ci: update cargo fuzz command to use nightly toolchain explicitly (#9298)

* ci: update cargo fuzz command to use nightly toolchain explicitly

* ci: honor RUSTUP_TOOLCHAIN pin in fuzz orchestration script

An explicit `+toolchain` argument overrides the RUSTUP_TOOLCHAIN env var
in rustup precedence, so the hard-coded `cargo +nightly` in
run-fuzz-targets.sh bypassed the pinned FUZZ_RUST_TOOLCHAIN
(nightly-2026-03-21) configured in the workflow.

- Invoke `cargo +"${RUSTUP_TOOLCHAIN:-nightly}" fuzz run` in the script
  so CI uses the pinned toolchain and local runs fall back to the
  floating nightly
- Pass RUSTUP_TOOLCHAIN through to all four fuzz-test action invocations,
  covering the no-prebuilt-binaries path and making the reproduce command
  in the summary print the exact pinned toolchain
- Add test_rustup_toolchain_env_is_honored covering the pinned-env
  scenario for both the cargo invocation args and the summary text

Addresses #9298 (review).

Signed-off-by: Ning Sun <sunning@greptime.com>

---------

Signed-off-by: Ning Sun <sunning@greptime.com>

.github/scripts/run-fuzz-targets-test.sh

@@ -31,7 +31,7 @@ new_fixture() {
 #!/usr/bin/env bash
 set -euo pipefail
 printf '%s\t%s\t%s\n' "${GT_FUZZ_DUMP_DIR}" "$*" "${MOCK_CARGO_MARKER:-}" >>"${MOCK_CARGO_LOG}"
-target="$3"
+target="$4"
 case " ${MOCK_FAIL_TARGETS:-} " in
   *" ${target} "*) exit 17 ;;
 esac
@@ -117,6 +117,20 @@ EOF
   set -e
 }
 
+test_rustup_toolchain_env_is_honored() {
+  new_fixture
+  export RUSTUP_TOOLCHAIN=nightly-2026-03-21
+  run_fixture $'fuzz_create_table' true true "fuzz_create_table"
+  unset RUSTUP_TOOLCHAIN
+
+  assert_eq 1 "${fixture_status}" "pinned toolchain run status"
+  grep -q -- '+nightly-2026-03-21 fuzz run fuzz_create_table' "${fixture}/cargo.log" || \
+    fail "pinned toolchain missing from cargo invocation"
+  grep -q 'cargo +nightly-2026-03-21 fuzz run fuzz_create_table' "${fixture}/artifacts/summary.md" || \
+    fail "pinned toolchain missing from reproduce command"
+  cleanup_fixture
+}
+
 test_successful_targets_run_in_order() {
   new_fixture
   run_fixture $'fuzz_create_table\nfuzz_insert' false true ""
@@ -125,7 +139,7 @@ test_successful_targets_run_in_order() {
   assert_eq 2 "$(wc -l <"${fixture}/cargo.log" | tr -d ' ')" "cargo invocation count"
   assert_eq \
     $'fuzz_create_table\nfuzz_insert' \
-    "$(awk -F '\t' '{print $2}' "${fixture}/cargo.log" | sed -E 's/^fuzz run ([^ ]+).*/\1/')" \
+    "$(awk -F '\t' '{print $2}' "${fixture}/cargo.log" | sed -E 's/^\+nightly fuzz run ([^ ]+).*/\1/')" \
     "target order"
   grep -q -- '--features=unstable' "${fixture}/cargo.log" || fail "unstable feature missing"
   grep -q -- '-max_total_time=120' "${fixture}/cargo.log" || fail "fuzz time missing"
@@ -175,7 +189,7 @@ test_fail_fast_stops_after_first_failure() {
     fail "skipped target annotation missing"
   grep -q '### Reproduce failed targets' "${fixture}/artifacts/summary.md" || \
     fail "reproduction section missing"
-  grep -q 'cargo fuzz run fuzz_insert' "${fixture}/artifacts/summary.md" || \
+  grep -q 'cargo +nightly fuzz run fuzz_insert' "${fixture}/artifacts/summary.md" || \
     fail "reproduction command missing"
   cleanup_fixture
 }
@@ -367,5 +381,6 @@ test_collector_keeps_target_scopes_separate
 test_cluster_collector_honors_target_scope_and_namespace
 test_setup_failure_writes_artifact_contract
 test_setup_failure_keeps_manifest_when_collection_fails
+test_rustup_toolchain_env_is_honored
 
 printf 'All fuzz orchestration script tests passed.\n'

