The real Gitea Actions run on this project's own registered runner just
failed exactly as CONTRIBUTING.md already anticipated it might:
FATAL: ThreadSanitizer: unexpected memory mapping, the same signature
already documented as a sandbox/container seccomp restriction blocking
personality(ADDR_NO_RANDOMIZE), which TSan needs to start at all. Build,
test suite, and ASan/UBSan all passed -- only the TSan step failed, on an
environment issue, not a code issue.
Fixed the CI step itself rather than just noting the failure: it now
classifies each binary's TSan run as PASS, a known flake (that exact
FATAL signature and nothing indicating an actual race was found), or a
real failure (anything else -- a genuine data race, a crash, any other
error). Only a real failure fails the build. Verified the classification
logic locally against four cases (a synthetic real race report, a plain
assertion failure, the known flake signature alone, and a clean pass) --
each classified correctly -- and against this sandbox's own six test
binaries, all six of which hit the real flake (this sandbox has never
been able to run TSan either) and correctly did not fail the build.
This does NOT mean TSan verification is happening in CI -- it means CI no
longer conflates "TSan couldn't start" with "the build is broken."
Updated CONTRIBUTING.md and CLAUDE.md from "whether the runner can execute
TSan is unverified" (a hedge) to the now-confirmed fact that it can't, and
corrected an overclaim in README.md that the suite is "regularly run under
ThreadSanitizer" -- as far as this project has been able to confirm, TSan
has not actually completed a run in any environment it's been built in
yet, local sandbox or CI. ASan/UBSan remain the real, run, load-bearing
sanitizer coverage.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqJpkdJ6Njnt1pw3CbghzB
Per explicit direction: this repository is not going on GitHub. Moved
.github/workflows/ci.yml to .gitea/workflows/ci.yml (Gitea Actions'
convention) and updated every doc that referenced the old path or assumed
GitHub-specific features:
- .gitea/workflows/ci.yml: added a header comment on the two things that
are genuinely Gitea-specific and instance-dependent, not just a renamed
file -- `runs-on: ubuntu-latest` must match a label the actual
registered Gitea runner advertises (there is no GitHub-hosted-runner
equivalent, this is self-hosted), and `actions/checkout@v4` resolves
against whatever action source that runner is configured with.
- CONTRIBUTING.md: corrected a claim that no longer holds -- it previously
said CI "runs on a normal, unrestricted GitHub Actions VM where TSan is
expected to work"; since this is actually a self-hosted Gitea runner
whose environment isn't controlled by this repo, that assumption isn't
something this repo can vouch for, so the text now says so rather than
carrying the old (GitHub-shaped) assumption forward silently.
- SECURITY.md: removed a claim this project can't back up (that "private
security advisories" are available once hosted -- that's a GitHub
feature this repo never had access to); reporting is by direct email to
the maintainer only.
- README.md: fixed a real gap while in here -- the "Security" section
never actually linked to SECURITY.md despite it existing since the
previous commit.
- CLAUDE.md, CHANGELOG.md: updated path references; CLAUDE.md's
self-evaluation section (a historical record of an audit finding) keeps
the old .github path where it describes what was literally true at that
time, with a note explaining the rename, rather than rewriting history.
Verified: clean make all + make test, all 6 binaries pass.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqJpkdJ6Njnt1pw3CbghzB
retoorandClaude Sonnet 5