Sanitizers #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: Copyright The Zephyr Project Contributors | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # Sanitizer run on native_sim, reported to the Security dashboard. | |
| # | |
| name: Sanitizers | |
| on: | |
| schedule: | |
| # Run at 06:00 UTC on every day. | |
| - cron: '0 6 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| sanitize: | |
| name: Run under ${{ matrix.name }} | |
| if: github.repository_owner == 'zephyrproject-rtos' | |
| runs-on: | |
| group: zephyr-runner-v2-linux-x64-4xlarge | |
| container: | |
| image: ghcr.io/zephyrproject-rtos/ci-repo-cache:v0.29.3.20260727 | |
| options: '--entrypoint /bin/bash' | |
| timeout-minutes: 600 | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: AddressSanitizer | |
| sanitizer: asan | |
| # LSan only reports at exit and needs ASan, so they pair. | |
| twister-args: '--enable-asan --enable-lsan' | |
| - name: UndefinedBehaviorSanitizer | |
| sanitizer: ubsan | |
| twister-args: '--enable-ubsan' | |
| env: | |
| ZEPHYR_TOOLCHAIN_VARIANT: zephyr | |
| # The subsystems worth the runtime cost: the parsers and state machines | |
| # that process attacker-controlled input, plus the libraries under them. | |
| TEST_ROOTS: '-T tests/net -T tests/bluetooth -T tests/subsys -T tests/lib' | |
| steps: | |
| - name: Apply container owner mismatch workaround | |
| run: | | |
| # FIXME: The owner UID of the GITHUB_WORKSPACE directory may not | |
| # match the container user UID because of the way GitHub | |
| # Actions runner is implemented. Remove this workaround when | |
| # GitHub comes up with a fundamental fix for this problem. | |
| git config --global --add safe.directory ${GITHUB_WORKSPACE} | |
| - name: Clone cached Zephyr repository | |
| continue-on-error: true | |
| run: | | |
| git clone --shared /repo-cache/zephyrproject/zephyr . | |
| git remote set-url origin ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY} | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Zephyr environment | |
| uses: ./.github/actions/zephyr-ci-env | |
| with: | |
| group-filter: '+ci,+optional,+testing' | |
| run-checks: 'true' | |
| - name: Install Python packages | |
| run: | | |
| pip install -r scripts/requirements-actions.txt --require-hashes | |
| - name: Run tests under ${{ matrix.name }} | |
| run: | | |
| export ZEPHYR_BASE=${PWD} | |
| # A sanitizer finding fails its test, so a non-zero exit is the | |
| # expected outcome of a productive run and must not fail the job -- | |
| # the findings are the point. twister.yaml remains the gate. | |
| set +e | |
| ./scripts/twister \ | |
| -p native_sim \ | |
| --inline-logs --force-color -v \ | |
| --outdir twister-out-${{ matrix.sanitizer }} \ | |
| -j 16 \ | |
| ${{ matrix.twister-args }} \ | |
| ${TEST_ROOTS} | |
| status=$? | |
| set -e | |
| if [ ${status} -ne 0 ]; then | |
| echo "::notice title=${{ matrix.name }} run had failures::twister exited" \ | |
| "${status}; this is expected when the sanitizer reports. See the" \ | |
| "uploaded SARIF for the findings." | |
| fi | |
| - name: Convert findings to SARIF | |
| run: | | |
| python3 scripts/ci/sanitizer_sarif.py twister-out-${{ matrix.sanitizer }} \ | |
| --source-root "${PWD}" \ | |
| -o results-${{ matrix.sanitizer }}.sarif | |
| - name: Write job summary | |
| run: python3 scripts/ci/sarif_summary.py results-${{ matrix.sanitizer }}.sarif | |
| - name: Upload SARIF to code scanning | |
| uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 | |
| with: | |
| sarif_file: results-${{ matrix.sanitizer }}.sarif | |
| # One category per sanitizer. They report disjoint rule sets, and a | |
| # shared category would let whichever job finished last close the | |
| # other's alerts. | |
| category: sanitizers-${{ matrix.sanitizer }} | |
| - name: Upload SARIF as artifact | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: sanitizer-sarif-${{ matrix.sanitizer }} | |
| if-no-files-found: ignore | |
| retention-days: 30 | |
| path: results-${{ matrix.sanitizer }}.sarif | |
| - name: Upload sanitizer logs | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: sanitizer-logs-${{ matrix.sanitizer }} | |
| if-no-files-found: ignore | |
| retention-days: 7 | |
| path: | | |
| twister-out-${{ matrix.sanitizer }}/twister.log | |
| twister-out-${{ matrix.sanitizer }}/twister.json |