.github/workflows/reusable-san.yml

name: Reusable Sanitizer

on:
  workflow_call:
    inputs:
      sanitizer:
        required: true
        type: string
      free-threading:
        description: Whether to use free-threaded mode
        required: false
        type: boolean
        default: false

permissions:
  contents: read

env:
  FORCE_COLOR: 1
  OPENSSL_VER: 3.5.8

jobs:
  build-san-reusable:
    name: >-
      ${{ inputs.sanitizer }}${{
        inputs.free-threading
        && ' (free-threading)'
        || ''
      }}
    runs-on: ubuntu-26.04
    timeout-minutes: 60
    steps:
    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false
    - name: Runner image version
      run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
    - name: Install dependencies
      run: |
        sudo ./.github/workflows/posix-deps-apt.sh
        # On ubuntu-26.04 image, clang is clang-21 by default
        # NOTE: when bumping to a new version of clang,
        # please update the versions in `Tools/pixi-packages/variants.yaml` too.
        echo "CC=clang" >> "$GITHUB_ENV"
        echo "CXX=clang++" >> "$GITHUB_ENV"
    - name: TSan option setup
      if: inputs.sanitizer == 'TSan'
      run: |
        sudo sysctl -w vm.mmap_rnd_bits=28  # Reduce ASLR to avoid TSan crashing

        echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
        echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
        echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${SUPPRESSIONS_SUFFIX}.txt handle_segv=0" >> "$GITHUB_ENV"
      env:
        SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
        SUPPRESSIONS_SUFFIX: >-
          ${{
            inputs.free-threading
            && '_free_threading'
            || ''
          }}
    - name: UBSan option setup
      if: inputs.sanitizer != 'TSan'
      run: >-
        echo
        "UBSAN_OPTIONS=${SAN_LOG_OPTION}
        halt_on_error=1
        suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt"
        >> "$GITHUB_ENV"
      env:
        SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
    - name: Add ccache to PATH
      run: |
        echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
    - name: 'Restore OpenSSL build (TSan)'
      id: cache-openssl
      if: inputs.sanitizer == 'TSan'
      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
      with:
        path: ./multissl/openssl/${{ env.OPENSSL_VER }}
        key: ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
    - name: Install OpenSSL (TSan)
      if: >-
        inputs.sanitizer == 'TSan'
        && steps.cache-openssl.outputs.cache-hit != 'true'
      run: >-
        python3 Tools/ssl/multissltests.py
        --steps=library
        --base-directory="${MULTISSL_DIR}"
        --openssl="${OPENSSL_VER}"
        --system=Linux
        --tsan
    - name: Configure CPython
      run: >-
        ./configure
        --config-cache
        ${{
          inputs.sanitizer == 'TSan'
          && '--with-thread-sanitizer'
          || '--with-undefined-behavior-sanitizer --with-strict-overflow'
        }}
        --with-pydebug
        ${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
        ${{ inputs.free-threading && '--disable-gil' || '' }}
    - name: Build CPython
      run: make -j4
    - name: Display build info
      run: make pythoninfo
    - name: Tests
      run: >-
        ./python -m test
        ${{ inputs.sanitizer == 'TSan' && '--tsan' || '' }}
        -j4 -W --timeout=900 --slowest
    - name: Parallel tests
      if: >-
        inputs.sanitizer == 'TSan'
        && inputs.free-threading
      run: ./python -m test --tsan-parallel --parallel-threads=4 -j4 -W --timeout=600 --slowest
    - name: Display logs
      if: always()
      run: find "${GITHUB_WORKSPACE}" -name 'san_log.*' | xargs head -n 1000
    - name: Archive logs
      if: always()
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
      with:
        name: >-
          ${{ inputs.sanitizer }}-logs-${{
            inputs.free-threading
            && 'free-threading'
            || 'default'
          }}
        path: san_log.*
        if-no-files-found: ignore