Repository navigation
Merge pull request #179 from forefireAPI/fix/restore-genforefirecase #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 🧼 Sanitizers (Linux) | |
| # AddressSanitizer over both test paths: the unit suite, which constructs and | |
| # destroys every propagation and flux model one call at a time, and runff, | |
| # which runs a full simulation with a reload and NetCDF and KML output. | |
| # | |
| # This is a blocking check from the day it lands, which is only possible | |
| # because ForeFire reports zero ASan errors today — no use-after-free, no | |
| # overflow, no double free, on either path. There is no backlog to clear | |
| # first, and the point of turning it on now is to keep it that way. See #162. | |
| # | |
| # Leaks are a separate matter and are deliberately NOT blocking: nothing owns | |
| # a PropagationModel (#159), so ASan reports every one as leaked. Making that | |
| # fail the build would produce a permanently red job, which teaches everyone | |
| # to ignore it. The leak check runs anyway, as an informational step, so the | |
| # number stays visible and can be made blocking once #159 lands. | |
| # | |
| # A separate workflow rather than a job in main.yml because it needs its own | |
| # build: install-forefire.sh builds with -O3 -flto -fomit-frame-pointer, which | |
| # is the opposite of what a sanitizer wants. | |
| on: | |
| push: | |
| branches: | |
| - "master" | |
| - "dev" | |
| pull_request: | |
| branches: [ "master", "dev" ] | |
| workflow_dispatch: | |
| jobs: | |
| address-sanitizer: | |
| name: AddressSanitizer | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| lfs: true # runff reads data.nc, which is stored in LFS | |
| - name: Install Dependencies | |
| run: | | |
| sudo apt-get update -y | |
| sudo apt-get install -y --no-install-recommends \ | |
| build-essential cmake python3 python3-pip | |
| sudo apt-get install -y --no-install-recommends \ | |
| libnetcdf-dev libnetcdf-c++4-dev | |
| pip3 install --no-cache-dir --break-system-packages lxml xarray netCDF4 | |
| - name: Build with AddressSanitizer | |
| # FOREFIRE_SANITIZE also switches the compile flags to -g -O1 | |
| # -fno-omit-frame-pointer, so the stack traces are readable. | |
| run: | | |
| cmake -S . -B build-asan -DFOREFIRE_SANITIZE=address | |
| cmake --build build-asan -j"$(nproc)" | |
| # Errors are blocking. detect_leaks=0 is the whole reason this can be: | |
| # see the note at the top about #159. | |
| - name: Unit tests under ASan | |
| env: | |
| ASAN_OPTIONS: detect_leaks=0 | |
| run: ctest --test-dir build-asan --output-on-failure | |
| - name: runff under ASan | |
| env: | |
| ASAN_OPTIONS: detect_leaks=0 | |
| run: | | |
| cd tests/runff | |
| bash ff-run.bash | |
| # Informational only. Prints what is leaking so the figure stays visible | |
| # without gating the build on a known ownership gap. | |
| - name: Leak report (informational) | |
| continue-on-error: true | |
| env: | |
| ASAN_OPTIONS: detect_leaks=1 | |
| run: | | |
| echo "::group::Unit suite leaks" | |
| ctest --test-dir build-asan --output-on-failure || true | |
| echo "::endgroup::" |