fuzz: get a failing fuzz input to the maintainers without publishing it #861

What is wrong

The log and the artifacts of a workflow run in this repository are public. The SigV4 fuzz targets parse a request before the caller is authenticated, so a crash, timeout, out-of-memory or slow input can be a denial of service that SECURITY.md asks to be reported privately. @robinnsc raised this on #798 (comment).

The pull request that answers that comment keeps the input out of public view. The Fuzz step writes the cargo-fuzz and libFuzzer output to a file on the runner, prints only the final statistics of a clean run, and uploads nothing. When a run fails, the log names the target and nothing more. A maintainer must run the target locally to find the input. A local run can take longer than the CI run did, and it can find a different input or none.

For a scheduled run, GitHub sends the failure email only to the user who last changed the cron line of the workflow.

Where

.github/workflows/fuzz.yml

What to change

Two decisions are open:

1. How a maintainer gets the input of a failed run. One option is to encrypt fuzz/artifacts and the log file to the public keys of the maintainers, committed in the repository, and upload only the encrypted file. The artifact stays public, but only a maintainer can read it, and the workflow needs no secret. Another option is to run the scheduled job in a repository where the logs and the artifacts are private.
2. Who looks at a red scheduled run, and how that person learns about it.

Recommendation

Encrypt the input with age to a list of maintainer public keys in the repository, and upload only the encrypted file. The runs stay in this repository with contents: read and no secrets. For triage, agree on an owner. Until a notification step exists, GitHub emails only the user who last edited the cron line.