Explore REST API fuzz testing for MPS and RPS using RESTler

[graikhel-intel]

Background

We have previously performed REST API fuzz testing on the MPS and RPS cloud components using Microsoft RESTler, by running the services locally and fuzzing their Swagger-defined APIs.

Next Steps

As a follow-up, we want to revisit this approach and align as a team on how (or if) we should continue fuzz testing for MPS and RPS.

This work is intentionally exploratory and discussion-driven:

• Should RESTler-based fuzz testing be integrated into GitHub Actions, or
• Given that MPS and RPS are being replaced by Console over time, should this remain a manual, on-demand task where someone runs the fuzzer and captures results?

After alignment, the task includes running RESTler fuzz tests based on the agreed approach and documenting findings.

Acceptance Criteria

• Team agreement on fuzz testing approach for MPS and RPS (CI vs manual)
• Decision and rationale documented
• RESTler fuzz testing executed using the chosen approach
• Results captured and shared

[shaoboon]

Updates:

• Recommend to at least automate and deploy into CI with on-demand trigger, rationale:
  • long hour test, best automate
  • there is still some time before console fully replacing MPS and RPS, even then, may still need some more time to slowly phase out MPS and RPS
  • fuzz test evidence can be downloaded easily from github fuzzing action run
• MPS and RPS RESTler fuzzing framework PR: https://github.com/device-management-toolkit/e2e-testing/pull/94
• MPS and RPS results captured and shared

Next step:

• discuss on CI deployment
• if yes, develop github workflow