ci: Add clang to nix images

[mathbunnyru]

High Level Overview of Change

This:

• renames hardcoded versions to make updates easier and naming consistent
• adds clang
• makes it work with asan/ubsan/tsan
• supports multi-arch images
• tests both compilers work with sanitizers and produce expected errors

Context of Change

API Impact

• Public API: New feature (new methods and/or new fields)
• Public API: Breaking change (in general, breaking changes should only impact the next api_version)
• libxrpl change (any change that may affect libxrpl or dependents of libxrpl)
• Peer protocol change (must be backward compatible or bump the peer protocol version)

[kuznetsss]

👍

[Copilot]

Pull request overview

Updates the Nix-based CI Docker images to include Clang alongside GCC, ensure sanitizer toolchains work correctly against a pinned glibc, and publish multi-arch images via GitHub Actions.

Changes:

• Refactors Nix flake inputs/attributes to generalize the pinned glibc snapshot and expands ci-env to provide both GCC and Clang wrappers.
• Extends the Nix Docker image build to validate Clang availability and run end-to-end sanitizer smoke tests.
• Reworks the GitHub Actions workflow to build per-arch images via a reusable workflow and merge them into multi-arch manifests on push.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
nix/utils.nix	Renames flake input wiring and exposes the pinned glibc as customGlibc.
nix/ci-env.nix	Adds a Clang toolchain wrapper and rebuilds relevant runtimes against the pinned glibc.
flake.nix	Renames the pinned nixpkgs input to nixpkgs-custom-glibc and threads it through outputs.
flake.lock	Updates lockfile node names/inputs for the renamed pinned nixpkgs snapshot.
docker/nix.Dockerfile	Adds loader-copy logic for nixos/nix base, verifies clang tools, and runs sanitizer checks.
docker/cpp_files/asan.cpp	Adds an ASan-triggering sample program.
docker/cpp_files/tsan.cpp	Adds a TSan-triggering sample program.
docker/cpp_files/ubsan.cpp	Adds a UBSan-triggering sample program.
docker/check-sanitizers.sh	Compiles/runs sanitizer samples with both g++ and clang++ and checks expected diagnostics.
cspell.config.yaml	Adds words used by new comments/workflow metadata fields.
.github/workflows/reusable-build-nix-image.yml	New reusable workflow to build and optionally push single-platform images with arch-suffixed tags.
.github/workflows/build-nix-image.yml	Uses the reusable workflow for per-arch builds and merges manifests on push.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.3%. Comparing base (3547a93) to head (82a4f0d).

Additional details and impacted files

@@            Coverage Diff            @@
##           develop   #7308     +/-   ##
=========================================
- Coverage     82.3%   82.3%   -0.0%     
=========================================
  Files         1011    1011             
  Lines        76248   76248             
  Branches      7307    7312      +5     
=========================================
- Hits         62788   62777     -11     
- Misses       13460   13471     +11     

see 5 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[bthomee]

Although this is the reusable workflow, it hardcodes the image prefix such that ghcr.io/xrplf/xrpld/nix- is duplicated.

How about changing the inputs such that you do either:

• The image prefix as a separate input in addition to the distro?, or
• the full image path and then modify DISTRO: ${{ inputs.distro }} to extract the distro from the image path?

[mathbunnyru]

I was able to remove every mention of nix in reusable-build-nix-image.yml and made it reusable-build-docker-image.yml
And removed ugly case statement and made it inline in the matrix - it's more generic and more readable now

[mathbunnyru]

For now, I'm only running sanitizers on ubuntu image.
I'll take a look later if we can make them work on other distros as well.
But this can be merged now, and it will greatly simplify further experiments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.