Skip to content

Enable CastGuard in Windows native builds - #7793

Merged
matouskozak merged 3 commits into
mainfrom
matouskozak-binskim-error-fixes
Oct 14, 2026
Merged

matouskozak merged 3 commits into
mainfrom
matouskozak-binskim-error-fixes

Conversation

@matouskozak

@matouskozak matouskozak commented Oct 14, 2026 •

Copy link
Copy Markdown
Member

Summary

  • Add /guard:cast alongside the existing options.
  • Replace the compiler /DEBUG option with /Z7 so the object files contain compiler debug metadata that BinSkim can use to verify the hardening settings.
  • Add a short Windows build prerequisite noting that the C++ toolset must support /guard:cast.

matouskozak and others added 3 commits October 13, 2026 19:25
Generate compiler debug metadata with /Z7 and retain CFG. Resolve the newly visible oneDAL compiler-warning errors without suppressions, check narrowing conversions, and document native build requirements.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: a64691c7-3c54-4513-8fbf-ab39a2eb744b
Restore the original oneDAL umbrella header, warning suppressions, and source. Defer the SDK upgrade to #7792 and the associated narrowing-conversion cleanup to that follow-up.

Retain /Z7 because adding /guard:cast alone still produces BA2028 for every native DLL in local reproduction. The focused patch clears CastGuard on x64/x86 but intentionally leaves the newly visible OneDalNative BA2007 finding (existing /wd4996 and /wd4267) for the follow-up, as agreed.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: a64691c7-3c54-4513-8fbf-ab39a2eb744b
Keep the Windows build guide focused on the compiler prerequisite. Explain debug metadata and BinSkim verification in the pull request instead.

Co-authored-by: Copilot App <[email protected]>
Copilot-Session: a64691c7-3c54-4513-8fbf-ab39a2eb744b
@codecov

codecov Bot commented Oct 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.96%. Comparing base (eb62d29) to head (2d56547).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #7793   +/-   ##
=======================================
  Coverage   69.95%   69.96%           
=======================================
  Files        1419     1419           
  Lines      272603   272603           
  Branches    27562    27562           
=======================================
+ Hits       190698   190714   +16     
+ Misses      73718    73701   -17     
- Partials     8187     8188    +1     
Flag Coverage Δ
Debug 69.96% <ø> (+<0.01%) ⬆️
production 64.15% <ø> (+<0.01%) ⬆️
test 89.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 7 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@matouskozak
matouskozak merged commit 8374db9 into main Oct 14, 2026
28 checks passed
@matouskozak
matouskozak deleted the matouskozak-binskim-error-fixes branch October 14, 2026 11:54
@matouskozak

Copy link
Copy Markdown
Member Author

/backport to release/6.0

@github-actions

Copy link
Copy Markdown
Contributor

Started backporting to release/6.0 (link to workflow run)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants