fuzz: Marinade crucible harness + FuzzCorp CI

.github/workflows/fuzzcorp.yml

@@ -0,0 +1,66 @@
+name: FuzzCorp bundle (marinade_invariants)
+
+# Builds the target program from THIS ref's source, builds the crucible fuzz harness against it,
+# and submits the bundle to FuzzCorp. Runs on every PR and on push to main, so each change is
+# fuzzed against its own program build — no prebuilt program/IDL is committed to the repo.
+#
+# Required repo configuration (Settings > Secrets and variables > Actions):
+#   - secret  FUZZ_API_KEY       FuzzCorp dashboard API key (service account)
+#   - var     FUZZ_ORGANIZATION  = marinade
+#   - var     FUZZ_PROJECT       = liquid-staking-program
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch: {}
+
+jobs:
+  build-and-upload:
+    runs-on: ubuntu-latest  # amd64 — matches the FuzzCorp worker fleet
+    steps:
+      - uses: actions/checkout@v4
+
+      # The program only builds with the pinned anchor 0.27 / solana 1.14.29 toolchain (modern
+      # toolchains fail on ahash's `stdsimd`). The verifiable-build image carries that toolchain and
+      # produces the same 1.14.29 SBF binary the harness needs (it clears crucible's CPI wall).
+      - name: Build marinade program (anchor 0.27 / solana 1.14.29)
+        run: |
+          docker run --rm -v "$PWD":/work -w /work backpackapp/build:v0.27.0 \
+            bash -lc "anchor build"
+          sudo chown -R "$(id -u):$(id -g)" target
+          cp target/deploy/marinade_finance.so fuzz/marinade/programs/marinade_program.so
+          cp target/idl/marinade_finance.json  fuzz/marinade/idls/marinade.json
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.92.0
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            fuzz/marinade/target
+          key: fuzz-marinade-${{ runner.os }}-${{ hashFiles('fuzz/marinade/Cargo.lock') }}
+
+      # Track crucible main so the harness is always built and fuzzed against the LATEST fuzzer, not
+      # a pinned snapshot. Updates the lock to the newest main commit before the build.
+      - name: Use latest crucible main
+        run: cd fuzz/marinade && cargo update -p crucible-fuzzer -p crucible-test-context -p crucible-idl-gen
+
+      - name: Build FuzzCorp bundle
+        run: bash fuzz/marinade/build-bundle.sh
+
+      # Upload only when secrets are available (pushes and same-repo PRs). Fork PRs still build the
+      # program + harness above as a check, but can't upload (GitHub withholds secrets from forks).
+      - name: Upload bundle to FuzzCorp
+        if: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: asymmetric-research/fuzz-upload-action@v2
+        with:
+          upload_type: bundle
+          upload_path: fuzz/marinade/build/bundle
+        env:
+          FUZZ_ORGANIZATION: ${{ vars.FUZZ_ORGANIZATION }}
+          FUZZ_PROJECT: ${{ vars.FUZZ_PROJECT }}
+          FUZZ_API_KEY: ${{ secrets.FUZZ_API_KEY }}

fuzz/marinade/.gitignore

@@ -0,0 +1,8 @@
+/target/
+/build/
+/crashes/
+# Unpacked from fixtures-mainnet.tar.gz by build-bundle.sh
+/fixtures/mainnet/
+# Generated from the program source by `anchor build` in CI (see .github/workflows/fuzzcorp.yml)
+/programs/marinade_program.so
+/idls/marinade.json