Add ASan/TSan/Valgrind configs and GitHub Actions CI

.bazelrc

@@ -1,14 +1,57 @@
-build:asan --strip=never
-build:asan --copt -fsanitize=address
-build:asan --copt -DADDRESS_SANITIZER
-build:asan --copt -g
-build:asan --copt -fno-omit-frame-pointer
-build:asan --linkopt -fsanitize=address
-
 # For all builds, use C++17
 build --cxxopt="-std=c++17"
 
 # For Apple Silicon
 build:apple_silicon --cpu=darwin_arm64
 build:apple_silicon --features=oso_prefix_is_pwd
 
+# -----------------------------------------------------------------------------
+# Sanitizer / dynamic-analysis configurations.
+#
+# Pick one with `--config=<name>`, e.g.
+#     bazel test --config=asan     //toolbelt:sockets_test
+#     bazel test --config=tsan     //toolbelt:sockets_test
+#     bazel test --config=valgrind //toolbelt:sockets_test
+#
+# All three configs preserve debug information so failures point back to
+# meaningful source locations.
+# -----------------------------------------------------------------------------
+
+# AddressSanitizer.  Detects use-after-free, heap/stack/global buffer
+# overflows, use-after-return, etc.
+build:asan --strip=never
+build:asan --copt=-fsanitize=address
+build:asan --copt=-DADDRESS_SANITIZER
+build:asan --copt=-g
+build:asan --copt=-O1
+build:asan --copt=-fno-omit-frame-pointer
+build:asan --linkopt=-fsanitize=address
+# Note: leak detection (LSan) is only supported on Linux; opting out keeps the
+# config portable to macOS.  On Linux you can enable it with
+#     --test_env=ASAN_OPTIONS=halt_on_error=1:detect_leaks=1
+test:asan --test_env=ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:detect_leaks=0:print_summary=1
+
+# ThreadSanitizer.  Detects data races and several kinds of synchronization
+# bugs.
+build:tsan --strip=never
+build:tsan --copt=-fsanitize=thread
+build:tsan --copt=-DTHREAD_SANITIZER
+build:tsan --copt=-g
+build:tsan --copt=-O1
+build:tsan --copt=-fno-omit-frame-pointer
+build:tsan --linkopt=-fsanitize=thread
+test:tsan --test_env=TSAN_OPTIONS=halt_on_error=1:second_deadlock_stack=1:history_size=7
+
+# Valgrind.  Runs the unmodified binary under Memcheck.
+#
+# Notes:
+#   * Valgrind is not available on macOS arm64.  Use Linux (or x86_64) to
+#     exercise this config.
+#   * --error-exitcode=1 makes the test fail on any reported error.
+#   * --child-silent-after-fork=yes suppresses noise from forking helpers.
+build:valgrind --strip=never
+build:valgrind --copt=-g
+build:valgrind --copt=-O1
+build:valgrind --copt=-fno-omit-frame-pointer
+test:valgrind --run_under='valgrind --error-exitcode=1 --leak-check=full --show-leak-kinds=definite,possible --track-origins=yes --child-silent-after-fork=yes --trace-children=yes'
+test:valgrind --test_timeout=300

.github/workflows/ci.yml

@@ -0,0 +1,127 @@
+name: CI
+
+on: [push, pull_request]
+
+jobs:
+  # Plain build + test on each supported host.  Mirrors the workflow used by
+  # the dallison/co repository so behavior stays consistent across
+  # projects.
+  test:
+    name: Build & test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+          - os: ubuntu-24.04-arm
+          - os: macos-latest
+            bazel_flags: --config=apple_silicon
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Install Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          # Avoid downloading Bazel every time.
+          bazelisk-cache: true
+          # Store the build cache per workflow.
+          disk-cache: ${{ github.workflow }}-${{ matrix.os }}
+          # Share the repository cache between workflows.
+          repository-cache: true
+
+      - name: Build all targets
+        run: |
+          bazel build //... \
+            --verbose_failures \
+            ${{ matrix.bazel_flags }}
+
+      - name: Run tests
+        run: |
+          bazel test //... \
+            --verbose_failures \
+            --test_output=errors \
+            ${{ matrix.bazel_flags }}
+
+      - name: Upload Bazel test logs
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: bazel-test-logs-${{ matrix.os }}
+          path: bazel-testlogs
+
+  # Run the test suite under AddressSanitizer and ThreadSanitizer.  Linux
+  # only because LSan + ASan, and TSan, behave most uniformly there.
+  sanitizers:
+    name: ${{ matrix.config }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        config: [asan, tsan]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Install Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}-${{ matrix.config }}
+          repository-cache: true
+
+      - name: Run tests under ${{ matrix.config }}
+        run: |
+          bazel test //... \
+            --config=${{ matrix.config }} \
+            --verbose_failures \
+            --test_output=errors
+
+      - name: Upload Bazel test logs
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: bazel-test-logs-${{ matrix.config }}
+          path: bazel-testlogs
+
+  # Run the test suite under Valgrind's Memcheck.  Valgrind is only
+  # available on Linux/x86_64 in practice.
+  valgrind:
+    name: valgrind
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Install Valgrind
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y valgrind
+
+      - name: Install Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+          bazelisk-cache: true
+          disk-cache: ${{ github.workflow }}-valgrind
+          repository-cache: true
+
+      - name: Run tests under Valgrind
+        run: |
+          bazel test //... \
+            --config=valgrind \
+            --verbose_failures \
+            --test_output=errors
+
+      - name: Upload Bazel test logs
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: bazel-test-logs-valgrind
+          path: bazel-testlogs

MODULE.bazel

@@ -1,13 +1,13 @@
 module(
     name = "cpp_toolbelt",
-    version = "2.0.2",
+    version = "2.1.1",
 )
 
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "abseil-cpp", version = "20250814.1")
 bazel_dep(name = "googletest", version = "1.17.0.bcr.2")
-bazel_dep(name = "coroutines", version = "3.2.1")
+bazel_dep(name = "coroutines", version = "3.3.1")
 bazel_dep(name = "rules_cc", version = "0.2.17")
 
 # For local debugging of co coroutine library.