diff --git a/.github/workflows/tier1-sanitizers-tag.yml b/.github/workflows/tier1-sanitizers-tag.yml new file mode 100644 index 00000000..283975df --- /dev/null +++ b/.github/workflows/tier1-sanitizers-tag.yml @@ -0,0 +1,16 @@ +name: Tier-1 Sanitizers (tag) + +on: + push: + tags: + - 'v1.*' + +permissions: + contents: read + +jobs: + sanitizer-verification: + uses: ./.github/workflows/tier1-sanitizers.yml + with: + ref: ${{ github.ref_name }} + expected_sha: ${{ github.sha }} diff --git a/.github/workflows/tier1-sanitizers.yml b/.github/workflows/tier1-sanitizers.yml new file mode 100644 index 00000000..d42d4b44 --- /dev/null +++ b/.github/workflows/tier1-sanitizers.yml @@ -0,0 +1,208 @@ +name: Tier-1 Sanitizers + +on: + workflow_call: + inputs: + ref: + description: Exact tag or commit to verify. + required: true + type: string + expected_sha: + description: Commit SHA that the caller resolved for ref. + required: true + type: string + +permissions: + contents: read + +jobs: + asan-ubsan: + name: ASan/UBSan / ${{ matrix.os }} / ${{ matrix.compiler }} + runs-on: ${{ matrix.os }} + strategy: + fail-fast: false + matrix: + include: + - os: ubuntu-latest + compiler: gcc + cc: gcc + - os: ubuntu-latest + compiler: clang + cc: clang + - os: ubuntu-24.04-arm + compiler: gcc + cc: gcc + - os: macos-latest + compiler: apple-clang + cc: clang + + steps: + - name: Checkout exact tag commit + uses: actions/checkout@v5 + with: + ref: ${{ inputs.ref }} + fetch-depth: 0 + + - name: Verify checkout identity + shell: bash + env: + EXPECTED_SHA: ${{ inputs.expected_sha }} + run: | + set -euo pipefail + actual_sha="$(git rev-parse HEAD)" + test "$actual_sha" = "$EXPECTED_SHA" + echo "verified $actual_sha" + + - name: Install dependencies (Linux) + if: runner.os == 'Linux' + run: | + sudo apt-get update + sudo apt-get install -y meson ninja-build abigail-tools + if [ "${{ matrix.compiler }}" = "clang" ]; then + sudo apt-get install -y clang + fi + + - name: Install dependencies (macOS) + if: runner.os == 'macOS' + run: brew install meson ninja + + - name: Configure ASan/UBSan + run: > + meson setup builddir-san + -Db_sanitize=address,undefined + -Db_lundef=false + -Dtests=true + --buildtype=debug + env: + CC: ${{ matrix.cc }} + + - name: Build ASan/UBSan + run: meson compile -C builddir-san + + - name: Test ASan/UBSan + run: meson test -C builddir-san --print-errorlogs + env: + ASAN_OPTIONS: abort_on_error=1:halt_on_error=1:print_stacktrace=1 + UBSAN_OPTIONS: abort_on_error=1:halt_on_error=1:print_stacktrace=1 + + tsan: + name: TSan / ${{ matrix.compiler }} + runs-on: ${{ matrix.runs_on }} + strategy: + fail-fast: false + matrix: + include: + - compiler: gcc + cc: gcc + runs_on: ubuntu-latest + platform: linux + - compiler: clang + cc: clang + runs_on: ubuntu-latest + platform: linux + - compiler: arm64-gcc + cc: gcc + runs_on: ubuntu-24.04-arm + platform: linux + - compiler: apple-clang + cc: clang + runs_on: macos-latest + platform: macos + + steps: + - name: Checkout exact tag commit + uses: actions/checkout@v5 + with: + ref: ${{ inputs.ref }} + fetch-depth: 0 + + - name: Verify checkout identity + shell: bash + env: + EXPECTED_SHA: ${{ inputs.expected_sha }} + run: | + set -euo pipefail + actual_sha="$(git rev-parse HEAD)" + test "$actual_sha" = "$EXPECTED_SHA" + echo "verified $actual_sha" + + - name: Install TSan dependencies + run: | + if [ "${{ matrix.platform }}" = "linux" ]; then + sudo apt-get update + sudo apt-get install -y meson ninja-build