ci: verify tier-1 sanitizers on v1 tags

.github/workflows/tier1-sanitizers-tag.yml

@@ -0,0 +1,16 @@
+name: Tier-1 Sanitizers (tag)
+
+on:
+  push:
+    tags:
+      - 'v1.*'
+
+permissions:
+  contents: read
+
+jobs:
+  sanitizer-verification:
+    uses: ./.github/workflows/tier1-sanitizers.yml
+    with:
+      ref: ${{ github.ref_name }}
+      expected_sha: ${{ github.sha }}

.github/workflows/tier1-sanitizers.yml

@@ -0,0 +1,208 @@
+name: Tier-1 Sanitizers
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: Exact tag or commit to verify.
+        required: true
+        type: string
+      expected_sha:
+        description: Commit SHA that the caller resolved for ref.
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  asan-ubsan:
+    name: ASan/UBSan / ${{ matrix.os }} / ${{ matrix.compiler }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            compiler: gcc
+            cc: gcc
+          - os: ubuntu-latest
+            compiler: clang
+            cc: clang
+          - os: ubuntu-24.04-arm
+            compiler: gcc
+            cc: gcc
+          - os: macos-latest
+            compiler: apple-clang
+            cc: clang
+
+    steps:
+      - name: Checkout exact tag commit
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
+
+      - name: Verify checkout identity
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+        run: |
+          set -euo pipefail
+          actual_sha="$(git rev-parse HEAD)"
+          test "$actual_sha" = "$EXPECTED_SHA"
+          echo "verified $actual_sha"
+
+      - name: Install dependencies (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y meson ninja-build abigail-tools
+          if [ "${{ matrix.compiler }}" = "clang" ]; then
+            sudo apt-get install -y clang
+          fi
+
+      - name: Install dependencies (macOS)
+        if: runner.os == 'macOS'
+        run: brew install meson ninja
+
+      - name: Configure ASan/UBSan
+        run: >
+          meson setup builddir-san
+          -Db_sanitize=address,undefined
+          -Db_lundef=false
+          -Dtests=true
+          --buildtype=debug
+        env:
+          CC: ${{ matrix.cc }}
+
+      - name: Build ASan/UBSan
+        run: meson compile -C builddir-san
+
+      - name: Test ASan/UBSan
+        run: meson test -C builddir-san --print-errorlogs
+        env:
+          ASAN_OPTIONS: abort_on_error=1:halt_on_error=1:print_stacktrace=1
+          UBSAN_OPTIONS: abort_on_error=1:halt_on_error=1:print_stacktrace=1
+
+  tsan:
+    name: TSan / ${{ matrix.compiler }}
+    runs-on: ${{ matrix.runs_on }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - compiler: gcc
+            cc: gcc
+            runs_on: ubuntu-latest
+            platform: linux
+          - compiler: clang
+            cc: clang
+            runs_on: ubuntu-latest
+            platform: linux
+          - compiler: arm64-gcc
+            cc: gcc
+            runs_on: ubuntu-24.04-arm
+            platform: linux
+          - compiler: apple-clang
+            cc: clang
+            runs_on: macos-latest
+            platform: macos
+
+    steps:
+      - name: Checkout exact tag commit
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
+
+      - name: Verify checkout identity
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+        run: |
+          set -euo pipefail
+          actual_sha="$(git rev-parse HEAD)"
+          test "$actual_sha" = "$EXPECTED_SHA"
+          echo "verified $actual_sha"
+
+      - name: Install TSan dependencies
+        run: |
+          if [ "${{ matrix.platform }}" = "linux" ]; then
+            sudo apt-get update
+            sudo apt-get install -y meson ninja-build libmbedtls-dev
+            if [ "${{ matrix.compiler }}" = "clang" ]; then
+              sudo apt-get install -y clang
+            fi
+          else
+            brew install meson ninja mbedtls
+          fi
+
+      - name: Configure TSan
+        run: |
+          meson setup builddir-tsan \
+            -Db_sanitize=thread \
+            -Db_lundef=false \
+            -Dthreads=posix \
+            -Dtests=true \
+            --buildtype=debug
+        env:
+          CC: ${{ matrix.cc }}
+
+      - name: Build TSan
+        run: meson compile -C builddir-tsan
+
+      - name: Test TSan
+        run: meson test -C builddir-tsan --print-errorlogs
+        env:
+          TSAN_OPTIONS: halt_on_error=1:second_deadlock_stack=1
+
+  msan-fuzz:
+    name: MSan fuzz smoke / clang
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout exact tag commit
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 0
+
+      - name: Verify checkout identity
+        shell: bash
+        env:
+          EXPECTED_SHA: ${{ inputs.expected_sha }}
+        run: |
+          set -euo pipefail
+          actual_sha="$(git rev-parse HEAD)"
+          test "$actual_sha" = "$EXPECTED_SHA"
+          echo "verified $actual_sha"
+
+      - name: Install MSan fuzz dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang meson ninja-build
+
+      - name: Configure MSan fuzz build
+        env:
+          CC: clang
+        run: >
+          meson setup builddir-msan
+          -Denable_fuzz=true
+          -Db_sanitize=memory
+          -Db_lundef=false
+          -Dtests=true
+          --buildtype=debug
+
+      - name: Build MSan fuzz targets
+        run: |
+          meson compile -C builddir-msan \
+            parser_fuzz csv_reader_fuzz intern_fuzz compound_arena_fuzz
+
+      - name: Run MSan fuzz smoke tests
+        run: |
+          meson test -C builddir-msan \
+            parser_fuzz_smoke csv_reader_fuzz_smoke \
+            intern_fuzz_smoke compound_arena_fuzz_smoke \
+            --print-errorlogs
+        env:
+          MSAN_OPTIONS: abort_on_error=1:halt_on_error=1:print_stacktrace=1:exit_code=86

