vortex-data · robert3005 · Sep 3, 2026
diff --git a/.github/workflows/build-fuzzers.yml b/.github/workflows/build-fuzzers.yml
@@ -0,0 +1,85 @@
+name: Build CPU Fuzzers
+
+on:
+  workflow_call:
+    inputs:
+      runner:
+        description: "Runner name from .github-private runs-on.yml"
+        required: false
+        type: string
+        default: "arm64-medium"
+    outputs:
+      artifact_name:
+        description: "Artifact containing the compiled CPU fuzzers"
+        value: ${{ jobs.build.outputs.artifact_name }}
+
+env:
+  NIGHTLY_TOOLCHAIN: nightly-2026-02-05
+
+jobs:
+  build:
+    name: "Build CPU fuzzers"
+    timeout-minutes: 120
+    runs-on: >-
+      ${{ github.repository == 'vortex-data/vortex'
+          && format('runs-on={0}/runner={1}/disk=large/tag=fuzz-build', github.run_id, inputs.runner)
+          || 'ubuntu-latest' }}
+    outputs:
+      artifact_name: ${{ steps.artifact.outputs.name }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+
+      - uses: ./.github/actions/setup-prebuild
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          toolchain: ${{ env.NIGHTLY_TOOLCHAIN }}
+          components: ""
+          enable-sccache: "false"
+
+      - name: Install cargo-fuzz
+        uses: taiki-e/cache-cargo-install-action@66c9585ef5ca780ee69399975a5e911f47905995
+        with:
+          tool: cargo-fuzz
+
+      - name: Build fuzzers
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p fuzz-binaries
+
+          cargo +$NIGHTLY_TOOLCHAIN fuzz build --release --debug-assertions
+
+          copy_fuzzer() {
+            local target=$1
+            local output_name=${2:-$target}
+            local binary
+            binary=$(find target -type f -path "*/release/$target" -perm -u+x -print -quit)
+            if [ -z "$binary" ]; then
+              echo "::error::Unable to find compiled fuzzer $target"
+              exit 1
+            fi
+            install -m 755 "$binary" "fuzz-binaries/$output_name"
+          }
+
+          for target in array_ops compress_roundtrip file_io fsst_like row_encode; do
+            copy_fuzzer "$target"
+          done
+
+          cargo +$NIGHTLY_TOOLCHAIN fuzz build --release --debug-assertions \
+            --features vortex/unstable_encodings array_ops
+          copy_fuzzer array_ops array_ops_unstable_encodings
+
+          tar -acf cpu-fuzzers.tar.zst fuzz-binaries
+
+      - name: Set artifact name
+        id: artifact
+        shell: bash
+        run: echo "name=cpu-fuzzers-${{ github.run_id }}-${{ github.run_attempt }}" >> "$GITHUB_OUTPUT"
+
+      - name: Upload fuzzers
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        with:
+          name: ${{ steps.artifact.outputs.name }}
+          path: cpu-fuzzers.tar.zst
+          compression-level: 0
+          retention-days: 2
diff --git a/.github/workflows/fuzz-regression.yml b/.github/workflows/fuzz-regression.yml
@@ -0,0 +1,46 @@
+name: Validate Fuzz Seeds
+
+concurrency:
+  group: fuzz-regression
+  cancel-in-progress: true
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - ".cargo/**"
+      - "**/*.c"
+      - "**/*.cpp"
+      - "**/*.cu"
+      - "**/*.cuh"
+      - "**/*.h"
+      - "**/*.hpp"
+      - "**/*.proto"
+      - "**/*.rs"
+      - "**/Cargo.toml"
+      - "Cargo.lock"
+      - "rust-toolchain.toml"
+      - "fuzz/**"
+      - ".github/actions/setup-prebuild/**"
+      - ".github/actions/setup-rust/**"
+      - ".github/workflows/build-fuzzers.yml"
+      - ".github/workflows/fuzz-regression.yml"
+      - ".github/workflows/validate-fuzz-corpora.yml"
+      - "scripts/s3-download.py"
+  workflow_dispatch: { }
+
+jobs:
+  build_cpu_fuzzers:
+    name: "Build CPU fuzzers"
+    uses: ./.github/workflows/build-fuzzers.yml
+
+  validate_existing_seeds:
+    name: "Validate existing seeds"
+    needs: build_cpu_fuzzers
+    uses: ./.github/workflows/validate-fuzz-corpora.yml
+    with:
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
+    secrets:
+      R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
+      R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
@@ -1,27 +1,31 @@
 name: Fuzz
 
 concurrency:
-  # The group causes runs to queue instead of running in parallel.
+  # Exploration and minimization update the same corpus objects.
   group: fuzz
-  # This ensures each run builds on the previous run's corpus discoveries rather than losing them to
-  # failed compare-and-swap uploads.
   cancel-in-progress: false
 
 on:
   schedule:
-    - cron: "0 */6 * * *"  # every 6 hours
+    - cron: "0 */3 * * *"  # every 3 hours
   workflow_dispatch: { }
 
