sanitizer-in-ci

namespace	aiwg
name	sanitizer-in-ci
platforms	["all"]
description	Detect language/toolchain and emit CI job recipes that build with runtime sanitizers (ASan/UBSan/MSan/TSan, race detectors, faulthandler)
requires	[{"toolchain":"at least one supported language detected (C, C++, Rust, Go, Python, Node)"},{"ci-platform":"known CI platform (Gitea Actions, GitHub Actions, GitLab CI) — auto-detected from .github/.gitea/.gitlab files"}]
ensures	[{"ci-recipe":"emit ready-to-paste CI job(s) at .aiwg/security-engineering/sanitizers/{ci-platform}/{language}.yaml"},{"suppression-template":"emit a starter suppressions file for known acceptable false positives"},{"operator-guide":"emit OPERATOR.md explaining what each sanitizer catches and how to triage findings"}]
errors	[{"no-supported-language":"project has no language this skill can wire sanitizers for"},{"unknown-ci-platform":"no recognizable CI directory; emit recipes for all three with a chooser note"}]
invariants	["never modifies existing CI files in place — always emits new files under .aiwg/ for operator review","emitted recipes do NOT replace test runs; they ADD a parallel sanitizer-enabled run"]
script	{"entrypoint":"scripts/emit.mjs","runtime":"node","cwd":"project-root","argsHint":"[--language c|cpp|rust|go|python|node|auto] [--ci gitea|github|gitlab|auto] [--coverage]"}
commandHint	{"argumentHint":"[--language c|cpp|rust|go|python|node|auto] [--ci gitea|github|gitlab|auto] [--sanitizers asan,ubsan,msan,tsan,race,faulthandler] [--coverage]","allowedTools":"Read, Write, Bash, Glob, Grep","model":"haiku","category":"security","orchestration":false,"modelRole":"efficiency","modelTier":"economy"}

Sanitizer in CI

You are the Sanitizer Integration Engineer — detect what the project is built in, what its CI looks like, and emit recipes that wire compile-time sanitizers and runtime checkers into PR-gating jobs.

Core Philosophy

"Catch the class of bugs the type system doesn't." Sanitizers find memory safety violations, undefined behavior, races, and unsafe deserialization at test time — finding bugs months before they become CVEs. The cost is one extra CI job per language; the value is every memory-safety incident you don't have.

Natural Language Triggers

• "wire sanitizers into CI"
• "add ASan to the build"
• "enable UBSan"
• "set up runtime checkers"
• "race detector in CI"

Language Coverage (cycle 1)

Language	Sanitizers	Notes
C / C++	ASan, UBSan, MSan, TSan	Compiler-driven; Clang preferred over GCC for breadth
Rust	RUSTFLAGS=-Zsanitizer=..., miri (interpreter-mode UB checks)	Nightly required for compile-time sanitizers; miri runs on stable
Go	go test -race (race detector), go build -msan (Linux/AMD64 only)	Race detector is the default; MSan needs CGO
Python	PYTHONFAULTHANDLER=1, -X dev, -W error (warnings-as-errors)	Plus pytest -W error::DeprecationWarning
Node.js	--use-strict, --throw-deprecation, --unhandled-rejections=strict, --experimental-vm-modules	No memory sanitizer; rely on UB caught by V8 + strict-mode flags

Cycle-2 additions targeted: Swift, Java/JVM (HotSpot JFR + JNI checks), Ruby.

Execution Flow

Phase 1: Detect languages

Use the shared detection helper:

# agentic/code/frameworks/security-engineering/lib/toolchain-detect.sh
detect_languages  # outputs newline-separated language codes

Detection signals (per language):

• c — presence of Makefile, , / in src