Update Coverage-Fuzzing yml and use last package file in corpus

Add COVFUZZ_PROJECT_PATH to Coverage-Fuzzing.gitlab-ci.yml.
Update corpus to use last package file instead of first package file.

Changelog: changed
EE: true

ee/app/models/app_sec/fuzzing/coverage/corpus.rb

@@ -35,22 +35,22 @@ module AppSec
         end
 
         def package_with_package_file
-          unless first_package_file
+          unless latest_package_file
             errors.add(:package_id, 'should have an associated package file')
           end
         end
 
         def validate_file_format
-          return unless first_package_file
+          return unless latest_package_file
 
-          unless ACCEPTED_FORMATS.include? File.extname(first_package_file.file_name)
+          unless ACCEPTED_FORMATS.include? File.extname(latest_package_file.file_name)
             errors.add(:package_id, 'format is not supported')
           end
         end
 
         # Currently we are only supporting one package_file per package for a corpus model.
-        def first_package_file
-          @package_file ||= package.package_files.first
+        def latest_package_file
+          @package_file ||= package.package_files.last
         end
       end
     end

ee/spec/models/app_sec/fuzzing/coverage/corpus_spec.rb

@@ -29,19 +29,43 @@ RSpec.describe AppSec::Fuzzing::Coverage::Corpus, type: :model do
 
       subject(:corpus) { build(:corpus, package: package, project: package.project) }
 
-      it 'raises the error on adding the package file with different format' do
-        expect { corpus.save! }.to raise_error(ActiveRecord::RecordInvalid, 'Validation failed: Package should have an associated package file')
+      context 'without a package file associated to the package' do
+        it 'raises the error' do
+          expect { corpus.save! }.to raise_error(ActiveRecord::RecordInvalid, 'Validation failed: Package should have an associated package file')
+        end
+      end
+
+      context 'with a package file associated to the package' do
+        before do
+          create(:package_file, :generic_zip, package: package)
+        end
+
+        it 'saves the record successfully' do
+          expect(corpus.save).to be true
+        end
       end
     end
 
     describe 'validate_file_format' do
-      let(:package_file) { create(:package_file) }
-      let(:package) { package_file.package }
+      let(:xml_package_file) { create(:package_file, :xml) }
+      let(:package) { xml_package_file.package }
 
       subject(:corpus) { build(:corpus, package: package, project: package.project) }
 
-      it 'raises the error on adding the package file with different format' do
-        expect { corpus.save! }.to raise_error(ActiveRecord::RecordInvalid, 'Validation failed: Package format is not supported')
+      context 'with an invalid last package file' do
+        it 'raises the error on adding the package file with different format' do
+          expect { corpus.save! }.to raise_error(ActiveRecord::RecordInvalid, 'Validation failed: Package format is not supported')
+        end
+      end
+
+      context 'with a valid last package file' do
+        before do
+          create(:package_file, :generic_zip, package: package)
+        end
+
+        it 'saves the record successfully' do
+          expect(corpus.save).to be true
+        end
       end
     end
   end

lib/gitlab/ci/templates/Security/Coverage-Fuzzing.gitlab-ci.yml

@@ -33,6 +33,7 @@ coverage_fuzzing_unlicensed:
   before_script:
     - export COVFUZZ_JOB_TOKEN=$CI_JOB_TOKEN
     - export COVFUZZ_PRIVATE_TOKEN=$CI_PRIVATE_TOKEN
+    - export COVFUZZ_PROJECT_PATH=$CI_PROJECT_PATH
     - export COVFUZZ_PROJECT_ID=$CI_PROJECT_ID
     - if [ -x "$(command -v apt-get)" ] ; then apt-get update && apt-get install -y wget; fi
     - wget -O gitlab-cov-fuzz "${COVFUZZ_URL_PREFIX}"/"${COVFUZZ_VERSION}"/binaries/gitlab-cov-fuzz_Linux_x86_64