Skip to content

Comments

Clean permissions of workflows and enable coverage reporting for PRs#152

Draft
LittleHuba wants to merge 19 commits intomainfrom
ulhu_add_perms_to_workflows
Draft

Clean permissions of workflows and enable coverage reporting for PRs#152
LittleHuba wants to merge 19 commits intomainfrom
ulhu_add_perms_to_workflows

Conversation

@LittleHuba
Copy link
Contributor

Reduce the permissions of all workflows as far as possible. Further, actively specify permissions as action to the codeql findings.

This also enables us to run the coverage report workflow on PRs.

@LittleHuba LittleHuba force-pushed the ulhu_add_perms_to_workflows branch 6 times, most recently from 4a6af2e to 9019459 Compare February 20, 2026 12:54
LLVM toolchain uses the builtin libc++ to remain hermetic.
This implementation of the standard library does not support
fancy pointers (like offset pointers) in std::basic_string.
This is required for shared memory allocators though.

The correct solution would be to provide a sysroot to the
LLVM toolchain that contains libstdc++.
Because of the amount of effort to achieve this we take the shortcut for the moment and deactivate the problematic code.
Many of the integration tests had race conditions.
Most expected that the service is there once the client searches for it.
But there was no synchronization between the skeleton offer being made
available and the client doing a one-time FindService call.

Switches to StartFindService to effectively synchronize the service
discovery.
StartFindService does not provide incremental updates of new
service offers. Instead, it gives the full list of existing
service offers at that current moment.
User applications must filter out the diff on their own.

Uses an unordered_map to correctly filter for individual service
offers.
Thread sanitizer highlighted a lock inversion in this test.
By adding a lock that spans the FindServiceHandler and the
creation of a proxy, we get this inversion.

The handler runs under a lock held in the service discovery.
The proxy also calls the service discovery.
Connecting both creates the lock inversion.

Solves the lock inversion by storing the handle required for
the proxy creation locally and then unlocking the mutex before
the proxy creation.
When multiple proxies try to do a rollback at the same time,
the rollback may be performed multiple times.

Fixes the data race by making the relevant flag atomic.
The new S-CORE GCC toolchain requires a very specific host
platform to be manually selected. This is not suitable for
our default toolchain setup.

Therefore, we move this toolchain to a specific configuration
and use an opensource GCC toolchain as alternative.
Manually specifying the host platform can lead to tremendous
problems if the specified host platform does match the actual
platform.

Removes the selection to let Bazel automatically select the
appropriate host platform.
Reduce the permissions of all workflows as far as possible.
Further, actively specify permissions as action to the codeql findings.

This also enables us to run the coverage report workflow on PRs.
Makes workflow more versatile to support testing more toolchains.
These targets fail with the QNX toolchains.
Since both targets are about documentation, fixing this has very
low priority.
Sanitizers rely on the addr2line utility to
symbolize the backtraces in their reports.

Adds this tool to the Ubuntu image.
Bazel requires more information about test size to
determine concurrent execution capabilities.
Some findings of the thread sanitizer are not easy to fix.
For these findings tickets were created and the test was
disabled.
@LittleHuba LittleHuba force-pushed the ulhu_add_perms_to_workflows branch from 9019459 to 04daac4 Compare February 20, 2026 17:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant