[meziantou]

What

A coverage-guided fuzzer for all the analyzers and code fixers, plus a weekly workflow that opens a GitHub issue for each new defect.

• Harness (tests/Meziantou.Analyzer.Fuzz): SharpFuzz instruments only Meziantou.Analyzer.dll and Meziantou.Analyzer.CodeFixers.dll, and libFuzzer mutates C# code starting from the ~4,000 raw-string snippets of the tests (plus a C# token dictionary). Every input goes through all the analyzers, with the rules that are disabled by default turned on, then through every matching code fixer. Compilation uses the .NET + ASP.NET Core assemblies, a few test libraries, and the framework source generators.
• Defects reported:
  • analyzer exceptions (AD0001)
  • code fixer exceptions
  • code fixes that add compiler errors to code that compiled
  • code fixes that change nothing, which AGENTS.md forbids
  • process crashes, such as a stack overflow
  • hangs
• Campaign:
  • One libFuzzer worker per core.
  • Findings are saved without stopping libFuzzer.
  • On a crash or timeout, the campaign works out which analyzer or fixer is responsible by replaying the input with groups of them, disables it, and restarts the worker.
  • At the end it merges the corpus and has libFuzzer minimize each finding's input.
• Workflow (.github/workflows/fuzz.yml):
  • Runs every Sunday for 4 hours, or on demand with a custom duration and an option to skip issue creation.
  • Reuses the corpus of the previous run.
  • A separate report job, which has issues: write, opens at most 10 fuzzing issues per run.
  • Each issue holds the minimized input, the stack trace or the fixed code, and a repro command.
  • Findings are deduplicated by a signature stored in the issue body. An open issue, or one closed as not planned, is skipped; an issue closed as completed leads to a new regression issue.
• repro replays inputs on any OS, macOS included: dotnet run --project tests/Meziantou.Analyzer.Fuzz -c Release -- repro input.cs.
• close-issues.yml exempts the fuzzing label from the stale bot, and ci.yml now builds the harness, so it keeps compiling.

See tests/Meziantou.Analyzer.Fuzz/README.md for details.

Notes for reviewers

• "FuzzSharp": no fuzzing library has that name, so this uses SharpFuzz 2.3.0.
• libfuzzer-dotnet binary: the workflow downloads it from a pinned release (v2025.05.02.0904) and checks a SHA-256 that I computed myself, because the release publishes no digests.
• Testing: verified in Docker (mcr.microsoft.com/dotnet/sdk:10.0) with three planted bugs (an exception, a stack overflow, a hang). Each was found and attributed to the right analyzer, and minimization was checked on amd64. The workflow itself has not run on GitHub yet. A workflow_dispatch run with duration-minutes: 10 and report: false is a good first check.
• Minimization on Arm64: it only works on x64. libfuzzer-dotnet signals a crash with __builtin_trap(), which raises SIGTRAP on Arm64, and libFuzzer doesn't handle that signal.
• First run will report existing defects: replaying just the test snippets already gives about 30 distinct findings, mostly "code fix introduces CSxxxx" (e.g. MA0038 MakeMethodStaticFixer, MA0045/MA0042, MA0053). The 10-issues-per-run cap keeps that from becoming a flood.
• Real bug found: a 6-minute run found a stack overflow in MA0008 on cyclic structs. It is fixed separately on branch feature/youthful-jepsen-1bab00.
• Restore failure on main: the test projects currently fail to restore on main (NU1902/NU1903, System.Security.Cryptography.Pkcs 9.0.6). That is unrelated to this change.

[meziantou]

Add timezone (america/toronto)