From b70716b4a7f4a3cd310d3090867852e398be7692 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Konstantin=20K=C3=A4fer?= <mail@kkaefer.com>
Date: Wed, 14 Oct 2026 11:56:40 +0200
Subject: [PATCH] Add ASan/UBSan sanitizer job to CI

Runs the test suite with AddressSanitizer (incl. LeakSanitizer) and
UndefinedBehaviorSanitizer using gcc-14 and clang-18. Runs directly on
the runner instead of a container because LeakSanitizer needs ptrace.
---
 .github/workflows/ci.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 879ef4aa..0e26670c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -153,6 +153,31 @@ jobs:
       - uses: ./.github/actions/build
       - uses: ./.github/actions/ctest
 
+  sanitizers:
+    # Not run in a container, because LeakSanitizer needs ptrace
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        compiler:
+          - { cc: gcc-14, cxx: g++-14 }
+          - { cc: clang-18, cxx: clang++-18 }
+    env:
+      CC: ${{ matrix.compiler.cc }}
+      CXX: ${{ matrix.compiler.cxx }}
+      BUILD_TYPE: Debug
+      CXXFLAGS: -fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer
+      LDFLAGS: -fsanitize=address,undefined
+      ASAN_OPTIONS: detect_stack_use_after_return=1:strict_string_checks=1
+      UBSAN_OPTIONS: print_stacktrace=1
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/install-ubuntu
+      - uses: ./.github/actions/cmake
+      - uses: ./.github/actions/build
+      - uses: ./.github/actions/ctest
+
   macos:
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30