ci: add Valgrind leak detection on bookworm#123
Merged
Conversation
Add a Valgrind CI job running on debian:bookworm (OpenSSL 3.x) to automatically detect memory leaks in the XS code across all PRs. Uses --show-leak-kinds=definite to avoid Perl's known "still reachable" false positives, and --trace-children=yes since prove forks child processes for each test file. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
trace-children=yes with prove caused valgrind to wrap every child process, exhausting CI memory (exit 137). Run each test file directly under valgrind in a loop instead — one valgrind instance at a time. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Perl's runtime has known "definitely lost" allocations at exit that are false positives. Instead of --error-exitcode=1 (which catches all leaks), parse valgrind's text output and only fail if a "definitely lost" block's stack trace includes RSA.so — our XS shared library. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
timlegge
approved these changes
Mar 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a Valgrind CI job to automatically detect memory leaks in RSA.xs.
Why
We've fixed ~15 memory leaks in the XS code (PRs #74–#114). A Valgrind CI gate
ensures no new leaks are introduced and validates that existing fixes hold.
How
debian:bookworm(OpenSSL 3.x) — where most leak vectors exist--show-leak-kinds=definitefilters Perl's "still reachable" false positives--trace-children=yes+--child-silent-after-fork=yessince prove forks per test file--error-exitcode=1fails the job on any definite leakubuntujob (same pattern as openssl-matrix)Testing
Push and observe CI. If Perl-internal false positives surface, a suppression
file can be added in a follow-up.
🤖 Generated with Claude Code
Quality Report
Changes: 1 file changed, 57 insertions(+)
Code scan: clean
Tests: passed (OK)
Branch hygiene: clean
Generated by Kōan post-mission quality pipeline