Create Build_Fuzz_Images.gitlab-ci.yml

templates/Build_Fuzz_Images.gitlab-ci.yml

@@ -0,0 +1,162 @@
+# Fuzz image builds (*-fuzz). Separate from the regular module `.build`.
+#
+# Mirrors deckhouse `build_fuzz_template` (dev / main):
+#   - FUZZ_S3_* are always required: werf passes them into the image as secrets
+#     for in-image corpus sync / replay (see fuzz.tmpl).
+#   - Corpus path: s3://anomaloys-materials/<repository>/<branch slug>/...
+#   - build_fuzz_dev:  local build only, FUZZ_S3_BRANCH_SLUG=main
+#                      (no registry push, no build-report upload)
+#   - build_fuzz_main: push to registry + upload images_fuzz_tags_werf.json
+#
+# Auth / werf ci-env / base_images come from Setup `before_script` (same as `.build`).
+# Registry variables (MODULES_MODULE_SOURCE, etc.) must be provided by the consumer
+# via a mixin (e.g. `.dev-variables` / `.dev`).
+
+.build_fuzz:
+  stage: build
+  variables:
+    WERF_FINAL_IMAGES_ONLY: "false"
+    VAULT_SERVER_URL: https://seguro.flant.com
+    VAULT_AUTH_PATH: fox
+  id_tokens:
+    VAULT_ID_TOKEN:
+      aud: gitlab-access-aud
+  secrets:
+    FUZZ_S3_ENDPOINT:
+      vault: 6db2f1ee-9b6f-4f4f-8381-2fb43060478a/team-ssdlc/fuzzing-s3/FUZZ_S3_ENDPOINT@projects
+      token: $VAULT_ID_TOKEN
+      file: false
+    FUZZ_S3_ACCESS_KEY:
+      vault: 6db2f1ee-9b6f-4f4f-8381-2fb43060478a/team-ssdlc/fuzzing-s3/FUZZ_S3_ACCESS_KEY@projects
+      token: $VAULT_ID_TOKEN
+      file: false
+    FUZZ_S3_SECRET_KEY:
+      vault: 6db2f1ee-9b6f-4f4f-8381-2fb43060478a/team-ssdlc/fuzzing-s3/FUZZ_S3_SECRET_KEY@projects
+      token: $VAULT_ID_TOKEN
+      file: false
+
+.build_fuzz_dev:
+  extends:
+    - .build_fuzz
+  script:
+    - |
+      SOURCE_REPO=${SOURCE_REPO#git@}
+      SOURCE_REPO=${SOURCE_REPO//://}
+      export SOURCE_REPO=https://gitlab-ci-token:${CI_JOB_TOKEN}@${SOURCE_REPO}
+
+    - |
+      set -euo pipefail
+
+      if [[ -z "${FUZZ_S3_ENDPOINT:-}" || -z "${FUZZ_S3_ACCESS_KEY:-}" || -z "${FUZZ_S3_SECRET_KEY:-}" ]]; then
+        echo "Fuzz S3 secrets are not set (required for in-image corpus sync)"
+        exit 1
+      fi
+
+      unset WERF_FINAL_IMAGES_ONLY
+
+      # PR/dev: do not push to primary repo; read stages from dev registry cache.
+      # Corpus replay always uses main (PR builds never publish image).
