CI: Add address (ASAN) and leak (LSAN) checks

Author: lovell

.github/workflows/ci.yml

@@ -342,6 +342,28 @@ jobs:
           path: npm/wasm32
           retention-days: 1
           if-no-files-found: error
+  build-asan:
+    permissions:
+      contents: read
+    needs: lint
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "26"
+      - run: npm install --ignore-scripts
+      - run: npm run build:dist
+      - run: npm run build
+        env:
+          CFLAGS: "-fsanitize=address"
+          LDFLAGS: "-fsanitize=address"
+      - run: npm run test-unit
+        env:
+          LSAN_OPTIONS: "detect_leaks=1:suppressions=test/leak/asan.supp"
+          LD_PRELOAD: "/usr/lib/x86_64-linux-gnu/libasan.so.8"
   release:
     permissions:
       contents: write
@@ -352,6 +374,7 @@ jobs:
       - build-linuxmusl-arm64
       - build-qemu
       - build-emscripten
+      - build-asan
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

test/fixtures/index.js

@@ -153,6 +153,8 @@ module.exports = {
 
   isLittleEndian: endianness() === 'LE',
 
+  isLsan: process.env.LSAN_OPTIONS?.includes('detect_leaks=1'),
+
   // Path for tests requiring human inspection
   path: getPath,
 

test/leak/asan.supp

@@ -0,0 +1 @@
+leak:OPENSSL_init_crypto

test/unit/svg.js

@@ -86,6 +86,7 @@ suite('SVG input', () => {
   });
 
   test('Convert SVG with embedded images to PNG, respecting dimensions, autoconvert to PNG', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     t.plan(4);
     const { data, info } = await sharp(fixtures.inputSvgWithEmbeddedImages)
       .toBuffer({ resolveWithObject: true });

test/unit/text.js

@@ -11,6 +11,7 @@ const { inRange } = require('../../dist/is.cjs');
 
 suite('Text to image', () => {
   test('text with default values', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     const output = fixtures.path('output.text-default.png');
     const text = sharp({
       text: {
@@ -44,6 +45,7 @@ suite('Text to image', () => {
   });
 
   test('text with width and height', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     const output = fixtures.path('output.text-width-height.png');
     const text = sharp({
       text: {
@@ -67,6 +69,7 @@ suite('Text to image', () => {
   });
 
   test('text with dpi', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     const output = fixtures.path('output.text-dpi.png');
     const dpi = 300;
     const text = sharp({
@@ -88,6 +91,7 @@ suite('Text to image', () => {
   });
 
   test('text with color and pango markup', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     const output = fixtures.path('output.text-color-pango.png');
     const dpi = 300;
     const text = sharp({
@@ -113,6 +117,7 @@ suite('Text to image', () => {
   });
 
   test('text with font', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     const output = fixtures.path('output.text-with-font.png');
     const text = sharp({
       text: {
@@ -133,6 +138,7 @@ suite('Text to image', () => {
   });
 
   test('text with justify and composite', async (t) => {
+    if (fixtures.isLsan) return t.skip('LSAN');
     const output = fixtures.path('output.text-composite.png');
     const width = 500;
     const dpi = 300;