ci(fuzz): narrow PR triggers and cover all fuzz targets (#4664)

Re-enable the Fuzz workflow (disabled_manually) with two changes that
address the congestion that likely caused it to be disabled:

- Narrow the PR trigger paths to fuzz/**, scripts/fuzz/** and
  fuzz.yml only. The broad crate paths (crates/ecstore|filemeta|utils)
  queued a ~45min fuzz-build on nearly every PR; coverage of those
  crates moves to the nightly schedule, which fuzzes against main.
- Expand the smoke matrix, nightly matrix, run.sh default set and the
  fuzz-build staging/upload steps from 3 to all 5 buildable targets:
  archive_extract, bucket_validation, local_metadata, path_containment,
  policy_ingress. archive_extract and policy_ingress were previously
  in no matrix.

The two *_storage_api.rs files are `mod` submodules of their parent
targets (bucket_validation, path_containment), not standalone bins, so
fuzz/Cargo.toml registers exactly 5 fuzz bins.

Smoke jobs run one target per parallel matrix job (-max_total_time=60),
so wall-clock stays per-target, well under the 15min budget for a
fuzz-only PR. A TODO(ci-8) hook marks where scheduled-failure alerting
will attach on the nightly job.

Refs rustfs/backlog#1149 (ci-9, absorbed sec-13), rustfs/backlog#1155

.github/workflows/fuzz.yml

@@ -17,13 +17,16 @@ name: Fuzz
 on:
   pull_request:
     types: [ opened, synchronize, reopened, closed ]
+    # PR trigger is intentionally narrow: only changes to the fuzz harness
+    # itself gate a PR. Broad crate paths (ecstore/filemeta/utils/policy/…)
+    # are covered by the nightly `schedule` run below, which fuzzes against
+    # whatever landed on main. Widening these paths previously queued a
+    # ~45min fuzz-build on nearly every PR and is why this workflow was
+    # disabled; do not re-add crate paths here.
     paths:
       - "fuzz/**"
       - "scripts/fuzz/**"
       - ".github/workflows/fuzz.yml"
-      - "crates/ecstore/**"
-      - "crates/filemeta/**"
-      - "crates/utils/**"
   schedule:
     - cron: "0 2 * * *"
   workflow_dispatch:
@@ -97,7 +100,11 @@ jobs:
         run: |
           binary_root="fuzz/prebuilt/${CARGO_BUILD_TARGET}/release"
           mkdir -p "${binary_root}"
-          for target in path_containment bucket_validation local_metadata; do
+          # Keep this list in sync with the smoke/nightly matrices and
+          # scripts/fuzz/run.sh default target set (all 5 buildable bins in
+          # fuzz/Cargo.toml). The *_storage_api.rs files are `mod` submodules
+          # of their parent targets, not standalone bins.
+          for target in archive_extract bucket_validation local_metadata path_containment policy_ingress; do
             install -Dm755 "fuzz/target/${CARGO_BUILD_TARGET}/release/${target}" "${binary_root}/${target}"
           done
 
@@ -106,9 +113,11 @@ jobs:
         with:
           name: fuzz-prebuilt-binaries-${{ github.run_number }}
           path: |
-            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/path_containment
+            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/archive_extract
             fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/bucket_validation
             fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/local_metadata
+            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/path_containment
+            fuzz/prebuilt/${{ env.CARGO_BUILD_TARGET }}/release/policy_ingress
           if-no-files-found: error
           retention-days: 1
           compression-level: 0
@@ -127,8 +136,10 @@ jobs:
     timeout-minutes: 30
     strategy:
       fail-fast: false
+      # One job per target runs in parallel, so wall-clock time is per-target
+      # (~60s fuzz + download/chmod overhead), not the sum across the matrix.
       matrix:
-        target: [path_containment, bucket_validation, local_metadata]
+        target: [archive_extract, bucket_validation, local_metadata, path_containment, policy_ingress]
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:
@@ -170,6 +181,10 @@ jobs:
   nightly-fuzz-corpus:
     name: "Nightly / ${{ matrix.target }}"
     needs: fuzz-build
+    # TODO(ci-8): when the schedule-failure-issue composite action lands,
+    # add a step here (or a dependent job) that opens/updates a GitHub issue
+    # on nightly failure. ci-8 is the single alerting mechanism for all
+    # scheduled workflows; do not self-roll alerting in this workflow.
     if: >
       github.event_name == 'schedule' ||
       (github.event_name == 'workflow_dispatch' &&
@@ -179,7 +194,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [path_containment, bucket_validation, local_metadata]
+        target: [archive_extract, bucket_validation, local_metadata, path_containment, policy_ingress]
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
     steps:

scripts/fuzz/run.sh

@@ -47,7 +47,10 @@ PREBUILT_BINARY_DIR=${PREBUILT_BINARY_DIR:-}
 cd "$FUZZ_DIR"
 mkdir -p "$ARTIFACT_ROOT"
 
-targets="path_containment bucket_validation local_metadata"
+# All buildable fuzz bins registered in fuzz/Cargo.toml. Keep in sync with the
+# smoke/nightly matrices in .github/workflows/fuzz.yml. The *_storage_api.rs
+# files are `mod` submodules of their parent targets, not standalone bins.
+targets="archive_extract bucket_validation local_metadata path_containment policy_ingress"
 if [ -n "$FUZZ_TARGET" ]; then
     targets="$FUZZ_TARGET"
 fi