Skip to content

DOCUMENTATION / GALANTHUS

Sanitizer Policy

Galanthus currently makes one explicit sanitizer promise in CI on Linux:

  • normal Release and Debug builds run in GitHub Actions
  • AddressSanitizer + UndefinedBehaviorSanitizer run in GitHub Actions
  • ThreadSanitizer runs in GitHub Actions
  • MemorySanitizer is supported for manual/local builds, but it is not CI-guaranteed

The MSan decision is deliberate. The Linux workflow uses stock distro packages, not an instrumented libc and dependency stack, so a MemorySanitizer job would not be trustworthy yet.

What this means for contributors:

  • GALANTHUS_SANITIZER=memory is a valid local configuration for manual testing
  • MSan failures are not expected to block CI today
  • if a future CI lane adds MSan, it needs an instrumented dependency environment first

If you are updating sanitizer support, keep the workflow, this policy, and cmake/CompilerSettings.cmake aligned.