ci-unix-static-sanitized.yml

name: CI Unix Static Sanitized
on:
  push:
  pull_request:
    paths:
      - ".github/workflows/ci-unix-static-sanitized.yml"
      - "**CMakeLists.txt"
      - "cmake/**"
      - "ext/**"

permissions:
  contents: read

jobs:
  build-static-sanitized:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
        sanitizer: [address, memory, thread, undefined]
        exclude:
          - os: macos-latest
            sanitizer: memory

    env:
      CC: clang
      CXX: clang++

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup-linux
        if: runner.os == 'Linux'
        id: setup_linux
        with:
          codec-aom: "LOCAL"
          codec-dav1d: "LOCAL"
          libyuv: "LOCAL"
          extra-cache-key: ${{ matrix.sanitizer }}
      - uses: ./.github/actions/setup-macos
        if: runner.os == 'macOS'
        id: setup_macos
        with:
          codec-aom: "LOCAL"
          codec-dav1d: "LOCAL"
          extra-cache-key: ${{ matrix.sanitizer }}
      - id: cache-hit
        run: echo "hit=${{ (runner.os == 'Linux' && steps.setup_linux.outputs.ext-cache-hit == 'true') || (runner.os == 'macOS' && steps.setup_macos.outputs.ext-cache-hit == 'true') }}" >> "$GITHUB_OUTPUT"

      - name: Build cxx and cxxabi
        if: ${{ matrix.sanitizer == 'memory' }}
        run: |
          # clone LLVM
          git clone --depth=1 --branch llvmorg-19.1.5  https://github.com/llvm/llvm-project
          # configure cmake
          cmake -G Ninja -S llvm-project/runtimes -B llvm-project/msan_out \
                  -DCMAKE_BUILD_TYPE=Release \
                  -DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi;libunwind" \
                  -DCMAKE_C_COMPILER=clang \
                  -DCMAKE_CXX_COMPILER=clang++ \
                  -DLLVM_USE_SANITIZER=MemoryWithOrigins
          # build the libraries
          cmake --build llvm-project/msan_out -- cxx cxxabi unwind
      - name: Set FLAGS for memory sanitizer
        if: ${{ matrix.sanitizer == 'memory' }}
        run: |
          echo "CI_CFLAGS=-fsanitize=memory -L${{ github.workspace }}/llvm-project/msan_out/lib -I${{ github.workspace }}/llvm-project/msan_out/include"  >> $GITHUB_ENV
          echo "CI_CXXFLAGS=-fsanitize=memory -stdlib=libc++ -L${{ github.workspace }}/llvm-project/msan_out/lib -I${{ github.workspace }}/llvm-project/msan_out/include -I${{ github.workspace }}/llvm-project/msan_out/include/c++/v1"  >> $GITHUB_ENV
          echo "CI_LDLAGS=-fsanitize=memory -L${{ github.workspace }}/llvm-project/msan_out/lib -lc++abi"  >> $GITHUB_ENV
          echo "CI_LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${{ github.workspace }}/llvm-project/msan_out/lib" >> $GITHUB_ENV
      - name: Set FLAGS for other sanitizers
        if: ${{ matrix.sanitizer != 'memory' }}
        run: |
          echo "CI_CFLAGS=-fsanitize=${{ matrix.sanitizer }}"  >> $GITHUB_ENV
          echo "CI_CXXFLAGS=-fsanitize=${{ matrix.sanitizer }}"  >> $GITHUB_ENV
          echo "CI_LDFLAGS=-fsanitize=${{ matrix.sanitizer }}"  >> $GITHUB_ENV
          echo "CI_LD_LIBRARY_PATH=$LD_LIBRARY_PATH" >> $GITHUB_ENV
      - name: Build libsharpyuv
        if: ${{ steps.cache-hit.outputs.hit == 'false' }}
        working-directory: ./ext
        run: ./libsharpyuv.cmd
        env:
          CFLAGS: ${{ env.CI_CFLAGS }}
          CXXFLAGS: ${{ env.CI_CXXFLAGS }}
          LDFLAGS: ${{ env.CI_LDFLAGS }}
      - name: Build GoogleTest
        if: ${{ steps.cache-hit.outputs.hit == 'false' }}
        working-directory: ./ext
        # Note: "apt install googletest" is sometimes insufficient for find_package(GTest) so build in ext/ instead.
        run: bash -e googletest.cmd
        env:
          CFLAGS: ${{ env.CI_CFLAGS }}
          CXXFLAGS: ${{ env.CI_CXXFLAGS }}
          LDFLAGS: ${{ env.CI_LDFLAGS }}

      - name: Prepare libavif (cmake)
        run: >
          cmake -S . -B build -G Ninja
          -DCMAKE_BUILD_TYPE=Debug -DBUILD_SHARED_LIBS=OFF
          -DAVIF_CODEC_AOM=LOCAL -DAVIF_CODEC_DAV1D=LOCAL
          -DAVIF_LIBYUV=LOCAL -DAVIF_LIBSHARPYUV=LOCAL
          -DAVIF_BUILD_EXAMPLES=ON -DAVIF_BUILD_APPS=ON
          -DAVIF_BUILD_TESTS=ON -DAVIF_ENABLE_GTEST=ON -DAVIF_GTEST=LOCAL
        env:
          CFLAGS: ${{ env.CI_CFLAGS }}
          CXXFLAGS: ${{ env.CI_CXXFLAGS }}
          LDFLAGS: ${{ env.CI_LDFLAGS }}
      - name: Build libavif (ninja)
        working-directory: ./build
        run: ninja
      - name: Run AVIF Tests
        working-directory: ./build
        run: ctest -j $(getconf _NPROCESSORS_ONLN) --output-on-failure
        env:
          ASAN_OPTIONS: allocator_may_return_null=1
          TSAN_OPTIONS: allocator_may_return_null=1
          LD_LIBRARY_PATH: ${{ env.CI_LD_LIBRARY_PATH }}