[wdconinc]

Stacked on #40.

Summary

• CMake options USE_ASAN, USE_UBSAN and USE_TSAN, following EICrecon. ASan and UBSan can be combined; TSan cannot be combined with ASan (configure error).
• CI job sanitizers (clang++, Debug) with two configurations: asan-ubsan and tsan. It is a separate job, so the job names required by the main ruleset are unchanged. UBSan and TSan run with halt_on_error=1, so findings fail CI instead of only being printed.
• LeakSanitizer suppressions in .github/lsan.supp: ROOT keeps allocations from DD4hep geometry loading (libCore, libRIO) alive until exit, which made the three GeoSvc tests fail under ASan. No other suppressions are needed.
• README section on running the tests and sanitizers locally.

The new job uses eic/run-cvmfs-osg-eic-shell@main like the existing build job. Pinning that action (CodeQL alert) is left as a repo-wide decision: its main is 9 commits ahead of the latest tag, v1.5.0, including changes to action.yml.

Test plan

• Locally in eic_xl:nightly with clang++ Debug: 85/85 tests pass with ASan (with the LSan suppressions), UBSan, and TSan
• CI

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

An unresolved active finding remains, flagging an inaccurate CMakeLists.txt comment that misstates where the sanitizer runtime options are configured.

1 open issue

• Clarify sanitizer options are set in workflow env, not .supp files · New

What changed in this PR

This PR adds AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), and ThreadSanitizer (TSan) support to the algorithms framework, following the EICrecon conventions. It introduces opt-in CMake flags, a dedicated CI job that exercises them, LeakSanitizer suppressions needed because ROOT keeps DD4hep-related allocations alive until exit, and developer-facing documentation. It builds on the stacked PR #40, which defines the workflow-level CMAKE_CXX_STANDARD: 20 env used by the new job. Because sanitizers is a separate job, the status-check names required by the main ruleset are unchanged.

Changes:

• Add USE_ASAN, USE_UBSAN, USE_TSAN CMake options (ASan+UBSan combinable; TSan+ASan is a configure error), with UBSan flags guarded by check_cxx_compiler_flag so Clang-only checks are skipped elsewhere.
• Add a sanitizers CI job (clang++, Debug) with asan-ubsan and tsan matrix configs and runtime options (halt_on_error=1 for UBSan/TSan) via job env:.
• Add .github/lsan.supp LeakSanitizer suppressions for libCore/libRIO, plus a README section on running tests and sanitizers locally.

File	Description
CMakeLists.txt	Adds the three sanitizer options, flag detection, and the TSan/ASan mutual-exclusion guard.
.github/​workflows/​linux-eic-shell.yml	Adds the sanitizers matrix job building and testing under ASan+UBSan and TSan in eic-shell.
.github/​lsan.supp	New LeakSanitizer suppressions for ROOT allocations retained until exit.
README.md	Documents running tests and enabling/configuring sanitizers locally.

Notes: The changes are well-scoped and consistent with the existing build job. I left one minor documentation comment on the CMake comment wording (runtime options live in the workflow, not in .supp files). The CI portion itself can only be fully validated by an actual sanitizer run, which is still pending in the test plan.

_{Review effort: Balanced}