Harden security-sensitive input handling (#3045)

* harden security-sensitive input handling

* enable ctest failure checks in ci

* add valgrind leak smoke tests

* split tests into separate workflow

.github/workflows/tests.yml

@@ -0,0 +1,57 @@
+name: tests
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  tests:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install dependencies (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libpcre2-dev libmbedtls-dev libsodium-dev libev-dev libc-ares-dev valgrind
+
+      - name: Install dependencies (macOS)
+        if: runner.os == 'macOS'
+        run: brew install mbedtls@3 libsodium libev c-ares pcre2
+
+      - name: Build test binaries
+        run: |
+          mkdir -p build && cd build
+          cmake .. -DCMAKE_BUILD_TYPE=Release
+          jobs="$(nproc 2>/dev/null || sysctl -n hw.ncpu)"
+          make -j"$jobs"
+
+      - name: CTest
+        run: ctest --test-dir build -LE memcheck --output-on-failure --no-tests=error
+
+      - name: Valgrind leak smoke tests
+        if: runner.os == 'Linux'
+        run: ctest --test-dir build -L memcheck --output-on-failure --no-tests=error
+
+      - name: ss-setup TUI tests
+        run: bash tests/test_ss_setup.sh
+
+      - name: Stress test
+        run: |
+          python3 tests/stress_test.py --bin build/shared/bin/ --size 10
+
+      - name: ss-redir transparent proxy test (QEMU)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get install -y qemu-system-x86
+          bash tests/test_redir_qemu.sh build/shared/bin/
+        timeout-minutes: 8