sanitizer.yml

name: Run sanitizer checks

on:
  workflow_dispatch:
  push:
    branches: [ master ]
    paths:
      - '**.h'
      - '**.c'

  pull_request:
    branches: [ master ]
    paths:
      - '**.h'
      - '**.c'

permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    name: Build with ${{ matrix.sanitizer }} sanitizer for ${{ matrix.ucs }}
    strategy:
      matrix:
        ucs: [ucs2, ucs4]
        sanitizer: [address, leak, undefined]
        include:
          - sanitizer: "address"
            options: "ASAN_OPTIONS=detect_leaks=0"
          - sanitizer: "leak"
            options: "LSAN_OPTIONS=fast_unwind_on_malloc=0"
          - sanitizer: "undefined"
            options: "UBSAN_OPTIONS=halt_on_error=1"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
        with:
          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs

      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - name: Install dependencies
        run: sudo apt-get update -qq && sudo apt-get install -y libyaml-dev
      - name: Autogen
        run: ./autogen.sh
      - name: Configure
        run: CFLAGS="-fsanitize=${{ matrix.sanitizer }} -g" ./configure
        if: matrix.ucs == 'ucs2'
      - name: Configure with ucs4
        run: CFLAGS="-fsanitize=${{ matrix.sanitizer }} -g" ./configure --enable-ucs4
        if: matrix.ucs == 'ucs4'
      - name: Make check
        run: ${{ matrix.options }} make check
      - name: Store the test suite log
        if: ${{ always() }} # store the test suite log even if the tests failed
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: test-suite-${{ matrix.ucs }}-${{ matrix.sanitizer }}.log
          path: tests/test-suite.log