gh-143572: Run 'python3-libraries' fuzzer in CI using CIFuzz

[sethmlarson]

Created a list of files and directories that should trigger a re-run of the python3-libraries fuzzers. Now that the Python repository is the home for this fuzzer it should be easier for Python core developers to fix issues with the fuzzer in case there are issues.

• Issue: Begin running CIFuzz on standard library modules #143572

[hugovk]

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

[sethmlarson]

I think we could also rename most of the "library"/"libraries"/"LIBRARY" to "stdlib"/"STDLIB" and it'd be clearer this is running on the standard library and not any third-party library code.

I agree with this, we can change most of our uses to "stdlib" within this PR except for oss-fuzz-project-name. I can handle that in a separate PR since we'll have to wait for OSS-Fuzz maintainers to rename the project.

[sethmlarson]

Thanks @StanFromIreland and @hugovk for the reviews! I've moved to a reusable workflows approach. I'll try pushing a commit modifying one of the libraries to check that the workflow fires correctly.

[hugovk]

(I resolved the conflict)

[sethmlarson]

@webknjaz I'm not sure why actionlint is refusing the contains([...], 'true') syntax used, checking on the allowed function definitions it seemed like this would be allowed?

[sethmlarson]

With the latest commit we got a run, but the values of oss-fuzz-project-name and sanitizer aren't being forwarded (the reusable workflow is seeing an empty string?) from the job matrix into the reusable workflow. I don't think I'm doing anything different than any of the other reusable workflows that use a matrix and forward parameters?

[webknjaz]

@webknjaz I'm not sure why actionlint is refusing the contains([...], 'true') syntax used, checking on the allowed function definitions it seemed like this would be allowed?

Not sure. Might be a bug in actionlint. Or maybe I misunderstood that this'd work from the docs 🤷‍♂️

[webknjaz]

With the latest commit we got a run, but the values of oss-fuzz-project-name and sanitizer aren't being forwarded (the reusable workflow is seeing an empty string?) from the job matrix into the reusable workflow. I don't think I'm doing anything different than any of the other reusable workflows that use a matrix and forward parameters?

Sounds like maybe I messed up the suggested conditionals or something. I'll double-check the current diff.

[webknjaz]

One more thing — in general, it's a good idea to keep the CI infra the same (at least structurally) across branches since this will reduce conflicts when backporting more important changes. So this will need to be backported if possible. Either partially or, if there's no problems — in full. The backwards compat considerations would almost never apply to the CI infra the same way it'd apply to the user-facing changes.

[hugovk]

Thanks!

[hugovk]

A brief note on CI time. These three jobs take about 22 minutes, which is fine:

• CIFuzz / python3-libraries (undefined) 22m 36s
• CIFuzz / python3-libraries (address) 20m 38s
• CIFuzz / python3-libraries (memory) 22m 14s

https://github.com/python/cpython/actions/runs/21006197138/usage

We have a few other jobs taking around this long, like Android and iOS and some Windows ones, with one free-threaded Windows being the bottleneck at 32 mins.

Just something to keep an eye on.

[hugovk]

Thanks all!

[miss-islington-app]

Thanks @sethmlarson for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

[miss-islington-app]

Sorry, @sethmlarson and @hugovk, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker edeebe22cb6bff3df4196bef3dcbdc7044f54df6 3.14 

[miss-islington-app]

Sorry, @sethmlarson and @hugovk, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker edeebe22cb6bff3df4196bef3dcbdc7044f54df6 3.13 

[sethmlarson]

@hugovk I can work on creating backports. Thanks for the reviews, everyone!

[bedevere-app]

GH-143912 is a backport of this pull request to the 3.14 branch.

[bedevere-app]

GH-143915 is a backport of this pull request to the 3.13 branch.

[webknjaz]

Reflecting on this a bit, I think we could've interpolated one of the factors to produce separate categories.

- name: CIFuzz${{'' }} # zizmor: ignore[obfuscation]+ name: CIFuzz (${{matrix.oss-fuzz-project-name }})

We can still do this in follow-ups if you @sethmlarson think it's a good idea.