Merge branch 'main' into dependabot/github_actions/crate-ci/typos-1.30.0

Signed-off-by: Simon Davies <[email protected]>

Author: simongdavies

.devcontainer/devcontainer.json

@@ -17,8 +17,9 @@
       "--device=/dev/kvm"
   ],
 
-  // Use 'postCreateCommand' to run commands after the container is created
-  "postCreateCommand": "bash .devcontainer/setup.sh",
+  // use `postStartCommand` for additional setup commands
+  // this is run after the container is created and the user has been added
+  "postStartCommand": "bash .devcontainer/setup.sh",
 
   "customizations": {
     "vscode": {

.github/workflows/Benchmarks.yml

@@ -28,7 +28,7 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
         env:

.github/workflows/CargoPublish.yml

@@ -32,7 +32,7 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
 

.github/workflows/CreateRelease.yml

@@ -21,7 +21,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
         env:
@@ -41,7 +41,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
         env:
@@ -57,12 +57,6 @@ jobs:
     uses: ./.github/workflows/dep_build_guest_binaries.yml
     secrets: inherit
 
-  fuzzing:
-    uses: ./.github/workflows/dep_fuzzing.yml
-    with:
-      max_total_time: 3600 # 1 hour in seconds
-    secrets: inherit
-
   benchmarks:
     needs: [build-guest-binaries]
     uses: ./.github/workflows/Benchmarks.yml
@@ -109,7 +103,7 @@ jobs:
           fetch-depth: 0
           fetch-tags: true
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
         env:

.github/workflows/Fuzzing.yml

@@ -10,9 +10,9 @@ permissions:
   contents: read
 
 jobs:
-
   fuzzing:
     uses: ./.github/workflows/dep_fuzzing.yml
     with:
+      targets: '["fuzz_host_print", "fuzz_guest_call", "fuzz_host_call"]' # Pass as a JSON array
       max_total_time: 18000 # 5 hours in seconds
     secrets: inherit

.github/workflows/ValidatePullRequest.yml

@@ -54,6 +54,7 @@ jobs:
       - docs-pr
     uses: ./.github/workflows/dep_fuzzing.yml
     with:
+      targets: '["fuzz_host_print", "fuzz_guest_call", "fuzz_host_call"]' # Pass as a JSON array
       max_total_time: 300 # 5 minutes in seconds
       docs_only: ${{needs.docs-pr.outputs.docs-only}}
     secrets: inherit
@@ -65,3 +66,23 @@ jobs:
     - uses: actions/checkout@v4
     - name: Spell Check Repo
       uses: crate-ci/[email protected]
+
+  # Gate PR merges on this specific "join-job" which requires all other
+  # jobs to run first. We need this job since we cannot gate on particular jobs
+  # in the workflow, since they can sometimes be skipped (e.g. if the PR only touches docs).
+  # This step fixes this issue by always running.
+  report-ci-status:
+    needs:
+      - docs-pr
+      - rust
+      - fuzzing
+      - spelling
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+    - name: Previous jobs succeeded
+      if: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
+      run: exit 0
+    - name: Previous jobs failed
+      if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+      run: exit 1

.github/workflows/dep_build_guest_binaries.yml

@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
         env:

.github/workflows/dep_fuzzing.yml

@@ -7,6 +7,10 @@ on:
         description: Maximum total time for the fuzz run in seconds
         required: true
         type: number
+      targets:
+        description: Fuzz targets to run
+        required: true
+        type: string
       docs_only:
         description: Skip fuzzing if docs only
         required: false
@@ -21,11 +25,14 @@ jobs:
   fuzz:
     if: ${{ inputs.docs_only == 'false' }}
     runs-on: [ self-hosted, Linux, X64, "1ES.Pool=hld-kvm-amd" ]
+    strategy:
+      matrix:
+        target: ${{ fromJson(inputs.targets) }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0"
         env:
@@ -44,12 +51,12 @@ jobs:
         run: cargo install cargo-fuzz
 
       - name: Run Fuzzing
-        run: cargo +nightly fuzz run --release fuzz_target_1 -- -max_total_time=300
+        run: just fuzz-timed ${{ matrix.target }} ${{ inputs.max_total_time }}
         working-directory: src/hyperlight_host
 
       - name: Upload Crash Artifacts
         if: failure() # This ensures artifacts are only uploaded on failure
         uses: actions/upload-artifact@v4
         with:
           name: fuzz-crash-artifacts
-          path: src/hyperlight_host/fuzz/artifacts/
+          path: fuzz/artifacts/

.github/workflows/dep_rust.yml

@@ -54,7 +54,7 @@ jobs:
         with:
           components: rustfmt
 
-      - uses: hyperlight-dev/ci-setup-workflow@v1.2.0
+      - uses: hyperlight-dev/ci-setup-workflow@v1.3.0
         with:
           rust-toolchain: "1.81.0" 
         env: