ci: halve the work, cache more, add sanitizer and hardened builds

[martinus]

Stop building everything twice

on: [push, pull_request] ran the full matrix twice for every branch with an open PR — once for the push, once for the pull_request event. You can see it in the recent runs: each of #57/#58/#59 had two of every job.

Now push only builds main, everything else goes through pull_request. Added a concurrency group so a new push to a PR cancels the run it just obsoleted — main is never cancelled, since that's what the README badge points at.

Speed

Measured from the last main run: windows 108s, macos 74s, linux 47s, lint 9s.

Change	Why
sccache on windows	It had no compiler cache at all and was the slowest job. ccache doesn't support MSVC; sccache does.
Drop brew install gcc on macos	Nothing used it — the build runs CXX=c++, which is AppleClang. This was the single most expensive step in that job.
Cache subprojects/packagecache	Keyed on the wrap files, so fmt/doctest/abseil tarballs aren't re-downloaded every run.
Per-job ccache keys	The jobs were sharing one key and evicting each other.
--print-errorlogs instead of -v	-v printed the full output of every passing test. Failures still print inline, and the log artifact is unchanged.
meson/ninja via pip on macos	Consistent with the other jobs, and faster than brew.

New: sanitizers job

Address + undefined behaviour, clang++ at --buildtype=debugoptimized, with detect_stack_use_after_return=1 and halt_on_error=1.

clang rather than g++ deliberately: unit/bad_alloc.cpp deliberately allocates max_size() to check it throws std::bad_alloc, and has to be skipped under asan. It detects this via __has_feature, which g++ only gained in version 14.

I also fixed that detection to fall back to __SANITIZE_ADDRESS__ / __SANITIZE_THREAD__, so a g++ sanitizer build works too — without it, asan aborts on the huge allocation instead of letting it throw.

New: hardened job

The flags a distribution build would use:

-D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS -fstack-protector-strong
-fstack-clash-protection -fcf-protection=full
-Wformat -Wformat-security -Werror=format-security
-Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack

_GLIBCXX_ASSERTIONS is the one that actually matters for a container — it turns on libstdc++'s precondition checks (bounds, iterator validity).

These apply only to the CI builds. svector is header-only, so meson.build keeps its existing flags and users pick their own.

Verification

Ran the exact commands the workflow produces, verbatim:

• sanitizers: 61 test cases passed, 617011 assertions, Ok: 2, Fail: 0
• hardened: Ok: 2, Fail: 0

And confirmed the hardening isn't silently dropped — checked compile_commands.json for every flag, and the resulting binary:

GNU_RELRO ... R          <- full RELRO
FLAGS      BIND_NOW
GNU_STACK  ... RW        <- non-executable stack
__stack_chk_fail present

One thing I could not test locally

CXX: sccache cl on windows. I have no MSVC here. sccache + MSVC historically needs /Z7 rather than /Zi for debug info, and meson's default buildtype uses /Zi — so this may need --buildtype=release or a /Z7 override. If the windows job goes red, that's the reason, and it's a one-line follow-up. Everything else is verified.

🤖 Generated with Claude Code

[martinus]

Correction: abseil was never being built in CI

I claimed earlier that the abseil subproject was the largest remaining compile cost. That was wrong, and I want to be explicit about it since it was the stated reason for this change.

A wrap is only consulted as a fallback, and meson does not fall back for an optional dependency. Every CI run has actually been resolving it as:

Run-time dependency absl_container found: NO  (tried pkg-config and cmake)

with no subproject built. The abseil sources only ever compiled under --wrap-mode=forcefallback — which is what my local verification builds used, and is where I got the wrong impression. Nothing in CI passes that flag.

So this commit does not speed up CI. What it does:

	before	after
absl objects, plain meson setup (= CI)	0	0
absl objects, --wrap-mode=forcefallback	160	0
full clean forcefallback build, local	3.22s	1.82s

It removes a stale 2023 pin and a dependency lookup that can never succeed. Real, but cleanup rather than a speedup.

All abseil use in the tests is behind ANKERL_SVECTOR_HAS_ABSL(), driven by __has_include, so the benchmarks and show_comparison build unchanged. Installing abseil system-wide brings the comparison back — boost already works exactly this way.