From e260c45628ca89376d8b840be3e5e3e5ed2df804 Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Fri, 17 Jul 2026 13:21:35 +0400
Subject: [PATCH 1/9] Create Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 149 ++++++++++++++++++++++
 1 file changed, 149 insertions(+)
 create mode 100644 templates/Build_Fuzz_Images.gitlab-ci.yml

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
new file mode 100644
index 0000000..4c6c087
--- /dev/null
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -0,0 +1,149 @@
+# Fuzz image builds (*-fuzz). Separate from the regular module `.build`.
+#
+# Mirrors deckhouse `build_fuzz_template` (dev / main):
+#   - FUZZ_S3_* are always required: werf passes them into the image as secrets
+#     for in-image corpus sync / replay (see fuzz.tmpl).
+#   - Corpus path: s3://anomaloys-materials/<repository>/<branch slug>/...
+#   - build_fuzz_dev:  local build only, FUZZ_S3_BRANCH_SLUG=main
+#                      (no registry push, no build-report upload)
+#   - build_fuzz_main: push to registry + upload images_fuzz_tags_werf.json
+#
+# Required CI/CD variables:
+#   FUZZ_S3_ENDPOINT
+#   FUZZ_S3_ACCESS_KEY
+#   FUZZ_S3_SECRET_KEY
+#
+# Auth / werf ci-env / base_images come from Setup `before_script` (same as `.build`).
+# Registry variables (MODULES_MODULE_SOURCE, etc.) must be provided by the consumer
+# via a mixin (e.g. `.dev-variables` / `.dev`).
+
+.build_fuzz:
+  stage: build
+  variables:
+    WERF_FINAL_IMAGES_ONLY: "false"
+
+.build_fuzz_dev:
+  extends:
+    - .build_fuzz
+  script:
+    - |
+      SOURCE_REPO=${SOURCE_REPO#git@}
+      SOURCE_REPO=${SOURCE_REPO//://}
+      export SOURCE_REPO=https://gitlab-ci-token:${CI_JOB_TOKEN}@${SOURCE_REPO}
+
+    - |
+      set -euo pipefail
+
+      if [[ -z "${FUZZ_S3_ENDPOINT:-}" || -z "${FUZZ_S3_ACCESS_KEY:-}" || -z "${FUZZ_S3_SECRET_KEY:-}" ]]; then
+        echo "Fuzz S3 secrets are not set (required for in-image corpus sync)"
+        exit 1
+      fi
+
+      unset WERF_FINAL_IMAGES_ONLY
+
+      # PR/dev: build locally, do not push fuzz images; no build-report upload.
+      # Corpus replay always uses main (PR builds never publish corpus).
+      unset WERF_REPO
+      export FUZZ_S3_REPOSITORY="${CI_PROJECT_NAME}"
+      export FUZZ_S3_BRANCH_SLUG="main"
+      echo "dev fuzz build: local only (no registry push, no build-report upload)"
+      echo "Corpus replay path prefix: anomaloys-materials/${FUZZ_S3_REPOSITORY}/${FUZZ_S3_BRANCH_SLUG}/"
+
+      FUZZ_IMAGES="$(werf config list | grep -- '-fuzz$' || true)"
+      if [[ -z "${FUZZ_IMAGES}" ]]; then
+        echo "No fuzz images found"
+        exit 1
+      fi
+
+      echo "Building fuzz images:"
+      echo "${FUZZ_IMAGES}"
+
+      # shellcheck disable=SC2086
+      werf build ${FUZZ_IMAGES} \
