[red-knot] Run py-fuzzer in CI to check for new panics (#17719)

.github/workflows/ci.yaml

@@ -636,6 +636,53 @@ jobs:
           name: ecosystem-result
           path: ecosystem-result
 
+  fuzz-redknot:
+    name: "Fuzz for new red-knot panics"
+    runs-on: depot-ubuntu-22.04-16
+    needs:
+      - cargo-test-linux
+      - determine_changes
+    # Only runs on pull requests, since that is the only we way we can find the base version for comparison.
+    if: ${{ !contains(github.event.pull_request.labels.*.name, 'no-test') && github.event_name == 'pull_request' && needs.determine_changes.outputs.red_knot == 'true' }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        name: Download new red-knot binary
+        id: redknot-new
+        with:
+          name: red_knot
+          path: target/debug
+      - uses: dawidd6/action-download-artifact@20319c5641d495c8a52e688b7dc5fada6c3a9fbc # v8
+        name: Download baseline red-knot binary
+        with:
+          name: red_knot
+          branch: ${{ github.event.pull_request.base.ref }}
+          workflow: "ci.yaml"
+          check_artifacts: true
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      - name: Fuzz
+        env:
+          FORCE_COLOR: 1
+          NEW_REDKNOT: ${{ steps.redknot-new.outputs.download-path }}
+        run: |
+          # Make executable, since artifact download doesn't preserve this
+          chmod +x "${PWD}/red_knot" "${NEW_REDKNOT}/red_knot"
+
+          (
+            uvx \
+            --python="${PYTHON_VERSION}" \
+            --from=./python/py-fuzzer \
+            fuzz \
+            --test-executable="${NEW_REDKNOT}/red_knot" \
+            --baseline-executable="${PWD}/red_knot" \
+            --only-new-bugs \
+            --bin=red_knot \
+            0-500
+          )
+
   cargo-shear:
     name: "cargo shear"
     runs-on: ubuntu-latest