docs/RELEASE_PROCESS.md

@@ -206,8 +206,15 @@ When cutting a release tag:
    git tag -s vX.Y.Z -m "wirelog X.Y.Z"
    git push origin vX.Y.Z
    ```
-   The `release-tag.yml` workflow (#749 B19, when shipped) re-runs
-   the full CI matrix on the tagged commit and produces the
+   The [Tier-1 Sanitizers (tag) workflow](../.github/workflows/tier1-sanitizers-tag.yml)
+   re-runs the sanitizer matrix on the tagged commit. It verifies the
+   ASan/UBSan Linux GCC, Linux Clang, Linux ARM64 GCC, and macOS Apple
+   Clang legs plus the Linux GCC/Clang, Linux ARM64 GCC, and macOS Apple
+   Clang TSan legs and MSan
+   parser/CSV/intern/compound-arena fuzz smoke targets required by #693.
+   The `release-tag.yml` workflow (#749 B19,
+   when shipped) will call this reusable workflow as part of the full
+   tagged-commit gate and block artifact publication on failure. It also produces the
    verification artefacts (signed tarball, checksums, SBOM, ABI
    manifest, SLSA provenance attestation).
 5. **Author the GitHub Release**:

sbom/snapshot.txt

@@ -1,5 +1,6 @@
 ./.github/workflows/lint-main.yml@UNKNOWN:NOASSERTION
 ./.github/workflows/lint-pr.yml@UNKNOWN:NOASSERTION
+./.github/workflows/tier1-sanitizers.yml@UNKNOWN:NOASSERTION
 actions/cache@v4:NOASSERTION
 actions/cache@v5:NOASSERTION
 actions/cache@v5:NOASSERTION
@@ -18,6 +19,7 @@ actions/checkout@v5:NOASSERTION
 actions/checkout@v5:NOASSERTION
 actions/checkout@v5:NOASSERTION
 actions/checkout@v5:NOASSERTION
+actions/checkout@v5:NOASSERTION
 actions/checkout@v6:NOASSERTION
 actions/checkout@v6:NOASSERTION
 actions/checkout@v6:NOASSERTION