+        --save-build-report --build-report-path images_fuzz_tags_werf.json
+
+.build_fuzz_main:
+  extends:
+    - .build_fuzz
+  variables:
+    WERF_REPO: ${MODULES_MODULE_SOURCE}/${MODULES_MODULE_NAME}
+  script:
+    - |
+      SOURCE_REPO=${SOURCE_REPO#git@}
+      SOURCE_REPO=${SOURCE_REPO//://}
+      export SOURCE_REPO=https://gitlab-ci-token:${CI_JOB_TOKEN}@${SOURCE_REPO}
+
+    - |
+      set -euo pipefail
+
+      if [[ -z "${FUZZ_S3_ENDPOINT:-}" || -z "${FUZZ_S3_ACCESS_KEY:-}" || -z "${FUZZ_S3_SECRET_KEY:-}" ]]; then
+        echo "Fuzz S3 secrets are not set (required for in-image corpus sync)"
+        exit 1
+      fi
+
+      unset WERF_FINAL_IMAGES_ONLY
+
+      export FUZZ_S3_REPOSITORY="${CI_PROJECT_NAME}"
+      export FUZZ_S3_BRANCH_SLUG="${CI_COMMIT_REF_SLUG}"
+      echo "main fuzz build: push to ${WERF_REPO}"
+      echo "Corpus replay path prefix: anomaloys-materials/${FUZZ_S3_REPOSITORY}/${FUZZ_S3_BRANCH_SLUG}/"
+
+      FUZZ_IMAGES="$(werf config list | grep -- '-fuzz$' || true)"
+      if [[ -z "${FUZZ_IMAGES}" ]]; then
+        echo "No fuzz images found"
+        exit 1
+      fi
+
+      echo "Building fuzz images:"
+      echo "${FUZZ_IMAGES}"
+
+      # shellcheck disable=SC2086
+      werf build ${FUZZ_IMAGES} \
+        --save-build-report --build-report-path images_fuzz_tags_werf.json
+
+      command -v jq >/dev/null 2>&1 || {
+        echo "jq is required"
+        exit 1
+      }
+
+      REPOSITORY="${CI_PROJECT_NAME}"
+      BRANCH="${CI_COMMIT_REF_NAME}"
+      BRANCH_SLUG="${CI_COMMIT_REF_SLUG}"
+      COMMIT="${CI_COMMIT_SHA}"
+
+      if [[ -z "${REPOSITORY}" || -z "${BRANCH}" || -z "${BRANCH_SLUG}" ]]; then
+        echo "Cannot determine repository/branch for fuzz build report upload"
+        exit 1
+      fi
+
+      jq \
+        --arg repository "${REPOSITORY}" \
+        --arg branch "${BRANCH}" \
+        --arg branchSlug "${BRANCH_SLUG}" \
+        --arg commit "${COMMIT}" \
+        '
+        .Source = {
+          Repository: $repository,
+          Branch: $branch,
+          BranchSlug: $branchSlug,
+          Commit: $commit
+        }
+        ' \
+        images_fuzz_tags_werf.json \
+        > images_fuzz_tags_werf.tmp.json
+      mv images_fuzz_tags_werf.tmp.json images_fuzz_tags_werf.json
+      cat images_fuzz_tags_werf.json
+
+      MC=/tmp/mc
+      curl -fsSL -o "${MC}" https://dl.min.io/client/mc/release/linux-amd64/mc
+      chmod +x "${MC}"
+
+      "${MC}" alias set fuzz-s3 \
+        "${FUZZ_S3_ENDPOINT}" \
+        "${FUZZ_S3_ACCESS_KEY}" \
+        "${FUZZ_S3_SECRET_KEY}"
+
+      "${MC}" cp \
+        "images_fuzz_tags_werf.json" \
+        "fuzz-s3/anomaloys-materials/build-reports/${REPOSITORY}/${BRANCH_SLUG}/images_fuzz_tags_werf.json"
+c