libmbedtls-dev + if [ "${{ matrix.compiler }}" = "clang" ]; then + sudo apt-get install -y clang + fi + else + brew install meson ninja mbedtls + fi + + - name: Configure TSan + run: | + meson setup builddir-tsan \ + -Db_sanitize=thread \ + -Db_lundef=false \ + -Dthreads=posix \ + -Dtests=true \ + --buildtype=debug + env: + CC: ${{ matrix.cc }} + + - name: Build TSan + run: meson compile -C builddir-tsan + + - name: Test TSan + run: meson test -C builddir-tsan --print-errorlogs + env: + TSAN_OPTIONS: halt_on_error=1:second_deadlock_stack=1 + + msan-fuzz: + name: MSan fuzz smoke / clang + runs-on: ubuntu-latest + steps: + - name: Checkout exact tag commit + uses: actions/checkout@v5 + with: + ref: ${{ inputs.ref }} + fetch-depth: 0 + + - name: Verify checkout identity + shell: bash + env: + EXPECTED_SHA: ${{ inputs.expected_sha }} + run: | + set -euo pipefail + actual_sha="$(git rev-parse HEAD)" + test "$actual_sha" = "$EXPECTED_SHA" + echo "verified $actual_sha" + + - name: Install MSan fuzz dependencies + run: | + sudo apt-get update + sudo apt-get install -y clang meson ninja-build + + - name: Configure MSan fuzz build + env: + CC: clang + run: > + meson setup builddir-msan + -Denable_fuzz=true + -Db_sanitize=memory + -Db_lundef=false + -Dtests=true + --buildtype=debug + + - name: Build MSan fuzz targets + run: | + meson compile -C builddir-msan \ + parser_fuzz csv_reader_fuzz intern_fuzz compound_arena_fuzz + + - name: Run MSan fuzz smoke tests + run: | + meson test -C builddir-msan \ + parser_fuzz_smoke csv_reader_fuzz_smoke \ + intern_fuzz_smoke compound_arena_fuzz_smoke \ + --print-errorlogs + env: + MSAN_OPTIONS: abort_on_error=1:halt_on_error=1:print_stacktrace=1:exit_code=86 diff --git a/docs/RELEASE_PROCESS.md b/docs/RELEASE_PROCESS.md index 09ddf90c..f044371c 100644 --- a/docs/RELEASE_PROCESS.md +++ b/docs/RELEASE_PROCESS.md @@ -206,8 +206,15 @@ When cutting a release tag: git tag -s vX.Y.Z -m "wirelog X.Y.Z" git push origin vX.Y.Z ``` - The `release-tag.yml` workflow (#749 B19, when shipped) re-runs - the full CI matrix on the tagged commit and produces the + The [Tier-1 Sanitizers (tag) workflow](../.github/workflows/tier1-sanitizers-tag.yml) + re-runs the sanitizer matrix on the tagged commit. It verifies the + ASan/UBSan Linux GCC, Linux Clang, Linux ARM64 GCC, and macOS Apple + Clang legs plus the Linux GCC/Clang, Linux ARM64 GCC, and macOS Apple + Clang TSan legs and MSan + parser/CSV/intern/compound-arena fuzz smoke targets required by #693. + The `release-tag.yml` workflow (#749 B19, + when shipped) will call this reusable workflow as part of the full + tagged-commit gate and block artifact publication on failure. It also produces the verification artefacts (signed tarball, checksums, SBOM, ABI manifest, SLSA provenance attestation). 5. **Author the GitHub Release**: diff --git a/sbom/snapshot.txt b/sbom/snapshot.txt index 6a3ef4f6..73429d05 100644 --- a/sbom/snapshot.txt +++ b/sbom/snapshot.txt @@ -1,5 +1,6 @@ ./.github/workflows/lint-main.yml@UNKNOWN:NOASSERTION ./.github/workflows/lint-pr.yml@UNKNOWN:NOASSERTION +./.github/workflows/tier1-sanitizers.yml@UNKNOWN:NOASSERTION actions/cache@v4:NOASSERTION actions/cache@v5:NOASSERTION actions/cache@v5:NOASSERTION @@ -18,6 +19,7 @@ actions/checkout@v5:NOASSERTION actions/checkout@v5:NOASSERTION actions/checkout@v5:NOASSERTION actions/checkout@v5:NOASSERTION +actions/checkout@v5:NOASSERTION actions/checkout@v6:NOASSERTION actions/checkout@v6:NOASSERTION actions/checkout@v6:NOASSERTION