From 9ddf0ab9abdee5424514e624b2dd0905136b3aca Mon Sep 17 00:00:00 2001
From: Rot127 <45763064+Rot127@users.noreply.github.com>
Date: Sat, 20 Jun 2026 17:56:41 +0000
Subject: [PATCH] Fix Leak checking workflow (#6532)

* Fix leak workflow by passing changes as file instead of env variables.
* Upload PR changes as file
---
 .github/workflows/get_real_pr_shas.yml | 19 +++++++------------
 .github/workflows/leaks.yml            | 11 +++++++----
 sys/lsan_check.py                      | 11 ++++++++---
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/get_real_pr_shas.yml b/.github/workflows/get_real_pr_shas.yml
index abca0d93b6..170a1087c1 100644
--- a/.github/workflows/get_real_pr_shas.yml
+++ b/.github/workflows/get_real_pr_shas.yml
@@ -30,7 +30,7 @@
 # Use `${{ needs.real_pr_shas.outputs.BASE_SHA }}` to get the real base sha.
 # Use `${{ needs.real_pr_shas.outputs.HEAD_SHA }}` to get the PR head commit sha.
 # Use `${{ needs.real_pr_shas.outputs.COMMIT_MSGS }}` to get the commit messages of git log --pretty=%B BASE_SHA..HEAD_SHA
-# Use `${{ needs.real_pr_shas.outputs.CHANGES }}` to get the commit messages of `git diff --unified=0 "$BASE_SHA".."$HEAD_SHA" | grep -E '^\+\+\+|^---|^@@.+@@'`
+# The commit messages of `git diff --unified=0 "$BASE_SHA".."$HEAD_SHA" | grep -E '^\+\+\+|^---|^@@.+@@'` are uploaded under the name 'pr_changes' as 'pr_changes.diff' (not archived).
 #
 # This workflow is copied from https://github.com/JensDll/should-run/blob/main/.github/workflows/main.yaml#L54
 #
@@ -52,9 +52,6 @@ on:
       COMMIT_MSGS:
         description: "The commit messages of BASE_SHA..HEAD_SHA"
         value: ${{ jobs.get_real_pr_shas.outputs.output_msgs }}
-      CHANGES:
-        description: "The commit messages of BASE_SHA..HEAD_SHA and reduced to only changed lines and files"
-        value: ${{ jobs.get_real_pr_shas.outputs.output_changes }}
 
 jobs:
   get_real_pr_shas:
@@ -63,7 +60,6 @@ jobs:
       output_base: ${{ steps.get_shas.outputs.BASE_SHA }}
       output_head: ${{ steps.get_shas.outputs.HEAD_SHA }}
       output_msgs: ${{ steps.get_shas.outputs.COMMIT_MSGS }}
-      output_changes: ${{ steps.get_shas.outputs.CHANGES }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
@@ -86,12 +82,10 @@ jobs:
             echo "Failed to get diff"
             exit 2
           fi
-          CHANGES=$(echo "$CHANGES | grep -E '^\+\+\+|^@@.+@@'")
+          echo "$CHANGES | grep -E '^\+\+\+|^@@.+@@'" > pr_changes.diff
 
           echo "BASE_SHA=$BASE_SHA"
           echo "HEAD_SHA=$HEAD_SHA"
-          echo -e "\nCHANGES=\n$CHANGES"
-          echo -e "\nCOMMIT_MSGS:\n$COMMIT_MSGS"
 
           echo "BASE_SHA=$BASE_SHA" >> $GITHUB_OUTPUT
           echo "HEAD_SHA=$HEAD_SHA" >> $GITHUB_OUTPUT
@@ -105,7 +99,8 @@ jobs:
           echo "$COMMIT_MSGS" >> $GITHUB_OUTPUT
           echo "$EOF" >> $GITHUB_OUTPUT
 
-          EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
-          echo "CHANGES<<$EOF" >> $GITHUB_OUTPUT
-          echo "$CHANGES" >> $GITHUB_OUTPUT
-          echo "$EOF" >> $GITHUB_OUTPUT
+      - uses: actions/upload-artifact@v7
+        with:
+          name: pr_changes.diff
+          archive: false
+          path: pr_changes.diff
diff --git a/.github/workflows/leaks.yml b/.github/workflows/leaks.yml
index 43c0089a40..dda7655e87 100644
--- a/.github/workflows/leaks.yml
+++ b/.github/workflows/leaks.yml
@@ -46,6 +46,12 @@ jobs:
         with:
           fetch-depth: 2
 
+      - name: Download git diff of PR
+        uses: actions/download-artifact@v8
+        with:
+          name: pr_changes.diff
+          path: pr_changes.diff
+
       - name: Install python and other dependencies
         run: sudo apt-get --assume-yes install python3-wheel python3-setuptools libcapstone4 libcapstone-dev
 
@@ -113,8 +119,5 @@ jobs:
           path: lsan_reports.tgz
 
       - name: Check for new leaks
-        env:
-          CHANGES: ${{ needs.real_pr_shas.outputs.CHANGES }}
         run: |
-          echo "$CHANGES" > changes.diff
-          ./sys/lsan_check.py changes.diff $LSAN_LOGS_DIR/*
+          ./sys/lsan_check.py pr_changes.diff/pr_changes.diff $LSAN_LOGS_DIR
diff --git a/sys/lsan_check.py b/sys/lsan_check.py
index 3de14f7ab2..40ad48d8e1 100755
--- a/sys/lsan_check.py
+++ b/sys/lsan_check.py
@@ -59,8 +59,14 @@ def parse_asan_leaks(
 def main() -> None:
     if len(sys.argv) < 3:
         print("Supply ASAN output via stdin or file argument")
-        print(f"{sys.argv[0]} <some.diff> [<file.log> ...]")
+        print(f"{sys.argv[0]} <some.diff> <log_dir>")
         sys.exit(2)
+
+    log_dir = Path(sys.argv[2])
+    if not log_dir.is_dir():
+        print(f"'{sys.argv[2]}' should be a directory")
+        sys.exit(1)
+
     diff_file = sys.argv[1]
     with open(diff_file, "r", encoding="utf8") as f:
         diff = f.read()
@@ -72,8 +78,7 @@ def main() -> None:
     print(changed)
 
     asan_text = ""
-    for i in range(2, len(sys.argv)):
-        p = Path(sys.argv[i])
+    for p in log_dir.rglob("*"):
         if p.is_dir():
             print(f"Skip dir: {p}")
             continue