.github/scripts/run-fuzz-targets.sh

@@ -104,7 +104,7 @@ write_summary() {
             reproduce_args+=("GT_FUZZ_INSTANCE_ROOT_DIR=${GT_FUZZ_INSTANCE_ROOT_DIR}")
           fi
         fi
-        reproduce_args+=(cargo fuzz run "${target}" --fuzz-dir tests-fuzz -D -s none)
+        reproduce_args+=(cargo +"${RUSTUP_TOOLCHAIN:-nightly}" fuzz run "${target}" --fuzz-dir tests-fuzz -D -s none)
         if [[ "${fuzz_unstable}" == true ]]; then
           reproduce_args+=(--features=unstable)
         fi
@@ -195,7 +195,7 @@ for ((index = 0; index < ${#targets[@]}; index++)); do
     fi
     run_args=("${fuzz_binary}" "-max_total_time=${FUZZ_MAX_TOTAL_TIME}" "-artifact_prefix=${target_dir}/libfuzzer/")
   else
-    run_args=(cargo fuzz run "${target}" --fuzz-dir tests-fuzz -D -s none)
+    run_args=(cargo +"${RUSTUP_TOOLCHAIN:-nightly}" fuzz run "${target}" --fuzz-dir tests-fuzz -D -s none)
     if [[ "${fuzz_unstable}" == true ]]; then
       run_args+=(--features=unstable)
     fi

