name: Fuzzing Tests

on:
  schedule:
    - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
  workflow_dispatch:  # Allow manual triggering
  pull_request:
    paths:
      - 'tests/fuzz/**'
      - 'src/local_deep_research/security/**'
      - 'src/local_deep_research/utilities/**'

# No concurrency group — intentionally omitted.
# Previous attempt (#3554, reverted #3599) used cancel-in-progress which
# killed in-progress PR runs before they produced useful results.
# Future iteration could safely add concurrency for scheduled/push-only
# triggers (where head_ref is empty and runs get unique groups).

permissions: {}

jobs:
  fuzz-tests:
    name: Hypothesis Fuzz Tests
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.12'

      - name: Cache PDM dependencies
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/pdm
            .venv
          key: pdm-${{ runner.os }}-${{ hashFiles('pdm.lock') }}
          restore-keys: |
            pdm-${{ runner.os }}-

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip==25.0
          pip install pdm==2.26.2
          # Retry pdm install up to 3 times with backoff
          for i in 1 2 3; do
            pdm install --dev --no-editable && break
            echo "Attempt $i failed, retrying in $((i * 10)) seconds..."
            sleep $((i * 10))
          done || exit 1

      - name: Run fuzz tests
        run: |
          pdm run pytest tests/fuzz/ -v --tb=short \
            --hypothesis-show-statistics \
            --hypothesis-seed=0
        env:
          HYPOTHESIS_PROFILE: ci

      - name: Run extended fuzz tests (scheduled only)
        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
        run: |
          # Run with more examples for scheduled/manual runs
          pdm run pytest tests/fuzz/ -v --tb=short \
            --hypothesis-show-statistics \
            -x  # Stop on first failure for investigation
        env:
          HYPOTHESIS_PROFILE: extended