test: add container plugin correctness validator and CI

.github/workflows/main.yml

@@ -71,6 +71,15 @@ jobs:
       collector-builder-tag: ${{ needs.build-builder-image.outputs.collector-builder-tag }}
     secrets: inherit
 
+  plugin-validator:
+    uses: ./.github/workflows/plugin-validator.yml
+    permissions:
+      contents: read
+    needs:
+      - build-builder-image
+    with:
+      collector-builder-tag: ${{ needs.build-builder-image.outputs.collector-builder-tag }}
+
   integration-tests:
     uses: ./.github/workflows/integration-tests.yml
     with:

.github/workflows/plugin-validator.yml

@@ -0,0 +1,75 @@
+name: Plugin correctness validator
+
+on:
+  workflow_call:
+    inputs:
+      collector-builder-tag:
+        type: string
+        required: true
+        description: The builder tag to use in the build
+
+permissions:
+  contents: read
+
+jobs:
+  replay:
+    name: Plugin corpus (ASan/UBSan, ${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [amd64, arm64]
+    runs-on: ${{ (matrix.arch == 'arm64' && 'ubuntu-24.04-arm') || 'ubuntu-24.04' }}
+    timeout-minutes: 45
+    container:
+      image: quay.io/stackrox-io/collector-builder:${{ inputs.collector-builder-tag }}
+    defaults:
+      run:
+        shell: bash
+    env:
+      ASAN_OPTIONS: detect_leaks=1:halt_on_error=1
+      UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize required submodules and record revisions
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git submodule update --init --depth 1 falcosecurity-libs collector/proto/third_party/stackrox
+          mkdir -p artifacts
+          {
+            git rev-parse HEAD
+            git submodule status falcosecurity-libs collector/proto/third_party/stackrox
+            echo "Builder: quay.io/stackrox-io/collector-builder:${{ inputs.collector-builder-tag }}"
+            uname -sm
+            c++ --version
+          } | tee artifacts/revisions.txt
+
+      - name: Configure sanitizer replay target
+        run: |
+          cmake -S . -B cmake-build \
+            -DBUILD_PLUGIN_REPLAY_TESTS=ON \
+            -DADDRESS_SANITIZER=ON \
+            -DCMAKE_BUILD_TYPE=Debug \
+            -DDISABLE_PROFILING=ON \
+            '-DCMAKE_C_FLAGS=-fsanitize=address,undefined -fno-omit-frame-pointer' \
+            2>&1 | tee artifacts/configure.log
+
+      - name: Build validator and production plugin
+        run: |
+          cmake --build cmake-build --target ContainerPluginReplayTest --parallel 2 \
+            2>&1 | tee artifacts/build.log
+
+      - name: Replay corpus
+        run: |
+          bash collector/test/plugin-replay/run-corpus.sh \
+            "$GITHUB_WORKSPACE/cmake-build" "$GITHUB_WORKSPACE/artifacts/replay"
+
+      - name: Upload validation evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: plugin-validator-${{ matrix.arch }}-${{ github.run_attempt }}
+          path: artifacts/
+          if-no-files-found: warn
+          retention-days: 14

collector/CMakeLists.txt

@@ -104,4 +104,12 @@ set(MODERN_BPF_DEBUG_MODE ${BPF_DEBUG_MODE} CACHE BOOL "Enable BPF debug prints"
 
 set(MODERN_BPF_EXCLUDE_PROGS "^(openat2|ppoll|setsockopt|io_uring_setup|nanosleep|pread64|preadv|pwritev|read|readv|writev|recv|process_vm_readv|process_vm_writev)$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
 
+option(BUILD_PLUGIN_REPLAY_TESTS "Build isolated plugin replay tests" OFF)
+if(BUILD_PLUGIN_REPLAY_TESTS)
+    set(HAS_ENGINE_TEST_INPUT ON)
+endif()
 add_subdirectory(${FALCO_DIR} falco)
+
+if(BUILD_PLUGIN_REPLAY_TESTS)
+    add_subdirectory(test/plugin-replay)
+endif()

collector/test/plugin-replay/CMakeLists.txt

@@ -0,0 +1,22 @@
+# Reuse the pinned upstream fixture without enabling its entire test suite.
+find_package(GTest CONFIG REQUIRED)
+set(FALCO_TEST_DIR "${FALCO_DIR}/userspace/libsinsp/test")
+configure_file("${FALCO_TEST_DIR}/libsinsp_test_var.h.in"
+               "${CMAKE_CURRENT_BINARY_DIR}/libsinsp_test_var.h")
+file(GLOB FALCO_TEST_HELPERS "${FALCO_TEST_DIR}/helpers/*.cpp")
+add_library(collector_replay_support STATIC
+    "${FALCO_TEST_DIR}/sinsp_with_test_input.cpp"
+    "${FALCO_TEST_DIR}/test_utils.cpp"
+    ${FALCO_TEST_HELPERS})
+target_include_directories(collector_replay_support PUBLIC
+    "${FALCO_DIR}" "${FALCO_TEST_DIR}" "${CMAKE_CURRENT_BINARY_DIR}")
+target_link_libraries(collector_replay_support PUBLIC sinsp GTest::gtest)
+
+add_executable(ContainerPluginReplayTest ContainerPluginReplayTest.cpp)
+target_link_libraries(ContainerPluginReplayTest PRIVATE
+    collector_replay_support collector_lib GTest::gtest_main)
+add_dependencies(ContainerPluginReplayTest collector-container-plugin)
+add_test(NAME ContainerPluginReplayTest COMMAND ContainerPluginReplayTest)
+set_tests_properties(ContainerPluginReplayTest PROPERTIES
+    TIMEOUT 30
+    ENVIRONMENT "ROX_COLLECTOR_CONTAINER_PLUGIN_PATH=$<TARGET_FILE:collector-container-plugin>")