ci: add CI-unit-tests-asan-coverage workflow

[renecannao]

Summary

Adds a new, self-contained CI workflow that builds ProxySQL with PROXYSQLGENAI=1 + WITHASAN=1 (forces NOJEMALLOC=1) + WITHGCOV=1, then builds and runs every unit test under test/tap/tests/unit/ and publishes an LCOV coverage report.

This is intentionally kept separate from the existing (currently disabled) CI-unittests workflow, and is designed around three constraints:

1. Runs on the GitHub runner, not inside the shared build cache.
   Unlike the other CI-taptests-* workflows this one does not require the private proxysql/jenkins-build-scripts repo or any backend MySQL/Docker infrastructure. Unit tests link against libproxysql.a via the stub test_globals.o and run as standalone binaries, so the workflow builds and tests directly on the runner. This also sidesteps the 10 GB cache quota issue documented in the disabled CI-unittests.yml top comment (see ci: shrink _test cache by dropping unit binaries and test/deps (critical) #5603).

2. Targets only test/tap/tests/unit/, not the integration TAP tests.
   make unit_tests is invoked via test/tap/Makefile, which recurses only into tests/unit/. Integration tests under tests/ are intentionally skipped because they need running backends.

3. Deps are built with make build_deps (optimized), not build_deps_debug.
   Third-party code isn't what we want to instrument; ASAN/gcov instrumentation is only needed in ProxySQL's own lib/ and src/, which are built with make debug in the next step.

What the workflow does

• Relaxes vm.mmap_rnd_bits to 28 (ASAN's shadow-memory requirement on modern kernels, explicitly warned about in include/makefiles_vars.mk).
• Installs build tools + build deps from INSTALL.md's Ubuntu list, plus lcov/fastcov for coverage.
• Builds with PROXYSQLGENAI=1 NOJEMALLOC=1 WITHASAN=1 WITHGCOV=1.
• Runs every test/tap/tests/unit/*-t binary under ASAN_OPTIONS=detect_leaks=0:abort_on_error=1:halt_on_error=1:symbolize=1:print_stacktrace=1.
  • detect_leaks=0 because existing unit tests were not written leak-free. Flipping to =1 later will immediately turn this workflow into a leak regression guard.
• Captures an LCOV coverage report (baseline + post-test merge, excluding deps/, test/, /usr/).
• Always uploads three artifacts (even on failure):
  • unit-tests-coverage-lcov-<sha> — raw lcov.info
  • unit-tests-coverage-html-<sha> — genhtml output tree
  • unit-tests-logs-<sha> — per-test stdout/stderr
• Follows the project's LouisBrunner/checks-action check-run convention for status reporting.

Triggers

• workflow_run: [CI-trigger] — same cascade pattern as every other CI-* workflow in this directory.
• workflow_dispatch — manual runs from the Actions tab.

Security

Every run: step in the workflow only consumes values from env: (SHA, ASAN_OPTIONS, …) or GitHub-provided variables like $GITHUB_WORKSPACE. No untrusted user input (PR titles, issue bodies, commit messages, fork branch names, etc.) is interpolated into shell commands, so there is no command-injection surface.

Test plan

• Merge this PR so the workflow file lands on v3.0 (workflow_run listeners only fire for workflows present on the default branch).
• Manually dispatch once via gh workflow run CI-unit-tests-asan-coverage -r v3.0 or the Actions UI to verify the full PROXYSQLGENAI + ASAN + gcov build succeeds.
• Inspect the uploaded LCOV report to confirm non-zero coverage on lib/ and src/.
• If any unit test fails under ASAN, triage from the per-test log artifact (unit-tests-logs-<sha>).

Known unknowns

• Whether ASAN + PROXYSQLGENAI=1 (Rust-linked deps) + gcov all compile together cleanly — this is an untested combination. If the link step fails on a Rust-backed crate, the likely fix is adding RUSTFLAGS for ASAN.
• Some unit tests may BAIL_OUT if they require files/env that don't exist on a fresh runner; log artifacts will reveal which.

Summary by CodeRabbit

• Chores
  • Enhanced continuous integration testing infrastructure with automated unit tests and code coverage reporting.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow is added that triggers on CI-trigger completion or manual dispatch. It provisions Ubuntu 24.04, installs coverage and build dependencies, compiles ProxySQL with ASAN and gcov flags, executes unit test binaries, and generates coverage reports via lcov and genhtml, uploading artifacts upon completion.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/CI-unit-tests-asan-coverage.yml	New workflow that orchestrates unit testing with AddressSanitizer (ASAN) and code coverage analysis. Establishes multi-stage pipeline: dependency installation, library/source build, unit test compilation, coverage baseline capture, test execution with logging, coverage report generation (HTML and LCOV), and artifact upload. Integrates workflow-level status checks.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Protocol encoding/decoding and utility unit tests (Phase 2.5) #5488: CI workflow directly compiles and executes unit test binaries via make unit_tests that this new workflow orchestrates.
• Fix CI test failures and workflow race conditions #5577: Both PRs modify GitHub Actions workflow trigger and guard logic to run on upstream workflow completion and gate on successful upstream execution.
• Phase 3.9: PgSQL monitor health decisions + unit tests #5513: CI workflow builds and runs unit test binaries under test/tap/tests/unit that this new workflow processes.

Poem

🐰 Coverage flows like morning dew,
ASAN guards the code so true,
Unit tests dance in GitHub's light,
Unit-tests-asan shines so bright! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title 'ci: add CI-unit-tests-asan-coverage workflow' directly and clearly describes the main change: adding a new GitHub Actions workflow for unit tests with ASAN and coverage features.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci-add-unit-tests-asan-coverage

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
3 Security Hotspots

See analysis details on SonarQube Cloud