sanitizer-common.yml

name: Common Sanitizer logic

on:
  workflow_call:
    inputs:
      os:
        required: true
        type: string
      jdk_distro:
        required: true
        type: string
      jdk_version:
        required: true
        type: string
      wolfssl_configure:
        required: true
        type: string

jobs:
  build_wolfcryptjni:
    runs-on: ${{ inputs.os }}
    steps:
      - uses: actions/checkout@v4

      - name: Cache JUnit dependencies
        uses: actions/cache@v4
        id: cache-junit
        with:
          path: junit
          key: junit-jars-v1

      - name: Download junit-4.13.2.jar
        if: steps.cache-junit.outputs.cache-hit != 'true'
        run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
      - name: Download hamcrest-all-1.3.jar
        if: steps.cache-junit.outputs.cache-hit != 'true'
        run: wget --directory-prefix=$GITHUB_WORKSPACE/junit https://repo1.maven.org/maven2/org/hamcrest/hamcrest-all/1.3/hamcrest-all-1.3.jar

      - name: Build native wolfSSL with AddressSanitizer
        uses: wolfSSL/actions-build-autotools-project@v1
        with:
          repository: wolfSSL/wolfssl
          ref: master
          path: wolfssl
          configure: ${{ inputs.wolfssl_configure }} CFLAGS="-fsanitize=address -fno-omit-frame-pointer" LDFLAGS="-fsanitize=address"
          check: false
          install: true

      - name: Setup java
        uses: actions/setup-java@v4
        with:
          distribution: ${{ inputs.jdk_distro }}
          java-version: ${{ inputs.jdk_version }}

      # Set environment variables
      # Use detect_leaks=0 to avoid leak sanitizer going wild when run via
      # Java, since it can have issues tracking internal JNI/JVM memory.
      # This will let us catch all non-leak issues.
      - name: Set environment variables
        run: |
          echo "JUNIT_HOME=$GITHUB_WORKSPACE/junit" >> "$GITHUB_ENV"
          echo "LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$GITHUB_WORKSPACE/build-dir/lib" >> "$GITHUB_ENV"
          echo "ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:halt_on_error=1:print_stats=1" >> "$GITHUB_ENV"

      # Only copy appropriate makefile for platform currently being tested
      - name: Copy makefile
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
              cp makefile.linux makefile
          elif [ "$RUNNER_OS" == "macOS" ]; then
              cp makefile.macosx makefile
          else
            echo "$RUNNER_OS not supported"
            exit 1
          fi
        shell: bash

      - name: Build JNI library with AddressSanitizer
        run: CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g" LDFLAGS="-fsanitize=address" PREFIX=$GITHUB_WORKSPACE/build-dir make

      - name: Find AddressSanitizer library
        run: |
          if [ "$RUNNER_OS" == "Linux" ]; then
            ASAN_LIB=$(gcc -print-file-name=libasan.so)
            echo "ASAN_LIB=$ASAN_LIB" >> "$GITHUB_ENV"
            echo "LD_PRELOAD=$ASAN_LIB" >> "$GITHUB_ENV"
          elif [ "$RUNNER_OS" == "macOS" ]; then
            # Find the actual path to the AddressSanitizer library
            XCODE_PATH=$(xcode-select -p)
            ASAN_LIB="$XCODE_PATH/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/$(clang --version | head -n1 | sed 's/.* \([0-9]*\.[0-9]*\.[0-9]*\).*/\1/')/lib/darwin/libclang_rt.asan_osx_dynamic.dylib"
            # Fallback to simpler path if the complex one doesn't work
            if [ ! -f "$ASAN_LIB" ]; then
              ASAN_LIB=$(find $XCODE_PATH -name "libclang_rt.asan_osx_dynamic.dylib" 2>/dev/null | head -n1)
            fi
            echo "ASAN_LIB=$ASAN_LIB" >> "$GITHUB_ENV"
            echo "DYLD_INSERT_LIBRARIES=$ASAN_LIB" >> "$GITHUB_ENV"
          fi

      # ant build-jni-debug
      - name: Build jni-debug JAR (ant build-jni-debug)
        run: ant build-jni-debug
      - name: Run Java tests (ant test)
        run: |
          if [ "$(uname)" == "Linux" ]; then
            LD_PRELOAD=$ASAN_LIB ant test
          elif [ "$(uname)" == "Darwin" ]; then
            DYLD_INSERT_LIBRARIES=$ASAN_LIB ant test
          else
            ant test
          fi
      - name: Clean JAR
        run: ant clean

      # ant build-jni-release
      - name: Build jni-release JAR (ant build-jni-release)
        run: ant build-jni-release
      - name: Run Java tests (ant test)
        run: |
          if [ "$(uname)" == "Linux" ]; then
            LD_PRELOAD=$ASAN_LIB ant test
          elif [ "$(uname)" == "Darwin" ]; then
            DYLD_INSERT_LIBRARIES=$ASAN_LIB ant test
          else
            ant test
          fi
      - name: Clean JAR
        run: ant clean

      # ant build-jce-debug
      - name: Build jce-debug JAR (ant build-jce-debug)
        run: ant build-jce-debug
      - name: Run Java tests (ant test)
        run: |
          if [ "$(uname)" == "Linux" ]; then
            LD_PRELOAD=$ASAN_LIB ant test
          elif [ "$(uname)" == "Darwin" ]; then
            DYLD_INSERT_LIBRARIES=$ASAN_LIB ant test
          else
            ant test
          fi
      - name: Clean JAR
        run: ant clean

      # ant build-jce-release
      - name: Build jce-release JAR (ant build-jce-release)
        run: ant build-jce-release
      - name: Run Java tests (ant test)
        run: |
          if [ "$(uname)" == "Linux" ]; then
            LD_PRELOAD=$ASAN_LIB ant test
          elif [ "$(uname)" == "Darwin" ]; then
            DYLD_INSERT_LIBRARIES=$ASAN_LIB ant test
          else
            ant test
          fi
      - name: Clean JAR
        run: ant clean

      - name: Show logs on failure
        if: failure() || cancelled()
        run: |
          cat build/reports/*.txt