.github/workflows/integration.yml

@@ -31,6 +31,11 @@ name: Integration CI
 
 env:
   CARGO_FUZZ_VERSION: "0.13.2"
+  # Fuzz targets require a nightly toolchain (cargo-fuzz needs
+  # `-Zsanitizer=fuzzer`). This pin decouples the fuzz workflow from the
+  # workspace default in rust-toolchain.toml, so it keeps working when the
+  # workspace moves to a stable toolchain.
+  FUZZ_RUST_TOOLCHAIN: "nightly-2026-03-21"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -328,6 +333,7 @@ jobs:
       - uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           cache: false
+          toolchain: ${{ env.FUZZ_RUST_TOOLCHAIN }}
       - name: Fuzz Dependency Cache
         id: fuzz-dependencies-cache
         uses: Swatinem/rust-cache@v2
@@ -343,7 +349,7 @@ jobs:
         uses: actions/cache/restore@v4
         with:
           path: ${{ runner.temp }}/greptime-fuzz-binaries
-          key: v1-fuzz-binaries-${{ env.CARGO_FUZZ_VERSION }}-all-${{ hashFiles('Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo/**', 'tests-fuzz/**', 'src/**') }}
+          key: v1-fuzz-binaries-${{ env.CARGO_FUZZ_VERSION }}-${{ env.FUZZ_RUST_TOOLCHAIN }}-all-${{ hashFiles('Cargo.toml', 'Cargo.lock', '.cargo/**', 'tests-fuzz/**', 'src/**') }}
       - name: Report fuzz cache lookup
         shell: bash
         run: |
@@ -355,6 +361,8 @@ jobs:
       - name: Set Rust Fuzz
         if: steps.fuzz-binaries.outputs.cache-hit != 'true'
         shell: bash
+        env:
+          RUSTUP_TOOLCHAIN: ${{ env.FUZZ_RUST_TOOLCHAIN }}
         run: |
           sudo apt-get install -y libfuzzer-14-dev
           cargo install cargo-fuzz --version "${CARGO_FUZZ_VERSION}" --locked
@@ -363,6 +371,7 @@ jobs:
         shell: bash
         env:
           CUSTOM_LIBFUZZER_PATH: /usr/lib/llvm-14/lib/libFuzzer.a
+          RUSTUP_TOOLCHAIN: ${{ env.FUZZ_RUST_TOOLCHAIN }}
           FUZZ_TARGETS: |
             fuzz_create_database
             fuzz_create_table
@@ -410,7 +419,7 @@ jobs:
         uses: actions/cache/save@v4
         with:
           path: ${{ runner.temp }}/greptime-fuzz-binaries
-          key: v1-fuzz-binaries-${{ env.CARGO_FUZZ_VERSION }}-all-${{ hashFiles('Cargo.toml', 'Cargo.lock', 'rust-toolchain.toml', '.cargo/**', 'tests-fuzz/**', 'src/**') }}
+          key: v1-fuzz-binaries-${{ env.CARGO_FUZZ_VERSION }}-${{ env.FUZZ_RUST_TOOLCHAIN }}-all-${{ hashFiles('Cargo.toml', 'Cargo.lock', '.cargo/**', 'tests-fuzz/**', 'src/**') }}
       - name: Pack prebuilt fuzz binaries
         shell: bash
         run: |
@@ -479,6 +488,7 @@ jobs:
       - name: Fuzz Test
         uses: ./.github/actions/fuzz-test
         env:
+          RUSTUP_TOOLCHAIN: ${{ env.FUZZ_RUST_TOOLCHAIN }}
           GT_MYSQL_ADDR: 127.0.0.1:4002
           FUZZ_SERVICE_LOG: /tmp/greptime-fuzz-runtime/greptime.log
         with:
@@ -537,6 +547,7 @@ jobs:
       - name: Run Fuzz Test
         uses: ./.github/actions/fuzz-test
         env:
+          RUSTUP_TOOLCHAIN: ${{ env.FUZZ_RUST_TOOLCHAIN }}
           GT_MYSQL_ADDR: 127.0.0.1:4002
           GT_FUZZ_BINARY_PATH: ./bin/greptime
           GT_FUZZ_INSTANCE_ROOT_DIR: /tmp/greptime-fuzz-artifacts/targets/unstable_fuzz_create_table_standalone/service/instance/
@@ -820,6 +831,7 @@ jobs:
       - name: Fuzz Test
         uses: ./.github/actions/fuzz-test
         env:
+          RUSTUP_TOOLCHAIN: ${{ env.FUZZ_RUST_TOOLCHAIN }}
           GT_MYSQL_ADDR: 127.0.0.1:4002
           GT_KAFKA_WAL_HELPER_URL: http://127.0.0.1:8080
           GT_KAFKA_ADDR: kafka.kafka-cluster.svc.cluster.local:9092
@@ -994,6 +1006,7 @@ jobs:
       - name: Fuzz Test
         uses: ./.github/actions/fuzz-test
         env:
+          RUSTUP_TOOLCHAIN: ${{ env.FUZZ_RUST_TOOLCHAIN }}
           GT_MYSQL_ADDR: 127.0.0.1:4002
         with:
           targets: ${{ matrix.group.targets }}

Makefile

@@ -212,12 +212,12 @@ sqlness-test: ## Run sqlness test.
 RUNS ?= 1
 FUZZ_TARGET ?= fuzz_alter_table
 .PHONY: fuzz
-fuzz: ## Run fuzz test ${FUZZ_TARGET}.
-	cargo fuzz run ${FUZZ_TARGET} --fuzz-dir tests-fuzz -D -s none -- -runs=${RUNS}
+fuzz: ## Run fuzz test ${FUZZ_TARGET} (requires a nightly toolchain).
+	cargo +nightly fuzz run ${FUZZ_TARGET} --fuzz-dir tests-fuzz -D -s none -- -runs=${RUNS}
 
 .PHONY: fuzz-ls
-fuzz-ls: ## List all fuzz targets.
-	cargo fuzz list --fuzz-dir tests-fuzz
+fuzz-ls: ## List all fuzz targets (requires a nightly toolchain).
+	cargo +nightly fuzz list --fuzz-dir tests-fuzz
 
 .PHONY: check
 check: ## Cargo check all the targets.

tests-fuzz/README.md

@@ -6,6 +6,12 @@
 cargo install cargo-fuzz
 ```
 
+Note: `cargo-fuzz` instruments targets with `-Zsanitizer=fuzzer`, so fuzz
+targets must be built with a **nightly** toolchain (the workspace default
+toolchain does not need to be nightly — `make fuzz` / `make fuzz-ls`
+invoke `cargo +nightly` for you; CI pins its own nightly in
+`FUZZ_RUST_TOOLCHAIN`).
+
 2. Start GreptimeDB
 3. Copy the `.env.example`, which is at project root, to `.env` and change the values on need.