 jobs:
+  build_cpu_fuzzers:
+    name: "Build CPU fuzzers"
+    uses: ./.github/workflows/build-fuzzers.yml
+
   # ============================================================================
   # IO Fuzzer
   # ============================================================================
   io_fuzz:
     name: "IO Fuzz"
+    needs: build_cpu_fuzzers
     uses: ./.github/workflows/run-fuzzer.yml
     with:
       fuzz_target: file_io
       jobs: 4
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
@@ -70,10 +74,12 @@ jobs:
   # ============================================================================
   ops_fuzz:
     name: "Array Operations Fuzz"
+    needs: build_cpu_fuzzers
     uses: ./.github/workflows/run-fuzzer.yml
     with:
       fuzz_target: array_ops
       jobs: 4
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
@@ -106,13 +112,15 @@ jobs:
   # ============================================================================
   ops_fuzz_unstable:
     name: "Array Operations Fuzz (unstable)"
+    needs: build_cpu_fuzzers
     uses: ./.github/workflows/run-fuzzer.yml
     with:
       fuzz_target: array_ops
       fuzz_name: array_ops_unstable_encodings
       extra_features: "vortex/unstable_encodings"
       extra_env: "VORTEX_EXPERIMENTAL_PATCHED_ARRAY=1"
       jobs: 4
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
@@ -146,10 +154,12 @@ jobs:
   # ============================================================================
   fsst_like_fuzz:
     name: "FSST LIKE Fuzz"
+    needs: build_cpu_fuzzers
     uses: ./.github/workflows/run-fuzzer.yml
     with:
       fuzz_target: fsst_like
       jobs: 4
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
@@ -182,10 +192,12 @@ jobs:
   # ============================================================================
   row_encode_fuzz:
     name: "Row Encoding Fuzz"
+    needs: build_cpu_fuzzers
     uses: ./.github/workflows/run-fuzzer.yml
     with:
       fuzz_target: row_encode
       jobs: 4
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
@@ -218,14 +230,39 @@ jobs:
   # ============================================================================
   compress_fuzz:
     name: "Compress Roundtrip Fuzz"
+    needs: build_cpu_fuzzers
     uses: ./.github/workflows/run-fuzzer.yml
     with:
       fuzz_target: compress_roundtrip
       jobs: 4
+      fuzzer_artifact: ${{ needs.build_cpu_fuzzers.outputs.artifact_name }}
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
 
+  report-compress-fuzz-failures:
+    name: "Report Compress Roundtrip Fuzz Failures"
+    needs: compress_fuzz
+    if: always() && needs.compress_fuzz.outputs.crashes_found == 'true'
+    permissions:
+      issues: write
+      contents: read
+      id-token: write
+      pull-requests: read
+    uses: ./.github/workflows/report-fuzz-crash.yml
+    with:
+      fuzz_target: compress_roundtrip
+      crash_file: ${{ needs.compress_fuzz.outputs.first_crash_name }}
+      artifact_url: ${{ needs.compress_fuzz.outputs.artifact_url }}
+      artifact_name: compress_roundtrip-crash-artifacts
+      logs_artifact_name: compress_roundtrip-logs
+      branch: ${{ github.ref_name }}
+      commit: ${{ github.sha }}
+    secrets:
+      claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+      gh_token: ${{ secrets.GITHUB_TOKEN }}
+      incident_io_alert_token: ${{ secrets.INCIDENT_IO_ALERT_TOKEN }}
+
   # ============================================================================
   # GPU Compress Fuzzer (CUDA)
   # ============================================================================

diff --git a/.github/workflows/minimize_fuzz_corpus.yml b/.github/workflows/minimize_fuzz_corpus.yml
@@ -34,6 +34,36 @@ jobs:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
       R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
 
+  ops_unstable_fuzz_minimize:
+    name: "Minimize Array Ops (unstable) Fuzz Corpus"
+    uses: ./.github/workflows/minimize_fuzz_corpus_workflow.yml
+    with:
+      fuzz_target: array_ops
+      fuzz_name: array_ops_unstable_encodings
+      extra_features: "vortex/unstable_encodings"
+      extra_env: "VORTEX_EXPERIMENTAL_PATCHED_ARRAY=1"
+    secrets:
+      R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
+      R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
+
+  fsst_like_fuzz_minimize:
+    name: "Minimize FSST LIKE Fuzz Corpus"
+    uses: ./.github/workflows/minimize_fuzz_corpus_workflow.yml
+    with:
+      fuzz_target: fsst_like
+    secrets:
+      R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
+      R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
+
+  row_encode_fuzz_minimize:
+    name: "Minimize Row Encoding Fuzz Corpus"
+    uses: ./.github/workflows/minimize_fuzz_corpus_workflow.yml
+    with:
+      fuzz_target: row_encode
+    secrets:
+      R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}
+      R2_FUZZ_SECRET_ACCESS_KEY: ${{ secrets.R2_FUZZ_SECRET_ACCESS_KEY }}
+
   # ============================================================================
   # Compress Roundtrip Fuzzer
   # ============================================================================
@@ -54,8 +84,6 @@ jobs:
     uses: ./.github/workflows/minimize_fuzz_corpus_workflow.yml
     with:
       fuzz_target: compress_gpu
-      family: "g4dn"
-      image: "ubuntu24-gpu-x64"
       extra_features: "cuda"
     secrets:
       R2_FUZZ_ACCESS_KEY_ID: ${{ secrets.R2_FUZZ_ACCESS_KEY_ID }}