From 27289bcc29e40ec4e025be014fc6b7c8fe936ab6 Mon Sep 17 00:00:00 2001
From: Eric Kilmer <eric.kilmer@trailofbits.com>
Date: Wed, 25 Feb 2026 21:20:06 +0000
Subject: [PATCH] Install LLVM explicitly in sanitizer and assertions CI jobs

Use the official LLVM apt script to install clang rather than relying
on whichever version happens to ship on the runner. The version is
configured via a workflow-level LLVM_VERSION env variable (currently 21)
so bumping is a one-line change.

The assertions job also installs the matching versioned libc++-dev and
libc++abi-dev packages.

Remove CMAKE_CXX_COMPILER from the ci-assertions preset so the CXX
environment variable is respected by CMake in both CI and local use.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/main.yml | 30 ++++++++++++++++++++++++------
 CMakePresets.json          |  1 -
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f920362..0e36606 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -13,6 +13,9 @@ on:
     branches:
       - "*"
 
+env:
+  LLVM_VERSION: 21
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
@@ -261,7 +264,6 @@ jobs:
       contents: read
 
     env:
-      CXX: clang++
       ASAN_OPTIONS: strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:detect_leaks=1
       UBSAN_OPTIONS: print_stacktrace=1
 
@@ -278,6 +280,13 @@ jobs:
         git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
         git config --global user.name "github-actions[bot]"
 
+    - name: Install LLVM
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        chmod +x /tmp/llvm.sh
+        sudo /tmp/llvm.sh $LLVM_VERSION
+        echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"
+
     - name: Install system dependencies
       run: |
         sudo apt-get update
@@ -351,8 +360,10 @@ jobs:
     permissions:
       contents: read
 
-    env:
-      CXX: clang++
+    strategy:
+      fail-fast: false
+      matrix:
+        release: [stable, HEAD]
 
     steps:
     - uses: actions/checkout@v6
@@ -362,16 +373,23 @@ jobs:
         git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
         git config --global user.name "github-actions[bot]"
 
+    - name: Install LLVM
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        chmod +x /tmp/llvm.sh
+        sudo /tmp/llvm.sh $LLVM_VERSION
+        echo "CXX=clang++-$LLVM_VERSION" >> "$GITHUB_ENV"
+
     - name: Install system dependencies
       run: |
         sudo apt-get update
-        sudo apt-get install -y ccache libc++-dev libc++abi-dev
+        sudo apt-get install -y ccache libc++-$LLVM_VERSION-dev libc++abi-$LLVM_VERSION-dev
 
     - name: Generate cache key
       shell: cmake -P {0}
       run: |
         string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
-        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_KEY=assertions_HEAD\n")
+        file(APPEND "$ENV{GITHUB_ENV}" "CACHE_KEY=assertions_${{ matrix.release }}\n")
         file(APPEND "$ENV{GITHUB_ENV}" "CACHE_TIMESTAMP=${current_date}\n")
 
     - name: Update the cache (ccache)
@@ -398,7 +416,7 @@ jobs:
 
     - name: Configure the project
       run: cmake --preset=ci-assertions
-        -Dsleigh_RELEASE_TYPE=HEAD
+        -Dsleigh_RELEASE_TYPE=${{ matrix.release }}
         -Dsleigh_BUILD_DOCUMENTATION=OFF
 
     - name: Build the project
diff --git a/CMakePresets.json b/CMakePresets.json
index c89345b..7de58c0 100644
--- a/CMakePresets.json
+++ b/CMakePresets.json
@@ -119,7 +119,6 @@
       "binaryDir": "${sourceDir}/build/assertions",
       "inherits": ["ci-unix", "dev-mode"],
       "cacheVariables": {
-        "CMAKE_CXX_COMPILER": "clang++",
         "CMAKE_BUILD_TYPE": "Assertions",
         "CMAKE_CXX_FLAGS_ASSERTIONS": "-O0 -g -stdlib=libc++ -D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_DEBUG -fstack-protector-strong",
         "CMAKE_EXE_LINKER_FLAGS_ASSERTIONS": "-stdlib=libc++ -lc++abi",