mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-26 04:19:53 +08:00
romanettandClaude Opus 5.5
e0c56a7c00
# Description Since the move to GitHub Actions, CI replays only the checked-in fuzz corpus. The full crash corpus used to be the Azure DevOps secure file `FuzzingArtifacts.zip`, which `.azurepipelines/test.yml` overlaid onto `Opc.Ua.Encoders.Fuzz.Tests`. The nightly `private-corpus` job that was meant to replace it depended on an Azure storage account, federated credentials and a protected environment. None of these were ever provisioned, so the job never ran. **The corpus now lives on the orphan branch [`fuzz-corpus`](https://github.com/OPCFoundation/UA-.NETStandard/tree/fuzz-corpus)** (commit `843ba944a7b144a7ae6429151846d9e5ab28d29f`, already pushed): - It contains 22,267 `crash-*`, 25 `slow-unit-*` and 1 `timeout-*` input under `Opc.Ua.Encoders.Fuzz.Tests/Assets/`. - The files are byte-identical to the secure file (SHA-256 `85198e46…fe1d61b`), recovered from the `drop` artifact of Azure build 18397. - The branch shares no history with `master`, so clones of `master` don't get 22k extra files in their checkout. **Why the corpus is no longer treated as private:** - The inputs date from April–June 2024. - The `drop` artifacts could be downloaded anonymously. - Every master build printed up to about 7k base64 reproducers into anonymously readable Azure logs. - Current `master` replays every input without a test failure. New, unfixed crashes still go through [SECURITY.md](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/SECURITY.md) and are added to the branch only after the fix ships. ## Changes - **`nightly.yml`:** `private-corpus` is replaced by `crash-corpus`. The new job: - checks out the commit pinned in `FUZZ_CORPUS_COMMIT` (no secrets, environment or OIDC); - verifies the SHA and copies each top-level folder over `fuzzing/<folder>`; - runs `Opc.Ua.Encoders.Fuzz.Tests` on the 12 non-macOS profiles through the shared `run-dotnet-tests` action and uploads `crash-corpus-results-*`. The `run_private_corpus` input and the INCOMPLETE label are removed. The job runs on every scheduled and manual run, and the nightly summary fails if it was skipped. - **`fuzzing/CrashCorpus.md` (new):** the Azure history, branch layout, how CI replays the corpus, local replay, and how to add inputs and move the pin. `Fuzzing.md` links to it. - **`docs/DeveloperGuide.md`:** the private-corpus section and its secrets table are replaced, and the migration to-do list is updated. - **`nightly.yml` AOT job (fix for a failure found by the first nightly run):** the Linux and macOS legs looked up the published binary by `BaseName`/`Extension`. A NativeAOT executable has no extension on those platforms, so PowerShell splits `Opc.Ua.Aot.Tests` into `Opc.Ua.Aot` + `.Tests`, and every leg reported *No NativeAOT executable was produced* even though publish succeeded ([run 36017168717](https://github.com/OPCFoundation/UA-.NETStandard/actions/runs/36017168717), `aot-ubuntu-latest`). The lookup now matches the exact file name. A failure now reports the publish errors, a missing publish directory, or which files were produced instead. - **`Opc.Ua.Redundancy.Samples.Tests` / `Opc.Ua.WotCon.Samples.Tests` (fix for failures found by the first nightly run):** the test runner's framework guard rejected both projects on the nightly net8.0, net9.0, net472 and netstandard2.1 profiles. Redundancy built a net48 placeholder for every target except net10.0, and WotCon was pinned to net10.0. Both now build the requested target on net8.0/9.0/10.0 and use `RestrictForLegacyTfm` to become explicit not-applicable shells on net48, net472, netstandard2.0 and netstandard2.1. The redundancy tests no longer hard-code `bin/<cfg>/net10.0` when locating the sample binaries, and `SampleAppProcess` falls back to an `object` lock below net9.0. The net48 placeholder remains for Azure's plain `dotnet test -f net48` leg. Checked locally by building Redundancy for `CustomTestTarget=net9.0` and WotCon for `netstandard2.1`. - **`DefaultServerRedundancyHandler` (fix for a failure found by the first nightly run):** `ResolveServerAsync` gave the resolver a token linked to the caller's, but waited on the caller's token directly. On cancellation the wait could finish, and its `using` could dispose the linked source, before the linked source's own callback had run. That unhooks it, so the in-flight peer lookup never saw the cancellation (`PeerDiscoveryPropagatesCallerCancellationAsync`, netstandard2.0 build on net48). The wait now uses the linked token. A timeout is still logged as a discovery failure, as before. A companion test fix makes `PeerTimeoutPreservesOtherEndpointsAndCoalescesPendingDiscoveryAsync(False)` deterministic. The timed-out lookup drains on the thread pool, so the test's retry could join it and then have its own time limit expire before it started a fresh lookup. The test now waits for the second resolver call before advancing the fake clock. - **`Session` keep-alive logging (found while investigating the net48 nightly failures):** `OnKeepAliveError` and the keep-alive read failure log used `Endpoint?.EndpointUrl`. `ClientBase.Endpoint` dereferences the transport channel, so once the channel was detached it threw a `NullReferenceException` on every keep-alive tick, and `BadNoCommunication` never reached the `KeepAlive` subscribers. Both now log the configured endpoint's URL. Three new `SessionKeepAliveTests` cover a detached channel. - **`ClientTestFramework` shared session (fix for 67 `Opc.Ua.Sessions.Tests` failures on the net48 nightly):** the fixture-wide shared session used the 10 s default session timeout. A test-host stall of about 11–18 s while other fixtures restarted their servers let the server expire it, and every later test in the `ClientTest("https")` and `ClientTest("opc.https")` fixtures failed with `BadSessionIdInvalid`. The shared session now requests `SharedSessionTimeout` = 120 s; per-test sessions keep 10 s. - **`run-dotnet-tests.ps1`:** `-QuietOutput` help text only; it no longer names the removed job. The Azure secure file stays in place, because `master378` and the 1.x release pipelines keep their own `test.yml` and still use it. ## Verification - `nightly.yml` parses as valid YAML, and no job, output or summary field still refers to the removed job. - I ran the job's overlay script against a clone of `fuzz-corpus` at the pinned commit. It overlaid all 22,293 files, left the tracked `Assets/Repo` untouched, removed the checkout folder and wrote the summary line. - **Not yet run:** the workflow itself. It is `schedule`/`workflow_dispatch` only, so it needs a manual `nightly.yml` run on this branch. On master the corpus has so far only been replayed on Windows (net48/net10.0 in Azure), so the Linux legs are new ground. ## Follow-ups (admin) - Add a ruleset for `fuzz-corpus`: require pull requests and block force pushes and deletion, so the pinned commit stays reachable. - The `fuzz-private-corpus` environment, if it was ever created, can be deleted. ## Related Issues - No issue exists yet; this is part of the Azure DevOps → GitHub Actions migration (#4513, #4524). ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [ ] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [ ] I have addressed **all** PR feedback received. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>