From: Viktor Szakats <commit@vsz.me>
Date: Tue, 23 Sep 2025 08:17:29 +0000 (+0200)
Subject: GHA/linux: add HTTP/3 c-ares scan-build and asan jobs
X-Git-Tag: rc-8_17_0-1~182
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9ebf778e824007f1aad83ba79f5af802ee77c884;p=thirdparty%2Fcurl.git

GHA/linux: add HTTP/3 c-ares scan-build and asan jobs

They use Linuxbrew instead of locally built components.

Linuxbrew limitations compared to the locally built components in
GHA/http3-linux:
- libngtcp2 currently supports OpenSSL only.
- wolfssl can't coexist with openssl.
- somewhat tricky configuration with autotools.

Upside is easy of use, always the latest versions (may be downside),
and availability of almost all packages.

Closes #18693
---

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 36d37dfaea..3c827ae34b 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -239,6 +239,20 @@ jobs:
               --enable-ech --with-gssapi --enable-ssls-export
               --disable-debug --disable-unity
 
+          - name: 'scan-build H3 c-ares'
+            install_packages: clang-tools clang libidn2-dev libnghttp2-dev
+            install_steps: skipall
+            install_steps_brew: openssl libngtcp2 libnghttp3 c-ares
+            CC: clang
+            configure-prefix: scan-build
+            make-prefix: scan-build --status-bugs
+            LDFLAGS: -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/openssl/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libngtcp2/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib
+            PKG_CONFIG_PATH: /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig
+            configure: >-
+              --with-openssl=/home/linuxbrew/.linuxbrew/opt/openssl --with-ngtcp2 --with-nghttp3=
+              --with-libidn2 --enable-httpsrr --enable-ares
+              --disable-debug --disable-unity
+
           - name: 'address-sanitizer'
             install_packages: clang libssl-dev libssh-dev libidn2-dev libnghttp2-dev libubsan1 libasan8 libtsan2
             install_steps: pytest randcurl
@@ -247,6 +261,16 @@ jobs:
             CC: clang
             generate: -DENABLE_DEBUG=ON -DCURL_USE_LIBSSH=ON
 
+          - name: 'address-sanitizer H3 c-ares'
+            install_packages: clang libubsan1 libasan8 libtsan2
+            install_steps: pytest
+            install_steps_brew: openssl libngtcp2 libnghttp3 c-ares
+            CFLAGS: -fsanitize=address,undefined,signed-integer-overflow -fno-sanitize-recover=undefined,integer -Wformat -Werror=format-security -Werror=array-bounds -g
+            LDFLAGS: -fsanitize=address,undefined -fno-sanitize-recover=undefined,integer -ldl -lubsan -Wl,-rpath,/home/linuxbrew/.linuxbrew/opt/c-ares/lib
+            PKG_CONFIG_PATH: /home/linuxbrew/.linuxbrew/opt/libngtcp2/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/libnghttp3/lib/pkgconfig:/home/linuxbrew/.linuxbrew/opt/c-ares/lib/pkgconfig
+            CC: clang
+            generate: -DENABLE_DEBUG=ON -DCURL_USE_OPENSSL=ON -DOPENSSL_ROOT_DIR=/home/linuxbrew/.linuxbrew/opt/openssl -DUSE_NGTCP2=ON -DUSE_SSLS_EXPORT=ON -DENABLE_ARES=ON
+
           - name: 'thread-sanitizer'
             install_packages: clang libtsan2
             install_steps: pytest openssl-tsan