.github/workflows/fuzz.yml

name: fuzz

on:
  push:
    paths:
      - tox.ini
      - .github/workflows/fuzz.yml
      - scripts/fuzz.py
      - src/**
      - tests/**
      - pyproject.toml

  pull_request:
    paths:
      - tox.ini
      - .github/workflows/fuzz.yml
      - scripts/fuzz.py
      - src/**
      - tests/**
      - pyproject.toml

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  fuzz:
    # We want to run on external PRs, but not on our own internal PRs as they'll be run
    # by the push to the branch. Without this if check, checks are duplicated since
    # internal PRs match both the push and pull_request events.
    if:
      github.event_name == 'push' || github.event.pull_request.head.repo.full_name !=
      github.repository

    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]

    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: ${{ matrix.python-version }}
          allow-prereleases: true
          pip-version: "25.3"
          pip-install: --group tox

      - name: Run fuzz tests
        run: tox -e fuzz