+      unset WERF_REPO
+      export WERF_SECONDARY_REPO="${MODULES_MODULE_SOURCE}/${MODULES_MODULE_NAME}"
+      export FUZZ_S3_REPOSITORY="${CI_PROJECT_NAME}"
+      export FUZZ_S3_BRANCH_SLUG="main"
+      echo "dev fuzz build: local primary, secondary cache ${WERF_SECONDARY_REPO} (no push, no build-report upload)"
+      echo "Corpus replay path prefix: anomaloys-materials/${FUZZ_S3_REPOSITORY}/${FUZZ_S3_BRANCH_SLUG}/"
+
+      FUZZ_IMAGES="$(werf config list | grep -- '-fuzz$' || true)"
+      if [[ -z "${FUZZ_IMAGES}" ]]; then
+        echo "No fuzz images found"
+        exit 1
+      fi
+
+      echo "Building fuzz images:"
+      echo "${FUZZ_IMAGES}"
+
+      # shellcheck disable=SC2086
+      werf build ${FUZZ_IMAGES} \
+        --save-build-report --build-report-path images_fuzz_tags_werf.json
+
+.build_fuzz_main:
+  extends:
+    - .build_fuzz
+  variables:
+    WERF_REPO: ${MODULES_MODULE_SOURCE}/${MODULES_MODULE_NAME}
+  script:
+    - |
+      SOURCE_REPO=${SOURCE_REPO#git@}
+      SOURCE_REPO=${SOURCE_REPO//://}
+      export SOURCE_REPO=https://gitlab-ci-token:${CI_JOB_TOKEN}@${SOURCE_REPO}
+
+    - |
+      set -euo pipefail
+
+      if [[ -z "${FUZZ_S3_ENDPOINT:-}" || -z "${FUZZ_S3_ACCESS_KEY:-}" || -z "${FUZZ_S3_SECRET_KEY:-}" ]]; then
+        echo "Fuzz S3 secrets are not set (required for in-image corpus sync)"
+        exit 1
+      fi
+
+      unset WERF_FINAL_IMAGES_ONLY
+
+      export FUZZ_S3_REPOSITORY="${CI_PROJECT_NAME}"
+      export FUZZ_S3_BRANCH_SLUG="${CI_COMMIT_REF_SLUG}"
+      echo "main fuzz build: push to ${WERF_REPO}"
+      echo "Corpus replay path prefix: anomaloys-materials/${FUZZ_S3_REPOSITORY}/${FUZZ_S3_BRANCH_SLUG}/"
+
+      FUZZ_IMAGES="$(werf config list | grep -- '-fuzz$' || true)"
+      if [[ -z "${FUZZ_IMAGES}" ]]; then
+        echo "No fuzz images found"
+        exit 1
+      fi
+
+      echo "Building fuzz images:"
+      echo "${FUZZ_IMAGES}"
+
+      # shellcheck disable=SC2086
+      werf build ${FUZZ_IMAGES} \
+        --save-build-report --build-report-path images_fuzz_tags_werf.json
+
+      command -v jq >/dev/null 2>&1 || {
+        echo "jq is required"
+        exit 1
+      }
+
+      REPOSITORY="${CI_PROJECT_NAME}"
+      BRANCH="${CI_COMMIT_REF_NAME}"
+      BRANCH_SLUG="${CI_COMMIT_REF_SLUG}"
+      COMMIT="${CI_COMMIT_SHA}"
+
+      if [[ -z "${REPOSITORY}" || -z "${BRANCH}" || -z "${BRANCH_SLUG}" ]]; then
+        echo "Cannot determine repository/branch for fuzz build report upload"
+        exit 1
+      fi
+
+      jq \
+        --arg repository "${REPOSITORY}" \
+        --arg branch "${BRANCH}" \
+        --arg branchSlug "${BRANCH_SLUG}" \
+        --arg commit "${COMMIT}" \
+        '
+        .Source = {
+          Repository: $repository,
+          Branch: $branch,
+          BranchSlug: $branchSlug,
+          Commit: $commit
+        }
+        ' \
+        images_fuzz_tags_werf.json \
+        > images_fuzz_tags_werf.tmp.json
+      mv images_fuzz_tags_werf.tmp.json images_fuzz_tags_werf.json
+      cat images_fuzz_tags_werf.json
+
+      MC=/tmp/mc
+      curl -fsSL -o "${MC}" https://dl.min.io/client/mc/release/linux-amd64/mc
+      chmod +x "${MC}"
+
+      "${MC}" alias set fuzz-s3 \
+        "${FUZZ_S3_ENDPOINT}" \
+        "${FUZZ_S3_ACCESS_KEY}" \
+        "${FUZZ_S3_SECRET_KEY}"
+
+      "${MC}" cp \
+        "images_fuzz_tags_werf.json" \
+        "fuzz-s3/anomaloys-materials/build-reports/${REPOSITORY}/${BRANCH_SLUG}/images_fuzz_tags_werf.json"