ci: run daily ClusterFuzz report

.github/workflows/coverage_report_clusterfuzz.yml

@@ -0,0 +1,42 @@
+# Creates a coverage report using only the ClusterFuzz corpus.
+# This complements our main coverage report, which only uses local test
+# vectors.  As ClusterFuzz continually finds new things to fuzz, we run
+# this script daily.
+
+name: Coverage Report (ClusterFuzz)
+on:
+  schedule:
+    - cron: 30 11 * * *
+  push:
+  workflow_dispatch:
+jobs:
+  coverage-report-clusterfuzz:
+    name: Coverage Report (ClusterFuzz)
+    runs-on: ubuntu-latest
+    env:
+      MACHINE: linux_clang_haswell
+      EXTRAS: llvm-cov
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ./.github/actions/deps
+
+      - name: Build
+        run: make -j fuzz-test
+
+      - name: Replace corpus dir
+        run: contrib/test/fetch_clusterfuzz_corpus.sh
+
+      - name: Generate all coverage
+        run: |
+          make run-fuzz-test
+          make build/linux/clang/haswell/cov/cov.lcov
+
+      - name: Upload coverage report to CodeCov
+        uses: codecov/codecov-action@v3
+        timeout-minutes: 5
+        with:
+          files: build/linux/clang/haswell/cov/cov.lcov
+          name: dist-cov-report-cf
+          functionalities: search
+          flags: clusterfuzz

contrib/test/fetch_clusterfuzz_corpus.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+# Downloads the latest ClusterFuzz corpus.
+# WARNING: Destructive!
+
+rm -rf corpus
+
+gcloud storage ls gs://backup.isol-clusterfuzz.appspot.com/corpus/libFuzzer/ |
+while read -r dir
+do
+  TARGET_FULL="$(basename "$dir")"                    # fuzz_base64-highend
+  TARGET=$(sed -r 's/-[a-z]+$//' <<< "$TARGET_FULL")  # fuzz_base64
+
+  CORPUS_DIR="corpus/$TARGET/$TARGET"
+  mkdir -v -p "$CORPUS_DIR"
+
+  TEMPFILE="$(mktemp)"
+  gcloud storage cp "$dir"latest.zip "$TEMPFILE"
+
+  TEMPDIR="$(mktemp -d)"
+  unzip -q "$TEMPFILE" -d "$TEMPDIR"
+  rm "$TEMPFILE"
+
+  find "$TEMPDIR" -type f -exec mv -nt "$CORPUS_DIR" {} +
+  rm -r "$TEMPDIR"
+done