oss-fuzz integration is split across (at least) 3 repositories and is fragile about containerd HOT 4 OPEN

The Dockerfile in oss-fuzz pulls in the instrumentation repo and then runs a script which invokes another script held in this repository. Can we remove the indirection in the oss-fuzz repo and just clone instrumentation directly in our oss_fuzz_build.sh script? That seems to remove at least one coordination point.

from containerd.

The use of instrumentation is not versioned at all. This can be helpful for the evolution of fuzzers, but introduces risk of breakage into our CI (i.e., cloning HEAD is not reproducible). Should we pin in our script and then bump when needed?

from containerd.

Also note that this checkout of the containerd repo does not use any information about the branch or PR in flight, although I think the "run fuzzers" does try and handle something PR related? (the default mode for the "run fuzzers" action is "code change" testing). However, I can't find the actual checking out the PR branch, but it could be hidden in the python code that gets kicked off after this checkout of main clearly seen in the project Dockerfile.

What this definitely means is that the release/1.7 fuzzer CI action and the main fuzzer CI action are doing the exact same thing for "build fuzzers" only again the 2.0 codebase; it should have broken in main when the packages were moved, but it is just silently exiting when it doesn't find the images package (moved from images/ to core/images/). Until we figure out if it is actually testing something in release/1.7 we might as well disable the action.

from containerd.