Fortify #59

	# SPDX-FileCopyrightText: 2006-2024 Knut Reinert & Freie Universität Berlin
	# SPDX-FileCopyrightText: 2016-2024 Knut Reinert & MPI für molekulare Genetik
	# SPDX-License-Identifier: CC0-1.0

	name: Fortify

	on:
	schedule:
	- cron: "0 8 * * SAT"
	workflow_dispatch:

	concurrency:
	group: fortify-actions
	cancel-in-progress: true

	env:
	SHARG_NO_VERSION_CHECK: 1
	TZ: Europe/Berlin

	defaults:
	run:
	shell: bash -Eeuxo pipefail {0}

	jobs:
	build:
	name: Fortify ${{ matrix.build_type }}
	runs-on: ubuntu-latest
	if: github.repository_owner == 'seqan' \|\| github.event_name == 'workflow_dispatch'
	strategy:
	fail-fast: false
	matrix:
	include:
	- build_type: Release
	cxx_flags: "-fcf-protection=check"

	- build_type: Debug
	cxx_flags: "-fcf-protection=full"
	container:
	image: ghcr.io/seqan/gcc-14
	volumes:
	- /home/runner:/home/runner
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Configure tests
	run: \|
	mkdir build && cd build
	cmake ../test/unit -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} \
	-DCMAKE_CXX_FLAGS="-fexceptions -g -grecord-gcc-switches -pipe -Werror=format -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fstack-protector-strong -mtune=native -fasynchronous-unwind-tables -fstack-clash-protection -Wno-interference-size ${{ matrix.cxx_flags }}"
	make gtest_main

	- name: Build tests
	working-directory: build
	run: make -k

	- name: Run tests
	working-directory: build
	run: ctest . -j --output-on-failure

Provide feedback