Run a bounded fuzz smoke test in CI

Author: lovasoa

.github/workflows/ci.yml

@@ -102,6 +102,26 @@ jobs:
       - run: sudo apt-get update && sudo apt-get install -y unixodbc-dev
       - run: cargo package --locked --allow-dirty
 
+  fuzz_smoke:
+    needs: ci_selection
+    if: needs.ci_selection.outputs.full == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      FUZZ_TOOLCHAIN: nightly-2026-10-21
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/install-frontend-dependencies
+      - run: rustup toolchain install "$FUZZ_TOOLCHAIN" --profile minimal --component rust-src
+      - name: Set up cargo cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4
+        with:
+          shared-key: rust-sqlpage-fuzz
+          workspaces: fuzz -> target
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - run: cargo install cargo-fuzz --locked --version 0.13.2
+      - run: scripts/run-fuzz-smoke.sh
+
   test:
     runs-on: ubuntu-latest
     needs: compile_and_lint
@@ -473,6 +493,7 @@ jobs:
       - ci_selection
       - compile_and_lint
       - published_crate
+      - fuzz_smoke
       - test
       - windows_test
       - playwright

fuzz/Cargo.lock

@@ -32,3 +32,9 @@ PY
 The 16 KiB limit is a starting point for efficient mutation, not a parser limit.
 The harness also accepts larger inputs. The same cargo-fuzz target is used by
 OSS-Fuzz and by OSS Verify's static RISC-V adapter.
+
+For the bounded, deterministic smoke run used by CI:
+
+```sh
+scripts/run-fuzz-smoke.sh
+```

fuzz/README.md

@@ -28,6 +28,7 @@ if (full === "true") {
   for (const name of [
     "compile_and_lint",
     "published_crate",
+    "fuzz_smoke",
     "test",
     "windows_test",
     "playwright",

scripts/check-ci-results.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+corpus_dir="$(mktemp -d)"
+trap 'rm -rf "$corpus_dir"' EXIT
+
+python3 - "$corpus_dir" <<'PY'
+import sys
+from pathlib import Path
+
+corpus = Path(sys.argv[1])
+for index, source in enumerate(sorted(Path("tests/sql_test_files").rglob("*.sql"))):
+    for selector in range(16):
+        (corpus / f"{index}-{selector}").write_bytes(
+            bytes([selector]) + source.read_bytes()
+        )
+PY
+
+toolchain="${FUZZ_TOOLCHAIN:-nightly}"
+cargo "+${toolchain}" fuzz run --dev sql_file "$corpus_dir" -- \
+  -runs=4096 \
+  -seed=1 \
+  -max_len=16384 \
+  -timeout=5

scripts/run-fuzz-smoke.sh

@@ -8,6 +8,7 @@ const root = fileURLToPath(new URL("../../", import.meta.url));
 const coreJobs = [
   "compile_and_lint",
   "published_crate",
+  "fuzz_smoke",
   "test",
   "windows_test",
   "playwright",