runtime-safety.yml

name: Runtime Safety

on:
  push:
    branches:
      - main
    paths:
      - CMakeLists.txt
      - bench/**
      - src/**
      - tests/**
      - .github/workflows/runtime-safety.yml
  pull_request:
    branches:
      - main
    paths:
      - CMakeLists.txt
      - bench/**
      - src/**
      - tests/**
      - .github/workflows/runtime-safety.yml
  schedule:
    - cron: "43 04 * * 2"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  shm-timeout-abi:
    name: ARM SHM timeout ABI
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false
      - name: Install ARM compiler and emulator
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends gcc-arm-linux-gnueabihf libc6-dev-armhf-cross qemu-user
      - name: Check legacy and time64 libc layouts
        env:
          NIPC_TEST_RUNNER: qemu-arm
        run: |
          bash tests/run-shm-timeout-abi.sh arm-linux-gnueabihf-gcc -static
          bash tests/run-shm-timeout-abi.sh arm-linux-gnueabihf-gcc -static -D_TIME_BITS=64 -D_FILE_OFFSET_BITS=64 -DNIPC_TEST_REQUIRE_TIME64_32

      - name: Check Rust ARM musl legacy and time64 layouts
        run: |
          rustup target add arm-unknown-linux-musleabihf
          bash tests/run-rust-shm-timeout-abi.sh

  asan-ubsan:
    name: ASAN/UBSAN
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Run ASAN/UBSAN validation
        run: bash tests/run-sanitizer-asan.sh

  tsan:
    name: TSAN
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Run TSAN validation
        run: bash tests/run-sanitizer-tsan.sh

  valgrind:
    name: Valgrind
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Install Valgrind
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends valgrind

      - name: Run Valgrind validation
        run: bash tests/run-valgrind.sh

  go-race:
    name: Go Race Detector
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: src/go/go.mod
          cache: false

      - name: Run Go race detector
        run: bash tests/run-go-race.sh

  shm-full-backing-store:
    name: SHM Full Backing Store
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: src/go/go.mod
          cache: false

      - name: Build C, Rust, and Go SHM creators
        run: |
          cmake -S . -B build-shm-regression
          cmake --build build-shm-regression --parallel 2 \
            --target interop_shm_c interop_shm_rs interop_shm_go

      - name: Require real tmpfs capacity-exhaustion regression
        run: |
          ctest_bin="$(dirname "$(command -v cmake)")/ctest"
          test -x "$ctest_bin"
          sudo env \
            PATH="$PATH" \
            NIPC_REQUIRE_TMPFS_TEST=1 \
            "$ctest_bin" \
              --test-dir build-shm-regression \
              --output-on-failure \
              --no-tests=error \
              -R '^test_shm_full_backing_store$'

  windows-msys:
    name: Windows MSYS2 Runtime
    runs-on: windows-latest
    timeout-minutes: 45

    defaults:
      run:
        shell: msys2 {0}

    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: src/go/go.mod
          cache: false

      - name: Set up MSYS2
        uses: msys2/setup-msys2@e9898307ac31d1a803454791be09ab9973336e1c # v2
        with:
          msystem: MSYS
          update: true
          path-type: inherit
          install: >-
            base-devel
            gcc
            cmake
            ninja
            git

      - name: Build Windows runtime targets
        run: |
          set -euo pipefail
          windows_cargo_home="${CARGO_HOME:-}"
          if [[ -z "$windows_cargo_home" && -n "${USERPROFILE:-}" ]]; then
            windows_cargo_home="$(cygpath -u "$USERPROFILE")/.cargo"
          fi
          windows_cargo_home="${windows_cargo_home:-$HOME/.cargo}"
          export PATH="$windows_cargo_home/bin:$PATH"
          cargo check \
            --manifest-path src/crates/netipc/Cargo.toml \
            --all-targets \
            --all-features \
            --locked
          cmake -S . -B build-windows -G Ninja \
            -DCMAKE_BUILD_TYPE=RelWithDebInfo \
            -DCMAKE_C_COMPILER=/usr/bin/gcc \
            -DCMAKE_CXX_COMPILER=/usr/bin/g++
          cmake --build build-windows \
            --parallel "$(getconf _NPROCESSORS_ONLN 2>/dev/null || echo 4)" \
            --target \
            test_named_pipe \
            test_win_shm \
            test_win_service \
            test_win_service_payload_limits \
            test_win_service_extra \
            test_win_stress \
            interop_named_pipe_c \
            interop_named_pipe_rs \
            interop_named_pipe_go \
            interop_win_shm_c \
            interop_win_shm_rs \
            interop_win_shm_go \
            interop_service_win_c \
            interop_service_win_rs \
            interop_service_win_go \
            interop_cache_win_c \
            interop_cache_win_rs \
            interop_cache_win_go

      - name: Run Windows runtime tests
        run: |
          set -euo pipefail
          ctest --test-dir build-windows --output-on-failure -j1 -R "^(test_named_pipe|test_win_shm|test_win_service|test_win_service_payload_limits|test_win_service_extra|test_named_pipe_interop|test_win_shm_interop|test_service_win_interop|test_service_win_shm_interop|test_cache_win_interop|test_cache_win_shm_interop|test_win_stress)$"