ci: add C++ ASan+TSan gate on every PR; document test strategy#539

Merged

jbachorik merged 38 commits into

mainfrom

jb/ci-sanitizer-split

May 26, 2026

Commits on May 24, 2026

fix(build): fix ASan/TSan runtime linking for clang

jbachorik
and
claude
committed
test: make C++ unit tests TSan-compatible

jbachorik
and
claude
committed
ci: add C++ ASan+TSan gate via GitLab

jbachorik
and
claude
committed
docs: add testing strategy guide

jbachorik
and
claude
committed
ci(sanitizer): move to build stage, drop prepare:start dependency

jbachorik
and
claude
committed
docs: update TestingGuide for GitLab migration of C++ sanitizer tests

jbachorik
and
claude
committed
ci: gate build-artifact on sanitizer tests

jbachorik
and
claude
committed
ci: dedicated sanitizer stage before build

jbachorik
and
claude
committed
ci(sanitizer): start immediately with needs: []

jbachorik
and
claude
committed
ci(sanitizer): add Gradle cache and sysctl vm.mmap_rnd_bits

jbachorik
and
claude
committed
build: remove log_path from ASAN_OPTIONS and UBSAN_OPTIONS

jbachorik
and
claude
committed
ci(sanitizer): use push+pull Gradle cache

jbachorik
and
claude
committed
build: route gtest output to stdout; increase Gradle download retries

jbachorik
and
claude
committed
build: write gtest output to /dev/stdout and /dev/stderr

jbachorik
and
claude
committed
build: explain Gradle output discard; flush /dev/std* streams after run

jbachorik
and
claude
committed
ci(sanitizer): use setarch -R instead of sysctl for ASLR

jbachorik
and
claude
committed
build: add buildGtest{Config} task for compile+link without run

jbachorik
and
claude
committed
ci(sanitizer): build via Gradle, run binaries directly from shell

jbachorik
and
claude
committed
ci(sanitizer): fix Gradle cache miss — set GRADLE_USER_HOME=.gradle

jbachorik
and
claude
committed
ci(sanitizer): remove setarch from Gradle build step

jbachorik
and
claude
committed
ci(sanitizer): add --parallel --build-cache to Gradle build step

jbachorik
and
claude
committed
build: compile gtest library sources once per config (shared objects)

jbachorik
and
claude
committed
build(gtest): simplify review fixes

jbachorik
and
claude
committed
ci(sanitizer): restore TSan with allow_failure; add llvm-symbolizer

jbachorik
and
claude
committed
ci(tsan): run inside docker --privileged to allow sysctl

jbachorik
and
claude
committed
ci(tsan): revert to setarch fallback; document infra requirement

jbachorik
and
claude
committed
ci(tsan): use docker-in-docker tags for proper runner access

jbachorik
and
claude
committed
ci(tsan): set GTEST_DEATH_TEST_STYLE=threadsafe for TSan runs

jbachorik
and
claude
committed
ci(tsan-amd64): use one-shot privileged container for sysctl only

jbachorik
and
claude
committed
ci(tsan-amd64): use BUILD_IMAGE_X64 for sysctl, not alpine

jbachorik
and
claude
committed
ci(tsan-amd64): use direct sysctl on kata-qemu micro VM

jbachorik
and
claude
committed
ci(tsan): fix amd64 sysctl path; add arm64 diagnostics

jbachorik
and
claude
committed
ci(tsan-amd64): add diagnostics — clang version, kernel, TSan probe

jbachorik
and
claude
committed
ci(tsan-amd64): install LLVM 18 — LLVM 11 crashes on kernel 6.8

jbachorik
and
claude
committed
ci(tsan): fix arm64 regression; simplify amd64

jbachorik
and
claude
committed

Commits on May 26, 2026