Add fuzz testing with ClusterFuzzLite

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,4 @@
+FROM gcr.io/oss-fuzz-base/base-builder-rust
+COPY . $SRC/airlock
+COPY .clusterfuzzlite/build.sh $SRC/
+WORKDIR $SRC/airlock

.clusterfuzzlite/build.sh

@@ -0,0 +1,8 @@
+#!/bin/bash -eu
+cd $SRC/airlock
+cargo fuzz build -O --debug-assertions
+FUZZ_TARGET_OUTPUT_DIR=fuzz/target/x86_64-unknown-linux-gnu/release
+for f in fuzz/fuzz_targets/*.rs; do
+    FUZZ_TARGET_NAME=$(basename ${f%.*})
+    cp $FUZZ_TARGET_OUTPUT_DIR/$FUZZ_TARGET_NAME $OUT/
+done

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: rust

.github/workflows/cflite_batch.yml

@@ -0,0 +1,34 @@
+name: ClusterFuzzLite batch
+on:
+  schedule:
+    - cron: '0 3 * * *'
+
+permissions: read-all
+
+jobs:
+  batch:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address]
+    steps:
+      - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          sanitizer: ${{ matrix.sanitizer }}
+      - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 3600
+          mode: batch
+          sanitizer: ${{ matrix.sanitizer }}
+
+  prune:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+      - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 600
+          mode: prune

.github/workflows/ci.yml

@@ -52,4 +52,22 @@ jobs:
       - uses: github/codeql-action/init@603b797f8b14b413fe025cd935a91c16c4782713 # v3
         with:
           languages: actions
-      - uses: github/codeql-action/analyze@603b797f8b14b413fe025cd935a91c16c4782713 # v3
+      - uses: github/codeql-action/analyze@603b797f8b14b413fe025cd935a91c16c4782713 # v3
+
+  fuzz:
+    needs: [test, audit]
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-fuzz-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+      - uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 120
+          mode: code-change
+          sanitizer: address

fuzz/.gitignore

@@ -0,0 +1,3 @@
+corpus/
+artifacts/
+target/