@@ -101,7 +101,7 @@ jobs:
101101 continue-on-error : ${{ matrix.optional == true }}
102102 timeout-minutes : 240
103103 steps :
104- - uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
104+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
105105
106106 - name : Install deps (Ubuntu)
107107 if : startsWith(matrix.os, 'ubuntu')
@@ -183,6 +183,129 @@ jobs:
183183 # platform can surface a race the others miss. Windows has no TSan runtime on
184184 # any toolchain (documented irreducible gap); this shared-code coverage is
185185 # its substitute.
186+ # Memory-diagnostics lane (user decision 2026-08-03: runner cost accepted).
187+ # Newest pinned LLVM sanitizer runtime + straighter stacks over the full
188+ # parallel suite — catches what an older compiler-rt can miss. Same
189+ # canonical scripts/test.sh wave as every other leg.
190+ test-diag :
191+ runs-on : ubuntu-latest
192+ timeout-minutes : 120
193+ steps :
194+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
195+
196+ - name : Install deps
197+ run : sudo apt-get update && sudo apt-get install -y zlib1g-dev ccache
198+
199+ - name : Install LLVM 22 (pinned diagnostic toolchain)
200+ run : |
201+ wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc
202+ echo "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-22 main" | sudo tee /etc/apt/sources.list.d/llvm-22.list
203+ sudo apt-get update
204+ sudo apt-get install -y clang-22
205+
206+ name : Compiler cache (content-verified, restore)
207+ uses : actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
208+ with :
209+ path : ${{ github.workspace }}/.ccache
210+ key : ccache-diag-${{ github.ref }}-${{ github.sha }}
211+ restore-keys : |
212+ ccache-diag-${{ github.ref }}-
213+ ccache-diag-
214+
215+ # Also enables the ASan checks that are off by default in every other
216+ # lane: stack-use-after-return, stack-use-after-scope, and strict string
217+ # checks. Mirrors `make -f Makefile.cbm diag`, including its reasoning
218+ # for leaving detect_invalid_pointer_pairs out.
219+ - name : Test (clang-22, ASan+UBSan + off-by-default ASan checks)
220+ env :
221+ ASAN_OPTIONS : " detect_stack_use_after_return=1:strict_string_checks=1:detect_stack_use_after_scope=1"
222+ run : |
223+ scripts/test.sh CC=clang-22 CXX=clang++-22 \
224+ SANITIZE="-fsanitize=address,undefined -fno-omit-frame-pointer -fno-optimize-sibling-calls"
225+
226+ name : Compiler cache (save)
227+ if : always()
228+ uses : actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
229+ with :
230+ path : ${{ github.workspace }}/.ccache
231+ key : ccache-diag-${{ github.ref }}-${{ github.sha }}
232+
233+ # MemorySanitizer lane (stage 2). Uninitialized READS are the one
234+ # memory-error class no other lane covers dynamically. The image carries
235+ # MSan-instrumented libc++/libc++abi/libunwind + zlib (vendored C deps
236+ # instrument in-tree); scripts/msan.sh drives the build and the suite.
237+ #
238+ # THIS JOB IS THE AUTHORITATIVE VENUE for the lane. It previously ran WITHOUT
239+ # the script's default exclusions to settle whether those were an aarch64
240+ # artifact — the local ladder cannot answer that, having no faithful x86-64
241+ # emulation. It has now answered it, and the answer SPLIT the list:
242+ #
243+ # - the five deep-recursion suites overflow their thread stacks on x86-64
244+ # too, so that limit is NOT architectural;
245+ # - `cli` does not overflow here at all — it fails in the install path for
246+ # an unrelated, still-undiagnosed reason;
247+ # - `incremental` was a shadow-memory RSS artifact, now fixed in the test
248+ # itself rather than skipped, so it stays in the lane.
249+ #
250+ # Per-cause detail lives in scripts/msan.sh, which is the single authoritative
251+ # list both venues now share. Zero use-of-uninitialized-value findings were
252+ # reported across the lane on either architecture.
253+ test-msan :
254+ runs-on : ubuntu-latest
255+ timeout-minutes : 180
256+ steps :
257+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
258+
259+ - name : Buildx cache
260+ uses : actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
261+ with :
262+ path : /tmp/.buildx-msan
263+ key : buildx-msan-${{ hashFiles('test-infrastructure/Dockerfile.msan') }}
264+
265+ - name : Build MSan image (cached layers)
266+ run : scripts/ci/msan-lane.sh build
267+
268+ - name : MSan suite (exclusions per scripts/msan.sh)
269+ run : scripts/ci/msan-lane.sh run
270+
271+ # macOS leak coverage. LeakSanitizer runs by default under ASan on Linux, so
272+ # test-unix's ubuntu legs have always had it; on macOS it is off by default
273+ # and Apple's clang refuses to turn it on, which left an entire platform with
274+ # zero leak detection. Upstream (Homebrew) LLVM supports LSan on darwin/arm64,
275+ # so this leg is the ordinary ASan suite built with that toolchain and run
276+ # with detect_leaks=1. Mirrors the local `make -f Makefile.cbm test-lsan`.
277+ test-lsan-macos :
278+ runs-on : macos-latest
279+ timeout-minutes : 120
280+ steps :
281+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
282+
283+ - name : Install LSan-capable toolchain
284+ run : brew install llvm ccache
285+
286+ - name : Compiler cache (content-verified, restore)
287+ uses : actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
288+ with :
289+ path : ${{ github.workspace }}/.ccache
290+ key : ccache-lsan-${{ github.ref }}-${{ github.sha }}
291+ restore-keys : |
292+ ccache-lsan-${{ github.ref }}-
293+ ccache-lsan-
294+
295+ name : Test (Homebrew clang, ASan + LeakSanitizer)
296+ env :
297+ ASAN_OPTIONS : " detect_leaks=1:halt_on_error=1"
298+ run : |
299+ LLVM_PREFIX="$(brew --prefix llvm)"
300+ scripts/test.sh CC="$LLVM_PREFIX/bin/clang" CXX="$LLVM_PREFIX/bin/clang++"
301+
302+ name : Compiler cache (save)
303+ if : always()
304+ uses : actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
305+ with :
306+ path : ${{ github.workspace }}/.ccache
307+ key : ccache-lsan-${{ github.ref }}-${{ github.sha }}
308+
186309 test-tsan :
187310 strategy :
188311 fail-fast : false
@@ -194,7 +317,7 @@ jobs:
194317 runs-on : ${{ matrix.os }}
195318 timeout-minutes : 120
196319 steps :
197- - uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
320+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
198321
199322 - name : Install deps (Ubuntu)
200323 if : runner.os == 'Linux'
@@ -250,7 +373,7 @@ jobs:
250373 continue-on-error : ${{ matrix.optional == true }}
251374 timeout-minutes : 240
252375 steps :
253- - uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
376+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
254377
255378 # Defender posture: real-time protection is POLICY-LOCKED OFF on hosted
256379 # Windows images (verified 2026-07-27: WinDefend starts and
@@ -367,7 +490,7 @@ jobs:
367490 # The union proof lives in the canonical scripts/ci entry, not inline
368491 # YAML (venue-parity contract) — checkout (into repo/, so the manifest
369492 # download below stays untouched) provides the script.
370- - uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
493+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
371494 with :
372495 path : repo
373496
@@ -390,7 +513,7 @@ jobs:
390513 runs-on : windows-latest
391514 timeout-minutes : 60
392515 steps :
393- - uses : actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
516+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
394517
395518 - uses : msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
396519 with :
0 commit comments