From cad7cf3c22bb31d8efbc57e11be82d407d231035 Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:21:40 +0400
Subject: [PATCH 2/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index 4c6c087..42d2269 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -146,4 +146,3 @@
       "${MC}" cp \
         "images_fuzz_tags_werf.json" \
         "fuzz-s3/anomaloys-materials/build-reports/${REPOSITORY}/${BRANCH_SLUG}/images_fuzz_tags_werf.json"
-c

From 7aa0802445591a166e989060b41f85c266ffede4 Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Fri, 17 Jul 2026 18:48:44 +0400
Subject: [PATCH 3/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index 42d2269..be28473 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -8,11 +8,6 @@
 #                      (no registry push, no build-report upload)
 #   - build_fuzz_main: push to registry + upload images_fuzz_tags_werf.json
 #
-# Required CI/CD variables:
-#   FUZZ_S3_ENDPOINT
-#   FUZZ_S3_ACCESS_KEY
-#   FUZZ_S3_SECRET_KEY
-#
 # Auth / werf ci-env / base_images come from Setup `before_script` (same as `.build`).
 # Registry variables (MODULES_MODULE_SOURCE, etc.) must be provided by the consumer
 # via a mixin (e.g. `.dev-variables` / `.dev`).
@@ -21,6 +16,19 @@
   stage: build
   variables:
     WERF_FINAL_IMAGES_ONLY: "false"
+  id_tokens:
+    VAULT_ID_TOKEN:
+      aud: https://seguro.flant.com
+  secrets:
+    FUZZ_S3_ENDPOINT:
+      vault: team-ssdlc/fuzzing-s3/FUZZ_S3_ENDPOINT@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret
+      file: false
+    FUZZ_S3_ACCESS_KEY:
+      vault: team-ssdlc/fuzzing-s3/FUZZ_S3_ACCESS_KEY@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret
+      file: false
+    FUZZ_S3_SECRET_KEY:
+      vault: team-ssdlc/fuzzing-s3/FUZZ_S3_SECRET_KEY@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret
+      file: false
 
 .build_fuzz_dev:
   extends:
@@ -42,7 +50,7 @@
       unset WERF_FINAL_IMAGES_ONLY
 
       # PR/dev: build locally, do not push fuzz images; no build-report upload.
-      # Corpus replay always uses main (PR builds never publish corpus).
+      # Corpus replay always uses main (PR builds never publish image).
       unset WERF_REPO
       export FUZZ_S3_REPOSITORY="${CI_PROJECT_NAME}"
       export FUZZ_S3_BRANCH_SLUG="main"

From e2792e5696d59da22cc0174af60f77cbcc24cccd Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Fri, 17 Jul 2026 18:56:34 +0400
Subject: [PATCH 4/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index be28473..2a5f974 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -18,7 +18,7 @@
     WERF_FINAL_IMAGES_ONLY: "false"
   id_tokens:
     VAULT_ID_TOKEN:
-      aud: https://seguro.flant.com
+      aud: gitlab-access-aud
   secrets:
     FUZZ_S3_ENDPOINT:
       vault: team-ssdlc/fuzzing-s3/FUZZ_S3_ENDPOINT@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret

From ed3de2e9264a1c59c1f54ff7ed2c78d1d9246f61 Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Mon, 20 Jul 2026 15:10:30 +0400
Subject: [PATCH 5/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index 2a5f974..c36095d 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -16,18 +16,23 @@
   stage: build
   variables:
     WERF_FINAL_IMAGES_ONLY: "false"
+    VAULT_SERVER_URL: https://seguro.flant.com
+    VAULT_AUTH_PATH: fox
   id_tokens:
     VAULT_ID_TOKEN:
       aud: gitlab-access-aud
   secrets:
     FUZZ_S3_ENDPOINT:
-      vault: team-ssdlc/fuzzing-s3/FUZZ_S3_ENDPOINT@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret
+      vault: 6db2f1ee-9b6f-4f4f-8381-2fb43060478a/team-ssdlc/fuzzing-s3/FUZZ_S3_ENDPOINT@projects
+      token: $VAULT_ID_TOKEN
       file: false
     FUZZ_S3_ACCESS_KEY:
-      vault: team-ssdlc/fuzzing-s3/FUZZ_S3_ACCESS_KEY@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret
+      vault: 6db2f1ee-9b6f-4f4f-8381-2fb43060478a/team-ssdlc/fuzzing-s3/FUZZ_S3_ACCESS_KEY@projects
+      token: $VAULT_ID_TOKEN
       file: false
     FUZZ_S3_SECRET_KEY:
-      vault: team-ssdlc/fuzzing-s3/FUZZ_S3_SECRET_KEY@projects/6db2f1ee-9b6f-4f4f-8381-2fb43060478a/secret
+      vault: 6db2f1ee-9b6f-4f4f-8381-2fb43060478a/team-ssdlc/fuzzing-s3/FUZZ_S3_SECRET_KEY@projects
+      token: $VAULT_ID_TOKEN
       file: false
 
