Add USAN/ASAN pipeline

NIEHS · Dec 28, 2023 · e530819 · e530819
1 parent 4822fbc
commit e530819
Show file tree

Hide file tree

Showing 2 changed files with 170 additions and 30 deletions.
diff --git a/.github/sanitizers.yaml b/.github/sanitizers.yaml
diff --git a/.github/workflows/sanitizers.yaml b/.github/workflows/sanitizers.yaml
@@ -0,0 +1,170 @@
+name: UBSAN/ASAN Checks
+
+on:
+  pull_request:
+    branches: [ "main" ]
+  push:
+    branches: [ "build-workflow" ]
+  workflow_dispatch: 
+
+
+permissions:
+  contents: read
+
+jobs:
+  sanitizer-check-asan:
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+      CXX: clang++
+      CXXFLAGS: "-fsanitize=address"
+      LINK: clang++
+      ASAN: true
+      UBSAN: true
+      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+      RSPM: https://packagemanager.rstudio.com/cran/__linux__/jammy/latest
+      R_REMOTES_NO_ERRORS_FROM_WARNINGS: true
+      ## R CMD check
+      _R_CHECK_CRAN_INCOMING_: false
+      _R_CHECK_LENGTH_1_CONDITION_: true
+      _R_CHECK_LENGTH_1_LOGIC2_: true
+      _R_CHECK_MATRIX_DATA_: true
+      ## Specific to package
+      _R_CHECK_USE_VALGRIND_: true
+      UBSAN_OPTIONS: "print_stacktrace=1"
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Clang
+        uses: egor-tensin/setup-clang@v1
+        with:
+            version: latest
+            platform: x64
+      - uses: r-lib/actions/setup-pandoc@v2
+
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          r-version: release
+
+      - name: Query dependencies
+        run: |
+          install.packages('remotes')
+          saveRDS(remotes::dev_package_deps(dependencies = TRUE), ".github/depends.Rds", version = 2)
+          writeLines(sprintf("R-%i.%i", getRversion()$major, getRversion()$minor), ".github/R-version")
+        shell: Rscript {0}
+
+      - name: Cache R packages
+        uses: actions/cache@v3
+        with:
+          path: ${{ env.R_LIBS_USER }}
+          key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
+          restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
+
+      - name: Install system dependencies
+        env:
+          RHUB_PLATFORM: linux-x86_64-ubuntu-gcc
+        run: |
+          Rscript -e "remotes::install_github('r-hub/sysreqs')"
+          sysreqs=$(Rscript -e "cat(sysreqs::sysreq_commands('DESCRIPTION'))")
+          sudo -s eval "$sysreqs"
+
+      - name: Install dependencies
+        run: |
+          remotes::install_deps(dependencies = TRUE)
+          remotes::install_cran("rcmdcheck")
+        shell: Rscript {0}
+
+      - name: Session info
+        run: |
+          options(width = 100)
+          pkgs <- installed.packages()[, "Package"]
+          sessioninfo::session_info(pkgs, include_base = TRUE)
+        shell: Rscript {0}
+
+      - name: Check with ASAN
+        run: rcmdcheck::rcmdcheck(build_args = "--no-build-vignettes", args = c("--no-codoc", "--no-examples", "--no-manual", "--ignore-vignettes"), error_on = "warning", check_dir = "check")
+        shell: Rscript {0}
+
+      - name: Upload check results
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ runner.os }}-asan-rrelease-results
+          path: check
+  sanitizer-check-usan:
+    runs-on: ubuntu-latest
+    env:
+      CC: clang
+      CXX: clang++
+      CXXFLAGS: "-fsanitize=undefined"
+      LINK: clang++
+      ASAN: true
+      UBSAN: true
+      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+      RSPM: https://packagemanager.rstudio.com/cran/__linux__/jammy/latest
+      R_REMOTES_NO_ERRORS_FROM_WARNINGS: true
+      ## R CMD check
+      _R_CHECK_CRAN_INCOMING_: false
+      _R_CHECK_LENGTH_1_CONDITION_: true
+      _R_CHECK_LENGTH_1_LOGIC2_: true
+      _R_CHECK_MATRIX_DATA_: true
+      ## Specific to package
+      _R_CHECK_USE_VALGRIND_: true
+      UBSAN_OPTIONS: "print_stacktrace=1"
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Clang
+        uses: egor-tensin/setup-clang@v1
+        with:
+            version: latest
+            platform: x64
+      - uses: r-lib/actions/setup-pandoc@v2
+
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          r-version: release
+
+      - name: Query dependencies
+        run: |
+          install.packages('remotes')
+          saveRDS(remotes::dev_package_deps(dependencies = TRUE), ".github/depends.Rds", version = 2)
+          writeLines(sprintf("R-%i.%i", getRversion()$major, getRversion()$minor), ".github/R-version")
+        shell: Rscript {0}
+
+      - name: Cache R packages
+        uses: actions/cache@v3
+        with:
+          path: ${{ env.R_LIBS_USER }}
+          key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
+          restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
+
+      - name: Install system dependencies
+        env:
+          RHUB_PLATFORM: linux-x86_64-ubuntu-gcc
+        run: |
+          Rscript -e "remotes::install_github('r-hub/sysreqs')"
+          sysreqs=$(Rscript -e "cat(sysreqs::sysreq_commands('DESCRIPTION'))")
+          sudo -s eval "$sysreqs"
+
+      - name: Install dependencies
+        run: |
+          remotes::install_deps(dependencies = TRUE)
+          remotes::install_cran("rcmdcheck")
+        shell: Rscript {0}
+
+      - name: Session info
+        run: |
+          options(width = 100)
+          pkgs <- installed.packages()[, "Package"]
+          sessioninfo::session_info(pkgs, include_base = TRUE)
+        shell: Rscript {0}
+
+      - name: Check with UBSAN
+        run: rcmdcheck::rcmdcheck(build_args = "--no-build-vignettes", args = c("--no-codoc", "--no-examples", "--no-manual", "--ignore-vignettes"), error_on = "warning", check_dir = "check")
+        shell: Rscript {0}
+
+      - name: Upload check results
+        if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: ${{ runner.os }}-ubsan-rrelease-results
+          path: check