feat: working app token

FuelLabs · Sep 25, 2024 · bb7ac76 · bb7ac76
1 parent 145b099
commit bb7ac76
Show file tree

Hide file tree

Showing 3 changed files with 72 additions and 58 deletions.
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
@@ -8,19 +8,26 @@ jobs:
   BatchFuzzing:
     runs-on: ubuntu-latest
     steps:
-    - name: Build Fuzzers (${{ matrix.sanitizer }})
-      id: build
-      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
-      with:
-        language: rust
-    - name: Run Fuzzers (${{ matrix.sanitizer }})
-      id: run
-      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        fuzz-seconds: 3600
-        mode: 'batch'
-        output-sarif: true
-        storage-repo: https://${{ secrets.FUZZ_STORAGE_PAT }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
-        storage-repo-branch: main
-        storage-repo-branch-coverage: gh-pages
+      - name: Get fuzzer auth token
+        uses: actions/create-github-app-token@v1
+        id: fuzzer-token
+        with:
+          owner: ${{ github.repository_owner }} # set this to get access to all allowed repos
+          app-id: ${{ vars.FUEL_FUZZING_CORPUS_APP_ID }}
+          private-key: ${{ secrets.FUEL_FUZZING_CORPUS_APP_KEY }}
+      - name: Build Fuzzers (${{ matrix.sanitizer }})
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+        with:
+          language: rust
+      - name: Run Fuzzers (${{ matrix.sanitizer }})
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 3600
+          mode: 'batch'
+          output-sarif: true
+          storage-repo: https://oauth2:${{ steps.fuzzer-token.outputs.token }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
+          storage-repo-branch: main
+          storage-repo-branch-coverage: gh-pages
diff --git a/.github/workflows/cflite_cron.yml b/.github/workflows/cflite_cron.yml
@@ -8,39 +8,53 @@ jobs:
   Pruning:
     runs-on: ubuntu-latest
     steps:
-    - name: Build Fuzzers
-      id: build
-      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
-      with:
-        language: rust
-    - name: Run Fuzzers
-      id: run
-      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        fuzz-seconds: 600 # Time after which minimization is aborted
-        mode: 'prune'
-        output-sarif: true
-        storage-repo: https://${{ secrets.FUZZ_STORAGE_PAT }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
-        storage-repo-branch: main
-        storage-repo-branch-coverage: gh-pages
+      - name: Get fuzzer auth token
+        uses: actions/create-github-app-token@v1
+        id: fuzzer-token
+        with:
+          owner: ${{ github.repository_owner }} # set this to get access to all allowed repos
+          app-id: ${{ vars.FUEL_FUZZING_CORPUS_APP_ID }}
+          private-key: ${{ secrets.FUEL_FUZZING_CORPUS_APP_KEY }}
+      - name: Build Fuzzers
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+        with:
+          language: rust
+      - name: Run Fuzzers
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 600 # Time after which minimization is aborted
+          mode: 'prune'
+          output-sarif: true
+          storage-repo: https://oauth2:${{ steps.fuzzer-token.outputs.token }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
+          storage-repo-branch: main
+          storage-repo-branch-coverage: gh-pages
   Coverage:
     runs-on: ubuntu-latest
     steps:
-    - name: Build Fuzzers
-      id: build
-      uses: google/clusterfuzzlite/actions/build_fuzzers@v1
-      with:
-        language: rust
-        sanitizer: coverage
-    - name: Run Fuzzers
-      id: run
-      uses: google/clusterfuzzlite/actions/run_fuzzers@v1
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
-        fuzz-seconds: 600
-        mode: 'coverage'
-        sanitizer: 'coverage'
-        storage-repo: https://${{ secrets.FUZZ_STORAGE_PAT }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
-        storage-repo-branch: main
-        storage-repo-branch-coverage: gh-pages
+      - name: Get fuzzer auth token
+        uses: actions/create-github-app-token@v1
+        id: fuzzer-token
+        with:
+          owner: ${{ github.repository_owner }} # set this to get access to all allowed repos
+          app-id: ${{ vars.FUEL_FUZZING_CORPUS_APP_ID }}
+          private-key: ${{ secrets.FUEL_FUZZING_CORPUS_APP_KEY }}
+      - name: Build Fuzzers
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
+        with:
+          language: rust
+          sanitizer: coverage
+      - name: Run Fuzzers
+        id: run
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: 600
+          mode: 'coverage'
+          sanitizer: 'coverage'
+          storage-repo: https://oauth2:${{ steps.fuzzer-token.outputs.token }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
+          storage-repo-branch: main
+          storage-repo-branch-coverage: gh-pages
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
@@ -13,15 +13,15 @@ jobs:
         uses: actions/create-github-app-token@v1
         id: fuzzer-token
         with:
-          owner: FuelLabs
+          owner: ${{ github.repository_owner }} # set this to get access to all allowed repos
           app-id: ${{ vars.FUEL_FUZZING_CORPUS_APP_ID }}
           private-key: ${{ secrets.FUEL_FUZZING_CORPUS_APP_KEY }}
       - name: Build Fuzzers
         id: build
         uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
-          github-token: ${{ steps.fuzzer-token.outputs.token }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           storage-repo: https://oauth2:${{ steps.fuzzer-token.outputs.token }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
           storage-repo-branch: main
           storage-repo-branch-coverage: gh-pages
@@ -36,10 +36,3 @@ jobs:
           storage-repo: https://oauth2:${{ steps.fuzzer-token.outputs.token }}@github.com/FuelLabs/fuel-fuzzing-corpus.git
           storage-repo-branch: main
           storage-repo-branch-coverage: gh-pages
-      - name: Token to env
-        if: ${{ failure() }}
-        run: |
-          echo "FUZZER_TOKEN=${{ steps.fuzzer-token.outputs.token }}" >> $GITHUB_ENV
-      - name: Debug with tmate on failure
-        if: ${{ failure() }}
-        uses: mxschmitt/action-tmate@v3