ci: balance runner pools across vendors and persist fuzz corpus

[simongdavies]

Runner pools

Vendor-agnostic jobs select AMD or Intel pools by run-ID parity, following copilot-setup-steps.yml. Other runner labels and JobId values are preserved. Coverage keeps one job. Explicit vendor matrices, benchmark pools and arm64 runner labels are unchanged.

Fuzzing

• Corpus restore, minimisation and save are opt-in through persist_corpus. Only the weekly workflow enables them, including its manual runs.
• Per-target caches reuse earlier inputs. cargo fuzz cmin reduces redundant inputs with a 20-minute limit. Trace targets use matching trace guests. Saving after failure or cancellation is best-effort, and minimisation does not enforce a storage cap.
• Callers supply timeout_minutes: 330 for weekly runs, 25 for PRs and 35 for daily arm64 runs.
• Failure notifications include timed-out dependencies. !cancelled() suppresses notifications for deliberate workflow cancellation.

[Copilot]

🟡 Changes recommended

Fuzz timeout, cancellation notification, architecture-specific caching, and cache retention issues remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR balances CI runner pools across AMD and Intel vendors and adds persistent, minimized fuzzing corpora with timeout and cancellation handling.

Changes:

• Selects runner pools by run-ID parity.
• Adds fuzz corpus caching and minimization.
• Adds explicit fuzz timeouts and cancellation notifications.

File summaries

File	Description
Justfile	Adds corpus minimization recipes.
.github/workflows/PrimeCaches.yml	Balances cache jobs across vendors.
.github/workflows/Fuzzing.yml	Handles cancelled fuzz jobs.
.github/workflows/dep_update_guest_locks.yml	Balances lock-update runners.
.github/workflows/dep_fuzzing.yml	Adds timeout, corpus caching, and minimization.
.github/workflows/dep_code_checks.yml	Balances Linux and Windows checks.
.github/workflows/dep_build_guests.yml	Balances guest-build runners.
.github/workflows/CreateRelease.yml	Balances release runners.
.github/workflows/Coverage.yml	Selects coverage CPU vendor by run ID.
.github/workflows/CargoPublish.yml	Balances publishing runners.

Review details

Suppressed comments (3)

.github/workflows/dep_fuzzing.yml:31

• This reusable workflow is also called by DailyArm64.yml, so this timeout applies to the arm64 fuzz jobs. That workflow's notifier still checks only needs.fuzzing.result == 'failure'; a timeout reports cancelled, so an arm64 timeout will silently skip the release-blocking notification. Update that caller's condition to handle dependency cancellation while excluding a human-cancelled run.

    timeout-minutes: ${{ inputs.max_total_time / 60 + 30 }}

.github/workflows/dep_fuzzing.yml:73

• The corpus cache is keyed only by target, but this reusable workflow runs the same targets on both X64 and arm64. The prefix restore can therefore feed an architecture-specific minimized corpus to the other architecture, and each architecture's cmin pass can discard inputs that are only useful on the other one. Include inputs.arch in both the save key and restore prefix.

          key: fuzz-corpus-${{ inputs.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            fuzz-corpus-${{ inputs.target }}-

.github/workflows/dep_fuzzing.yml:73

• Including github.run_id makes every run create a new immutable cache entry. cmin bounds each snapshot but does not remove prior weekly or pull-request snapshots, so the six targets can still consume the 10 GB cache budget over time and evict the Rust caches this PR is intended to protect. Use a bounded retention or deletion strategy, or storage that updates one corpus per target.

          key: fuzz-corpus-${{ inputs.target }}-${{ github.run_id }}-${{ github.run_attempt }}
          restore-keys: |
            fuzz-corpus-${{ inputs.target }}-

• Files reviewed: 10/10 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.