Clang tidy via annotations (#3364)

* Clang tidy via annotations

* list contents of build

* Add source dir

* Use fork for testing

* pin to commit

* Add some more exclusions

* args as string

* system includes in step output

* system includes to output, not env

.clang-tidy

@@ -31,6 +31,11 @@ Checks: >
   -cppcoreguidelines-special-member-functions,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-avoid-do-while,
+  -cppcoreguidelines-pro-type-static-cast-downcast,
+  -cppcoreguidelines-pro-bounds-pointer-arithmetic,
+  -bugprone-easily-swappable-parameters,
+  -cppcoreguidelines-avoid-magic-numbers,  
+  -readability-identifier-length
 WarningsAsErrors: false # should be true once we get there
 HeaderFileExtensions:         ['h','hh','hpp','hxx']
 ImplementationFileExtensions: ['c','cc','cpp','cxx']

.github/workflows/clang-tidy.yml

@@ -1,6 +1,6 @@
 name: Clang Tidy
 on:
-  pull_request_target: # Required to post comments on PR from forks
+  pull_request: # Required to post comments on PR from forks
 jobs:
   clang-tidy-review:
     runs-on: ubuntu-latest
@@ -13,22 +13,15 @@ jobs:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           submodules: recursive
 
-      - name: Dump GitHub context
-        env:
-          GITHUB_CONTEXT: ${{ toJson(github) }}
-        run: echo "$GITHUB_CONTEXT"
-
       - name: Install clang-tidy
         run: |
           sudo debconf-communicate <<< "set man-db/auto-update false"
           sudo dpkg-reconfigure man-db        
           sudo apt-get update
+          sudo apt-get remove -y ^clang-tidy
           sudo apt-get install -y clang-19 clang-tidy-19
+          sudo update-alternatives --install /usr/bin/clang-tidy clang-tidy /usr/bin/clang-tidy-19 100
 
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-          cache: "pip"
       - name: Generate compilation database
         run: |
           cd ${{ github.workspace }}
@@ -37,41 +30,30 @@ jobs:
           sed -i 's/-fdevirtualize-at-ltrans//g' build/compile_commands.json
           sed -i 's/-fuse-linker-plugin//g' build/compile_commands.json
 
-      - name: Install clang-tidy-review
-        run: pip install ${{github.workspace}}/contrib/clang_tidy_review
-
       - name: Extract system includes from GCC
+        id: extract_system_includes
         run: |
           ${{ github.workspace }}/toolchain/current/arm-none-eabi-gcc/bin/arm-none-eabi-g++ -mcpu=cortex-a9 -mfpu=neon -mfloat-abi=hard -E -x c++ - -v < /dev/null 2>&1           \
             | sed -n '/^#include <...> search starts here:$/,/^End of search list.$/p' \
             | tail -n +2 \
             | head -n -1 \
             | sed 's/^\s*//g' \
-            | sed 's/^\(.*\)$/--extra-arg-before=-isystem\1/g' > system_includes.txt
+            | sed 's/^\(.*\)$/--extra-arg-before=-isystem\1/g' \
+            | tr '\n' ' ' > system_includes.txt
+          echo "system_includes=$(cat system_includes.txt)" >> $GITHUB_OUTPUT
           echo "Extracted system includes:"
           cat system_includes.txt
 
-      - name: Run clang-tidy-review
-        run: |
-          review \
-            --token=${{ secrets.GITHUB_TOKEN }} \
-            --repo=${{ github.event.pull_request.base.repo.full_name }} \
-            --pr=${{ github.event.pull_request.number }} \
-            --split_workflow=True \
-            --clang_tidy_binary=clang-tidy-19 \
-            --build_dir=${{ github.workspace }}/build \
-            --config_file=${{ github.workspace }}/.clang-tidy \
-            $(cat system_includes.txt) \
-            --extra-arg-before="--no-standard-includes"
-        env:
-          USER: ${{ github.event.pull_request.user.login }}
+      - name: Check clang-tidy version
+        run: clang-tidy --version
+
+      - uses: stellar-aria/clang-tidy-annotations@7a07996fe01ffaa846b0f4a5e9de3c58a3217f73 #ZehMatt/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          build_dir: ${{ github.workspace }}/build
+          source_dir: ${{ github.workspace }}
+          only_affected_lines: true
+          fail_on_problems: true
+          clang_tidy_args: ${{ steps.extract_system_includes.outputs.system_includes }} --extra-arg-before=--no-standard-includes
+          clang_tidy_file: ${{ github.workspace }}/.clang-tidy
 
-      - name: Post review
-        run: |
-          post \
-            --token=${{ secrets.GITHUB_TOKEN }} \
-            --repo=${{ github.event.pull_request.base.repo.full_name }} \
-            --lgtm-comment-body="" \
-            --annotations=True \
-            --num-comments-as-exitcode=True \
-            clang-tidy-review-output.json