Enable SHSTK in CI

Author: arnaud-lb

.github/workflows/nightly.yml

@@ -122,7 +122,7 @@ jobs:
       fail-fast: false
       matrix:
         branch: ${{ fromJson(needs.GENERATE_MATRIX.outputs.branches) }}
-        configuration_parameters: ['']
+        configuration_parameters: ['CFLAGS="-fcf-protection=full" LDFLAGS="-Wl,-z,cet-report=error"']
         debug: [true, false]
         name: ['']
         run_tests_parameters: ['']
@@ -163,12 +163,16 @@ jobs:
         uses: ./.github/actions/setup-x64
       - name: Test
         uses: ./.github/actions/test-linux
+        env:
+          GLIBC_TUNABLES: 'glibc.cpu.hwcaps=SHSTK'
         with:
           runTestsParameters: >-
             ${{ matrix.run_tests_parameters }}
           idleCpu: ${{ matrix.asan && 'true' || 'false' }}
       - name: Test Tracing JIT
         uses: ./.github/actions/test-linux
+        env:
+          GLIBC_TUNABLES: 'glibc.cpu.hwcaps=SHSTK'
         with:
           jitType: tracing
           runTestsParameters: >-

.github/workflows/push.yml

@@ -123,7 +123,7 @@ jobs:
           configurationParameters: >-
             --${{ matrix.debug && 'enable' || 'disable' }}-debug
             --${{ matrix.zts && 'enable' || 'disable' }}-zts
-            ${{ matrix.asan && 'CFLAGS="-fsanitize=undefined,address -DZEND_TRACK_ARENA_ALLOC" LDFLAGS="-fsanitize=undefined,address" CC=clang-16 CXX=clang++-16' || '' }}
+            ${{ matrix.asan && 'CFLAGS="-fsanitize=undefined,address -DZEND_TRACK_ARENA_ALLOC" LDFLAGS="-fsanitize=undefined,address" CC=clang-16 CXX=clang++-16' || 'CFLAGS="-fcf-protection=full" LDFLAGS="-Wl,-z,cet-report=error"' }}
           skipSlow: ${{ matrix.asan }}
       - name: make
         run: make -j$(/usr/bin/nproc) >/dev/null
@@ -135,8 +135,12 @@ jobs:
       - name: Test
         if: matrix.asan == false
         uses: ./.github/actions/test-linux
+        env:
+          GLIBC_TUNABLES: 'glibc.cpu.hwcaps=SHSTK'
       - name: Test Tracing JIT
         uses: ./.github/actions/test-linux
+        env:
+          GLIBC_TUNABLES: ${{ !matrix.asan && 'glibc.cpu.hwcaps=SHSTK' || '' }}
         with:
           jitType: tracing
           runTestsParameters: >-