissions: read-all - -concurrency: - group: ${{ github.workflow }} - cancel-in-progress: false - -jobs: - prune: - name: Prune the stored corpus - runs-on: ubuntu-latest - permissions: - contents: write - steps: - - name: Build fuzzers - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - language: rust - - name: Run fuzzers - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - fuzz-seconds: 600 - mode: prune - storage-repo: ${{ github.server_url }}/${{ github.repository }}.git - storage-repo-branch: clusterfuzzlite diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 214cffd..d78f0b9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -82,7 +82,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - run: shellcheck -x upgrade.sh bump.sh sigstore.sh interop.sh suite/run.sh .clusterfuzzlite/build.sh + - run: shellcheck -x upgrade.sh bump.sh sigstore.sh interop.sh suite/run.sh - name: actionlint run: | bash <(curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/914e7df21a07ef503a81201c76d2b11c789d3fca/scripts/download-actionlint.bash) 1.7.12 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 094e6e6..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,50 +0,0 @@ ---- -name: CodeQL - -"on": - pull_request: - push: - branches: - - main - schedule: - # Keeps the default branch scanned when no push arrives for a while. - - cron: "23 4 * * 1" - -permissions: - contents: read - -# Each main run gets a group of its own, since GitHub drops a pending run of a group when a newer one queues. -concurrency: - group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }} - cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} - -jobs: - analyze: - name: Analyze (${{ matrix.language }}) - runs-on: ubuntu-latest - timeout-minutes: 60 - permissions: - security-events: write - strategy: - fail-fast: false - matrix: - include: - - language: actions - - language: rust - build-mode: none - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Initialize CodeQL - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - languages: ${{ matrix.language }} - config-file: ./.github/codeql/codeql-config.yml - build-mode: ${{ matrix.build-mode }} - - - name: Analyze - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - with: - category: /language:${{ matrix.language }} diff --git a/.github/workflows/sqlite3mc-release.yml b/.github/workflows/sqlite3mc-release.yml index a4ae0dd..9bb503c 100644 --- a/.github/workflows/sqlite3mc-release.yml +++ b/.github/workflows/sqlite3mc-release.yml @@ -75,7 +75,7 @@ jobs: TARGET: ${{ steps.release.outputs.target }} run: ./bump.sh "$TARGET" - # A pull request from the app, unlike one from the workflow token, starts CI, CodeQL + # A pull request from the app, unlike one from the workflow token, starts CI # and Coverage on it, and so does every later push to its branch. - if: steps.release.outputs.moved == 'yes' name: Mint an app token diff --git a/README.md b/README.md index 8031413..62c4993 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,6 @@ # sqlite3mc-src [![CI](https://github.com/LucaCappelletti94/sqlite3mc-src/actions/workflows/ci.yml/badge.svg)](https://github.com/LucaCappelletti94/sqlite3mc-src/actions/workflows/ci.yml) -[![ClusterFuzzLite](https://github.com/LucaCappelletti94/sqlite3mc-src/actions/workflows/cflite_build.yml/badge.svg)](https://github.com/LucaCappelletti94/sqlite3mc-src/actions/workflows/cflite_build.yml) [![Coverage](https://codecov.io/gh/LucaCappelletti94/sqlite3mc-src/graph/badge.svg)](https://codecov.io/gh/LucaCappelletti94/sqlite3mc-src) [![crates.io](https://img.shields.io/crates/v/sqlite3mc-src.svg)](https://crates.io/crates/sqlite3mc-src) [![docs.rs](https://docs.rs/sqlite3mc-src/badge.svg)](https://docs.rs/sqlite3mc-src) @@ -21,4 +20,4 @@ SQLite3MC is MIT licensed. The amalgamation also carries public-domain code (SQL A daily workflow in the [repository](https://github.com/LucaCappelletti94/sqlite3mc-src) opens a pull request for each new SQLite3MC release, taking the archive's checksum only from the release's Sigstore-signed `SHA256SUMS`. CI re-runs `upgrade.sh`, which checks that signature again before trusting the pinned checksum, to prove the vendored bytes match the pinned release. It also compiles the packaged sources natively and through `sqlite-wasm-rs`, and checks that each build opens the other's files in every cipher, under Node and in headless Chrome and Firefox, on OPFS too. -CI also runs SQLite3MC's own tests, a rekey of every cipher and SQLite's TCL suite through the shipped amalgamation, once plainly and once under the address and undefined-behaviour sanitizers, with every expected failure named and explained. Five fuzz targets in `fuzz/` run on every pull request and daily through `ClusterFuzzLite`: a self-consistency check across the six native cipher schemes, and dedicated targets for rekeying, `journal_mode=WAL`, `ATTACH DATABASE` and the `sqlite3_backup_*` API. Shared-cache mode is left out, since SQLite discourages it and SQLite3MC supports it only as legacy ([#290](https://github.com/utelle/SQLite3MultipleCiphers/issues/290)). +CI also runs SQLite3MC's own tests, a rekey of every cipher and SQLite's TCL suite through the shipped amalgamation, once plainly and once under the address and undefined-behaviour sanitizers, with every expected failure named and explained. `fuzz/` holds five fuzz targets: a self-consistency check across the six native cipher schemes, and dedicated targets for rekeying, `journal_mode=WAL`, `ATTACH DATABASE` and the `sqlite3_backup_*` API. Shared-cache mode is left out, since SQLite discourages it and SQLite3MC supports it only as legacy ([#290](https://github.com/utelle/SQLite3MultipleCiphers/issues/290)).