Skip to content

Add sanitizers job #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bratpiorka wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add sanitizers job #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/lsan-suppressions.txt
View file
Open in desktop

@szymon-zadworny szymon-zadworny Oct 19, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I might be wrong on this but if the OpenCL runtime manages all allocations then all SYCL-related leaks will happen inside the runtime. If we suppress this then we won't get any leak reports caused by wrong runtime usage by the C++ shims/Rust bindings.

Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# Leaks reported inside the uninstrumented OpenCL CPU runtime
# leak:libOpenCL.so
# leak:libur_adapter_opencl.so
38 changes: 37 additions & 1 deletion .github/workflows/basic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,38 @@ jobs:
name: documentation
path: target/doc

sanitizers:
if: github.event_name != 'schedule'
runs-on: ["oneapi-rs", "Linux"]

steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Setup oneAPI
uses: ./.github/actions/setup-oneapi

- name: Install nightly toolchain
run: rustup toolchain install nightly --profile minimal

- name: Build and test with hardening flags
env:
RUSTFLAGS: -Zemit-stack-sizes -Zcf-protection=full
CARGO_TARGET_DIR: target/hardened
run: |
cargo +nightly test --workspace --verbose
cargo +nightly build --workspace --release --verbose

- name: Run tests with sanitizers
env:
# Test only CPU to avoid issues with GPU drivers and sanitizers
ONEAPI_DEVICE_SELECTOR: opencl:cpu
LSAN_OPTIONS: suppressions=${{ github.workspace }}/.github/lsan-suppressions.txt
run: |
for sanitizer in address leak thread; do
RUSTFLAGS="-Zsanitizer=$sanitizer" CARGO_TARGET_DIR="target/sanitizer-$sanitizer" \
cargo +nightly test --workspace --lib --tests --target x86_64-unknown-linux-gnu --verbose
done

trivy:
name: Trivy scan
runs-on: ubuntu-latest
Expand Down Expand Up @@ -149,7 +181,11 @@ jobs:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Audit dependencies against RustSec
run: cargo +stable audit --deny unsound --format sarif > cargo-audit.sarif
run: |
database_dir="$(mktemp -d "$RUNNER_TEMP/rustsec.XXXXXX")"
cargo +stable audit --deny unsound --format sarif \
--db "$database_dir/advisory-db" \
--url https://github.com/RustSec/advisory-db.git > cargo-audit.sarif

- name: Upload RustSec findings
# Upload the report even when the audit step fails on findings.
Expand Down
Loading