Add sanitizer support using GCC toolchain features

.bazelrc

@@ -87,3 +87,6 @@ coverage --test_env=COVERAGE_GCOV_OPTIONS=-bcu
 coverage --test_env=LLVM_PROFILE_CONTINUOUS_MODE=1
 coverage --cxxopt -mllvm
 coverage --cxxopt -runtime-counter-relocation
+
+# Dynamic analysis (sanitizers) for Linux host builds/tests.
+try-import %workspace%/quality/sanitizer/sanitizer.bazelrc

.github/workflows/sanitizers.yml

@@ -0,0 +1,69 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Sanitizers
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+
+jobs:
+  sanitizer-tests:
+    name: Bazel Tests (${{ matrix.sanitizer_config }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer_config: [asan_ubsan_lsan]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4.2.2
+        with:
+          ref: ${{ github.head_ref || github.event.pull_request.head.ref || github.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+
+      - name: Setup Bazel with shared caching
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          bazelisk-version: 1.26.0
+          disk-cache: true
+          repository-cache: true
+          bazelisk-cache: true
+          cache-save: ${{ github.event_name == 'push' }}
+
+      - name: Run sanitizer tests via Bazel
+        run: |
+          set -euo pipefail
+          echo "Running: bazel test --config=${{ matrix.sanitizer_config }} //score/..."
+          # Note: Scoped to C/C++ targets only. Rust targets require Rust-specific
+          # sanitizer handling and are excluded via tag filters.
+          bazel test \
+            --config=${{ matrix.sanitizer_config }} \
+            //score/... \
+            --build_tag_filters=-rust \
+            --test_tag_filters=-rust \
+            --verbose_failures
+
+      - name: Upload Bazel test logs (always)
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: bazel-testlogs-${{ matrix.sanitizer_config }}
+          path: bazel-testlogs/**/test.log
+          if-no-files-found: warn

quality/sanitizer/sanitizer.bazelrc

@@ -0,0 +1,29 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+# ASan + UBSan + LSan
+test:asan_ubsan_lsan --config=x86_64-linux
+test:asan_ubsan_lsan --compilation_mode=dbg
+test:asan_ubsan_lsan --features=asan
+test:asan_ubsan_lsan --features=ubsan
+test:asan_ubsan_lsan --features=lsan
+test:asan_ubsan_lsan --platform_suffix=asan_ubsan_lsan
+test:asan_ubsan_lsan --test_env=ASAN_OPTIONS=exitcode=55:allow_addr2line=1:verbosity=1:detect_leaks=1:halt_on_error=1:allocator_may_return_null=1
+test:asan_ubsan_lsan --test_env=UBSAN_OPTIONS=exitcode=55:allow_addr2line=1:verbosity=1:print_stacktrace=1:halt_on_error=1
+
+# TSan
+test:tsan --config=x86_64-linux
+test:tsan --compilation_mode=dbg
+test:tsan --features=tsan
+test:tsan --platform_suffix=tsan
+test:tsan --test_env=TSAN_OPTIONS=exitcode=55:allow_addr2line=1:verbosity=1:halt_on_error=1:detect_deadlocks=1

score/mw/log/rust/score_log_bridge/BUILD

@@ -96,6 +96,7 @@ rust_test(
     edition = "2021",
     rustc_flags = RUSTC_FLAGS,
     tags = [
+        "rust",
         "unit_tests",
         "ut",
     ],
@@ -113,6 +114,7 @@ rust_binary(
     ],
     edition = "2021",
     rustc_flags = RUSTC_FLAGS,
+    tags = ["rust"],
     visibility = ["//visibility:public"],
     deps = [
         ":score_log_bridge",