 .build_fuzz_dev:

From a7a2f2bd4417d89d0a7c65db1f3c339b2fa80829 Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:20:21 +0400
Subject: [PATCH 6/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index c36095d..6745fa1 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -54,12 +54,13 @@
 
       unset WERF_FINAL_IMAGES_ONLY
 
-      # PR/dev: build locally, do not push fuzz images; no build-report upload.
+      # PR/dev: do not push to primary repo; read stages from dev registry cache.
       # Corpus replay always uses main (PR builds never publish image).
       unset WERF_REPO
+      export WERF_SECONDARY_REPO="${MODULES_MODULE_SOURCE}/${MODULES_MODULE_NAME}"
       export FUZZ_S3_REPOSITORY="${CI_PROJECT_NAME}"
       export FUZZ_S3_BRANCH_SLUG="main"
-      echo "dev fuzz build: local only (no registry push, no build-report upload)"
+      echo "dev fuzz build: local primary, secondary cache ${WERF_SECONDARY_REPO} (no push, no build-report upload)"
       echo "Corpus replay path prefix: anomaloys-materials/${FUZZ_S3_REPOSITORY}/${FUZZ_S3_BRANCH_SLUG}/"
 
       FUZZ_IMAGES="$(werf config list | grep -- '-fuzz$' || true)"

From c392ee190d24386095bb4611036a2e9a8c4d03fd Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:39:32 +0400
Subject: [PATCH 7/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index 6745fa1..12e247f 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -76,7 +76,8 @@
       werf build ${FUZZ_IMAGES} \
         --save-build-report --build-report-path images_fuzz_tags_werf.json
 
-.build_fuzz_main:
+      echo "Cleaning local werf host cache after fuzz_dev build"
+      werf host cleanup
   extends:
     - .build_fuzz
   variables:

From 90cd4f0c9a37c916a046edae49441b6345b5a864 Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:42:23 +0400
Subject: [PATCH 8/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index 12e247f..76c33b0 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -78,6 +78,8 @@
 
       echo "Cleaning local werf host cache after fuzz_dev build"
       werf host cleanup
+
+.build_fuzz_main:
   extends:
     - .build_fuzz
   variables:

From 39caf402c01f395e3da20eec6f5215c9b894080c Mon Sep 17 00:00:00 2001
From: Mikhail <39648424+MixBars@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:52:53 +0400
Subject: [PATCH 9/9] Update Build_Fuzz_Images.gitlab-ci.yml

Signed-off-by: Mikhail <39648424+MixBars@users.noreply.github.com>
---
 templates/Build_Fuzz_Images.gitlab-ci.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/templates/Build_Fuzz_Images.gitlab-ci.yml b/templates/Build_Fuzz_Images.gitlab-ci.yml
index 76c33b0..6745fa1 100644
--- a/templates/Build_Fuzz_Images.gitlab-ci.yml
+++ b/templates/Build_Fuzz_Images.gitlab-ci.yml
@@ -76,9 +76,6 @@
       werf build ${FUZZ_IMAGES} \
         --save-build-report --build-report-path images_fuzz_tags_werf.json
 
-      echo "Cleaning local werf host cache after fuzz_dev build"
-      werf host cleanup
-
 .build_fuzz_main:
   extends:
     - .build_fuzz