From a7642d78bb80eec9b93b766c87fbc011f8456c9c Mon Sep 17 00:00:00 2001
From: Rafal Rudnicki <rafal.rudnicki@intel.com>
Date: Fri, 16 Oct 2026 13:09:39 +0000
Subject: [PATCH] Add sanitizers workflow

---
 .github/lsan-suppressions.txt |  3 ++
 .github/workflows/basic.yml   | 61 ++++++++++++++++++++++++++++++++++-
 2 files changed, 63 insertions(+), 1 deletion(-)
 create mode 100644 .github/lsan-suppressions.txt

diff --git a/.github/lsan-suppressions.txt b/.github/lsan-suppressions.txt
new file mode 100644
index 0000000..8eb2276
--- /dev/null
+++ b/.github/lsan-suppressions.txt
@@ -0,0 +1,3 @@
+# Leaks reported inside the uninstrumented OpenCL CPU runtime
+# leak:libOpenCL.so
+# leak:libur_adapter_opencl.so
diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml
index 8edd61f..8d5635d 100644
--- a/.github/workflows/basic.yml
+++ b/.github/workflows/basic.yml
@@ -86,6 +86,61 @@ jobs:
         name: documentation
         path: target/doc
 
+  hardening:
+    if: github.event_name != 'schedule'
+    runs-on: ["oneapi-rs", "Linux"]
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Setup oneAPI
+      uses: ./.github/actions/setup-oneapi
+
+    - name: Install nightly toolchain
+      run: rustup toolchain install nightly --profile minimal
+
+    - name: Build and test with hardening flags
+      env:
+        RUSTFLAGS: -Zemit-stack-sizes -Zcf-protection=full
+        CARGO_TARGET_DIR: target/hardened
+      run: |
+        cargo +nightly test --workspace --verbose
+        cargo +nightly build --workspace --release --verbose
+
+  sanitizers:
+    name: Sanitizer (${{ matrix.sanitizer }})
+    if: github.event_name != 'schedule'
+    runs-on: ["oneapi-rs", "Linux"]
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [address, leak, thread]
+    env:
+      CARGO_TARGET_DIR: target/sanitizer-${{ matrix.sanitizer }}
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Setup oneAPI
+      uses: ./.github/actions/setup-oneapi
+
+    - name: Install nightly toolchain
+      run: rustup toolchain install nightly --profile minimal
+
+    - name: Install standard library sources for ThreadSanitizer
+      if: matrix.sanitizer == 'thread'
+      run: rustup component add rust-src --toolchain nightly
+
+    - name: Run tests with sanitizers
+      env:
+        # Test only CPU to avoid issues with GPU drivers and sanitizers
+        ONEAPI_DEVICE_SELECTOR: opencl:cpu
+        LSAN_OPTIONS: suppressions=${{ github.workspace }}/.github/lsan-suppressions.txt
+        RUSTFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
+      run: |
+        cargo +nightly test ${{ matrix.sanitizer == 'thread' && '-Zbuild-std' || '' }} \
+          --workspace --lib --tests --target x86_64-unknown-linux-gnu --verbose
+
   trivy:
     name: Trivy scan
     runs-on: ubuntu-latest
@@ -149,7 +204,11 @@ jobs:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Audit dependencies against RustSec
-      run: cargo +stable audit --deny unsound --format sarif > cargo-audit.sarif
+      run: |
+        database_dir="$(mktemp -d "$RUNNER_TEMP/rustsec.XXXXXX")"
+        cargo +stable audit --deny unsound --format sarif \
+          --db "$database_dir/advisory-db" \
+          --url https://github.com/RustSec/advisory-db.git > cargo-audit.sarif
 
     - name: Upload RustSec findings
       # Upload the report even when the audit step fails on findings.