[Tarantool-patches] [PATCH luajit 2/2] ci: introduce testing workflow with sanitizers

[Igor Munkin]

This commit adds GitHub workflow running all available LuaJIT tests with
LUAJIT_USE_ASAN option enabled. For now, sanitizers workflow works only
for Linux/x86_64 as the most scaling setup in our CI. I believe we will
be able to add other platforms being supported, when ARM64 and macOS
runners starvation is defeated. There is also a separate GitHub Action
introduced for convenient setup of the environment.

Follows up tarantool/tarantool#5878

Signed-off-by: Igor Munkin <imun at tarantool.org>
---
 .github/actions/setup-sanitizers/README.md  | 12 ++++
 .github/actions/setup-sanitizers/action.yml | 24 +++++++
 .github/workflows/sanitizers-testing.yml    | 79 +++++++++++++++++++++
 3 files changed, 115 insertions(+)
 create mode 100644 .github/actions/setup-sanitizers/README.md
 create mode 100644 .github/actions/setup-sanitizers/action.yml
 create mode 100644 .github/workflows/sanitizers-testing.yml

diff --git a/.github/actions/setup-sanitizers/README.md b/.github/actions/setup-sanitizers/README.md
new file mode 100644
index 00000000..3aa9e214
--- /dev/null
+++ b/.github/actions/setup-sanitizers/README.md
@@ -0,0 +1,12 @@
+# Setup environment for sanitizers on Linux
+
+Action setups the environment on Linux runners (install requirements, setup the
+workflow environment, etc) for testing with sanitizers enabled.
+
+## How to use Github Action from Github workflow
+
+Add the following code to the running steps before LuaJIT configuration:
+```
+- uses: ./.github/actions/setup-sanitizers
+  if: ${{ matrix.OS == 'Linux' }}
+```
diff --git a/.github/actions/setup-sanitizers/action.yml b/.github/actions/setup-sanitizers/action.yml
new file mode 100644
index 00000000..ca6b6b9f
--- /dev/null
+++ b/.github/actions/setup-sanitizers/action.yml
@@ -0,0 +1,24 @@
+name: Setup CI environment for testing with sanitizers on Linux
+description: Common part to tweak Linux CI runner environment for sanitizers
+runs:
+  using: composite
+  steps:
+    - name: Setup CI environment
+      uses: ./.github/actions/setup
+    - name: Set CMAKE_BUILD_PARALLEL_LEVEL
+      run: |
+        # Set CMAKE_BUILD_PARALLEL_LEVEL environment variable to
+        # limit the number of parallel jobs for build/test step.
+        NPROC=$(nproc)
+        echo CMAKE_BUILD_PARALLEL_LEVEL=$(($NPROC + 1)) | tee -a $GITHUB_ENV
+      shell: bash
+    - name: Install build and test dependencies
+      run: |
+        apt -y update
+        apt -y install clang-11 cmake ninja-build make perl
+      shell: bash
+    - name: Set Clang as a default toolchain
+      run: |
+        echo CC=clang-11 | tee -a $GITHUB_ENV
+        echo CXX=clang++-11 | tee -a $GITHUB_ENV
+      shell: bash
diff --git a/.github/workflows/sanitizers-testing.yml b/.github/workflows/sanitizers-testing.yml
new file mode 100644
index 00000000..ab8e5dc7
--- /dev/null
+++ b/.github/workflows/sanitizers-testing.yml
@@ -0,0 +1,79 @@
+name: Sanitizers testing
+
+on:
+  push:
+    branches-ignore:
+      - '**-notest'
+      - 'upstream-**'
+    tags-ignore:
+      - '**'
+
+concurrency:
+  # An update of a developer branch cancels the previously
+  # scheduled workflow run for this branch. However, the default
+  # branch, and long-term branch (tarantool/release/2.11,
+  # tarantool/release/2.10, etc) workflow runs are never canceled.
+  #
+  # We use a trick here: define the concurrency group as 'workflow
+  # run ID' + # 'workflow run attempt' because it is a unique
+  # combination for any run. So it effectively discards grouping.
+  #
+  # XXX: we cannot use `github.sha` as a unique identifier because
+  # pushing a tag may cancel a run that works on a branch push
+  # event.
+  group: ${{ startsWith(github.ref, 'refs/heads/tarantool/')
+    && format('{0}-{1}', github.run_id, github.run_attempt)
+    || format('{0}-{1}', github.workflow, github.ref) }}
+  cancel-in-progress: true
+
+jobs:
+  test-asan:
+    strategy:
+      fail-fast: false
+      matrix:
+        # XXX: Let's start with only Linux/x86_64
+        BUILDTYPE: [Debug, Release]
+        GC64: [ON, OFF]
+        include:
+          - BUILDTYPE: Debug
+            CMAKEFLAGS: -DCMAKE_BUILD_TYPE=Debug -DLUA_USE_ASSERT=ON -DLUA_USE_APICHECK=ON
+          - BUILDTYPE: Release
+            CMAKEFLAGS: -DCMAKE_BUILD_TYPE=RelWithDebInfo
+    runs-on: [self-hosted, regular, Linux, x86_64]
+    name: >
+      LuaJIT with ASan (Linux/x86_64)
+      ${{ matrix.BUILDTYPE }}
+      GC64:${{ matrix.GC64 }}
+    steps:
+      - uses: actions/checkout at v3
+        with:
+          fetch-depth: 0
+          submodules: recursive
+      - name: setup Linux for sanitizers
+        uses: ./.github/actions/setup-sanitizers
+      - name: configure
+        run: >
+          cmake -S . -B ${{ env.BUILDDIR }}
+          -G Ninja
+          ${{ matrix.CMAKEFLAGS }}
+          -DLUAJIT_ENABLE_GC64=${{ matrix.GC64 }}
+          -DLUAJIT_USE_ASAN=ON
+      - name: build
+        run: cmake --build . --parallel
+        working-directory: ${{ env.BUILDDIR }}
+      - name: test
+        env:
+          # Enable as much checks as possible. See more info here:
+          # https://github.com/google/sanitizers/wiki/AddressSanitizerFlags
+          ASAN_OPTIONS: "                    \
+            detect_invalid_pointer_pairs=1:  \
+            detect_leaks=1:                  \
+            detect_stack_use_after_return=1: \
+            dump_instruction_bytes=1:        \
+            heap_profile=0:                  \
+            print_suppressions=0             \
+            symbolize=1:                     \
+            unmap_shadow_on_exit=1:          \
+          "
+        run: cmake --build . --parallel --target LuaJIT-test
+        working-directory: ${{ env.BUILDDIR }}
-- 
2.30.2