coverage CI: fix four CI failures

- Validation regex: allow `.` in coverage-artifact-name so matrix
  labels like `ubuntu-24.04` pass.
- FreeBSD: llvm19 port installs versioned binaries (clang19,
  clang++19, llvm-cov19, llvm-profdata19) directly under
  /usr/local/bin/, not /usr/local/llvm19/bin/. Update absolute
  paths.
- macOS: brew clang on the Apple SDK warns -Wundef on the SDK's
  `__STDC_VERSION__` check because brew clang doesn't treat the
  SDK as system headers by default. Export SDKROOT in the
  dependencies step so brew clang picks up the SDK as a sysroot
  (system include path), suppressing -Wundef in those headers.
- Self-host coverage export: ls with two glob arguments returns
  nonzero when one glob has no match (e.g. .dylib on Linux), and
  pipefail propagated the failure. Use bash nullglob + array
  instead.

Co-authored-by: Copilot <copilot@github.com>

Author: mjp41

.github/workflows/coverage.yml

@@ -53,7 +53,14 @@ jobs:
             # `xcrun`). The coverage target's find_program(LLVM_COV ...)
             # only looks for unversioned/-19/-15 names, so we install
             # llvm@19 via brew and pass the explicit binary paths.
-            dependencies: 'brew install --quiet ninja llvm@19'
+            #
+            # SDKROOT is exported in the dependencies step so brew
+            # clang treats the Apple SDK as a system header path,
+            # which suppresses -Wundef on Apple's _STDC_VERSION_
+            # check inside <sys/cdefs.h>.
+            dependencies: |
+              brew install --quiet ninja llvm@19
+              echo "SDKROOT=$(xcrun --show-sdk-path)" >> "$GITHUB_ENV"
             extra-cmake-flags: >-
               -DCMAKE_CXX_COMPILER=/opt/homebrew/opt/llvm@19/bin/clang++
               -DCMAKE_C_COMPILER=/opt/homebrew/opt/llvm@19/bin/clang
@@ -114,20 +121,17 @@ jobs:
           - label: freebsd-14
             vm-type: freebsd
             vm-version: '14.1'
-            # FreeBSD's llvm19 port installs binaries with a numeric
-            # suffix and no dash (clang19, llvm-cov19,
-            # llvm-profdata19) under /usr/local/llvm19/bin/. The base
-            # CMakeLists.txt's find_program list only knows the
-            # dashed forms (-19/-15) and bare names; we sidestep the
-            # search entirely by passing absolute paths via -D so the
-            # find_program cache is preset with a fully-qualified
-            # binary that doesn't depend on PATH.
+            # FreeBSD's llvm19 port installs versioned binaries
+            # (clang19, clang++19, llvm-cov19, llvm-profdata19)
+            # directly under /usr/local/bin/ — not under a
+            # /usr/local/llvm19/bin/ subtree. Pass absolute paths so
+            # find_program is preset and doesn't depend on PATH.
             dependencies: 'pkg install -y cmake ninja llvm19'
             cmake-flags: >-
-              -DCMAKE_CXX_COMPILER=/usr/local/llvm19/bin/clang++19
-              -DCMAKE_C_COMPILER=/usr/local/llvm19/bin/clang19
-              -DLLVM_COV=/usr/local/llvm19/bin/llvm-cov19
-              -DLLVM_PROFDATA=/usr/local/llvm19/bin/llvm-profdata19
+              -DCMAKE_CXX_COMPILER=/usr/local/bin/clang++19
+              -DCMAKE_C_COMPILER=/usr/local/bin/clang19
+              -DLLVM_COV=/usr/local/bin/llvm-cov19
+              -DLLVM_PROFDATA=/usr/local/bin/llvm-profdata19
           - label: netbsd-10
             vm-type: netbsd
             vm-version: '10.0'

.github/workflows/reusable-cmake-build.yml

@@ -87,8 +87,8 @@ jobs:
           tests|tests+selfhost) ;;
           *) echo "::error::coverage-mode must be one of: off, tests, tests+selfhost (got '${{ inputs.coverage-mode }}')" ; exit 1 ;;
         esac
-        if ! [[ "${{ inputs.coverage-artifact-name }}" =~ ^[A-Za-z0-9_-]+$ ]]; then
-          echo "::error::coverage-artifact-name must match ^[A-Za-z0-9_-]+\$ when coverage-mode != 'off' (got '${{ inputs.coverage-artifact-name }}')"
+        if ! [[ "${{ inputs.coverage-artifact-name }}" =~ ^[A-Za-z0-9._-]+$ ]]; then
+          echo "::error::coverage-artifact-name must match ^[A-Za-z0-9._-]+\$ when coverage-mode != 'off' (got '${{ inputs.coverage-artifact-name }}')"
           exit 1
         fi
 
@@ -203,11 +203,15 @@ jobs:
         # libsnmallocshim-checks.so) the caller is expected to schedule
         # one matrix leg per variant; this step exports against whichever
         # one is present in libs/.
-        shim=$(ls libs/libsnmallocshim*.so libs/libsnmallocshim*.dylib 2>/dev/null | head -1)
-        if [ -z "$shim" ]; then
+        # Glob via bash nullglob so a missing pattern (e.g. no .dylib on
+        # Linux) doesn't fail the pipeline under `pipefail`.
+        shopt -s nullglob
+        shims=( libs/libsnmallocshim*.so libs/libsnmallocshim*.dylib )
+        if [ ${#shims[@]} -eq 0 ]; then
           echo "::error::no shim built; cannot export selfhost coverage"
           exit 1
         fi
+        shim="${shims[0]}"
         llvm-profdata merge -sparse profiles/selfhost-*.profraw -o selfhost.profdata
         llvm-cov export -format=json -instr-profile=selfhost.profdata \
           -object "$shim" > selfhost.json

.github/workflows/reusable-vm-build.yml

@@ -60,8 +60,8 @@ jobs:
           tests) ;;
           *) echo "::error::coverage-mode must be one of: off, tests (got '${{ inputs.coverage-mode }}')" ; exit 1 ;;
         esac
-        if ! [[ "${{ inputs.coverage-artifact-name }}" =~ ^[A-Za-z0-9_-]+$ ]]; then
-          echo "::error::coverage-artifact-name must match ^[A-Za-z0-9_-]+\$ when coverage-mode != 'off' (got '${{ inputs.coverage-artifact-name }}')"
+        if ! [[ "${{ inputs.coverage-artifact-name }}" =~ ^[A-Za-z0-9._-]+$ ]]; then
+          echo "::error::coverage-artifact-name must match ^[A-Za-z0-9._-]+\$ when coverage-mode != 'off' (got '${{ inputs.coverage-artifact-name }}')"
           exit 1
         fi