Repository navigation
137 lines (132 loc) · 4.5 KB
/
Copy pathreusable-san.yml
File metadata and controls
137 lines (132 loc) · 4.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: Reusable Sanitizer
on:
workflow_call:
inputs:
sanitizer:
required: true
type: string
free-threading:
description: Whether to use free-threaded mode
required: false
type: boolean
default: false
permissions:
contents: read
env:
FORCE_COLOR: 1
OPENSSL_VER: 3.5.9
jobs:
build-san-reusable:
name: >-
${{ inputs.sanitizer }}${{
inputs.free-threading
&& ' (free-threading)'
|| ''
}}
runs-on: ubuntu-26.04
timeout-minutes: 60
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
persist-credentials: false
- name: Runner image version
run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
- name: Install dependencies
run: |
sudo ./.github/workflows/posix-deps-apt.sh
# On ubuntu-26.04 image, clang is clang-21 by default
# NOTE: when bumping to a new version of clang,
# please update the versions in `Tools/pixi-packages/variants.yaml` too.
echo "CC=clang" >> "$GITHUB_ENV"
echo "CXX=clang++" >> "$GITHUB_ENV"
- name: TSan option setup
if: inputs.sanitizer == 'TSan'
run: |
sudo sysctl -w vm.mmap_rnd_bits=28 # Reduce ASLR to avoid TSan crashing
echo "MULTISSL_DIR=${GITHUB_WORKSPACE}/multissl" >> "$GITHUB_ENV"
echo "OPENSSL_DIR=${GITHUB_WORKSPACE}/multissl/openssl/${OPENSSL_VER}" >> "$GITHUB_ENV"
echo "TSAN_OPTIONS=${SAN_LOG_OPTION} suppressions=${GITHUB_WORKSPACE}/Tools/tsan/suppressions${SUPPRESSIONS_SUFFIX}.txt handle_segv=0" >> "$GITHUB_ENV"
env:
SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
SUPPRESSIONS_SUFFIX: >-
${{
inputs.free-threading
&& '_free_threading'
|| ''
}}
- name: UBSan option setup
if: inputs.sanitizer != 'TSan'
run: >-
echo
"UBSAN_OPTIONS=${SAN_LOG_OPTION}
halt_on_error=1
suppressions=${GITHUB_WORKSPACE}/Tools/ubsan/suppressions.txt"
>> "$GITHUB_ENV"
env:
SAN_LOG_OPTION: log_path=${{ github.workspace }}/san_log
- name: Add ccache to PATH
run: |
echo "PATH=/usr/lib/ccache:$PATH" >> "$GITHUB_ENV"
- name: 'Restore OpenSSL build (TSan)'
id: cache-openssl
if: inputs.sanitizer == 'TSan'
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: ./multissl/openssl/${{ env.OPENSSL_VER }}
key: ${{ env.IMAGE_OS_VERSION }}-multissl-openssl-tsan-${{ env.OPENSSL_VER }}
- name: Install OpenSSL (TSan)
if: >-
inputs.sanitizer == 'TSan'
&& steps.cache-openssl.outputs.cache-hit != 'true'
run: >-
python3 Tools/ssl/multissltests.py
--steps=library
--base-directory="${MULTISSL_DIR}"
--openssl="${OPENSSL_VER}"
--system=Linux
--tsan
# gh-157958: -O2 instead of the pydebug default -Og to avoid a clang 21
# compile-time blowup on some interpreter files.
# (https://github.com/llvm/llvm-project/issues/179695)
- name: Configure CPython
run: >-
./configure
--config-cache
OPT="-O2 -g"
${{
inputs.sanitizer == 'TSan'
&& '--with-thread-sanitizer'
|| '--with-undefined-behavior-sanitizer --with-strict-overflow'
}}
--with-pydebug
${{ inputs.sanitizer == 'TSan' && '--with-openssl="$OPENSSL_DIR" --with-openssl-rpath=auto' || '' }}
${{ inputs.free-threading && '--disable-gil' || '' }}
- name: Build CPython
run: make -j4
- name: Display build info
run: make pythoninfo
- name: Tests
run: >-
./python -m test
${{ inputs.sanitizer == 'TSan' && '--tsan' || '' }}
-j4 -W --timeout=900 --slowest
- name: Parallel tests
if: >-
inputs.sanitizer == 'TSan'
&& inputs.free-threading
run: ./python -m test --tsan-parallel --parallel-threads=4 -j4 -W --timeout=600 --slowest
- name: Display logs
if: always()
run: find "${GITHUB_WORKSPACE}" -name 'san_log.*' | xargs head -n 1000
- name: Archive logs
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: >-
${{ inputs.sanitizer }}-logs-${{
inputs.free-threading
&& 'free-threading'
|| 'default'
}}
path: san_log.*
if-no-files-found: ignore