ci-cpp-analysis.yml

# C++ analysis lane (cppcheck + diff-based clang-tidy). Runs on push/PR
# in parallel with build-engine and does not wait for the engine artifact.
#
# clang-tidy is DIFF-BASED: it lints only the first-party C++ TUs
# changed in the PR (task lint:cpp:tidy-changed), so a typical PR runs in
# seconds/minutes instead of the multi-hour full-tree sweep. The full
# sweep (task lint:cpp:tidy-parallel) stays available for manual runs.
#
# Mirror of `task ci:cpp-analysis` (cppcheck, compile_commands,
# tidy-changed). The build/test gate lives in ci.yml (workflow_run).

name: ci-cpp-analysis

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-cpp-analysis-${{ github.ref }}
  cancel-in-progress: true

jobs:
  cpp-analysis:
    name: cpp-analysis (cppcheck + clang-tidy)
    runs-on: ubuntu-latest
    timeout-minutes: 90
    steps:
      - name: Checkout
        uses: actions/checkout@v5
        with:
          # Full history so the diff-based clang-tidy step can resolve
          # the PR/push merge-base (BASE...HEAD).
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: '1.26'
          cache: true

      - name: Install Task
        uses: go-task/setup-task@v2
        with:
          version: 3.x
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install C++ lint and Bazel query deps
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            clang \
            clang-format \
            clang-tidy-18 \
            cppcheck \
            libprotobuf-dev \
            protobuf-compiler \
            libgrpc++-dev \
            libgrpc-dev \
            protobuf-compiler-grpc
          # Bazel aquery emits clang-18 flags (e.g. -fno-canonical-system-headers)
          # that the distro's default clang-tidy package does not understand.
          sudo ln -sf /usr/bin/clang-tidy-18 /usr/local/bin/clang-tidy

      - name: Restore GoogleSQL prebuilt cache
        uses: actions/cache@v5
        with:
          path: .cache/googlesql-prebuilt
          key: googlesql-prebuilt-${{ vars.GOOGLESQL_PREBUILT_SHA256 || 'source' }}

      - name: Set up Bazel (bazelisk)
        uses: bazel-contrib/setup-bazel@0.19.0
        with:
          bazelisk-cache: true
          disk-cache: engine-v2
          cache-version: 2
          repository-cache: true

      - name: Resolve GoogleSQL build mode
        id: googlesql
        uses: ./.github/actions/setup-googlesql
        with:
          prebuilt-url: ${{ vars.GOOGLESQL_PREBUILT_URL }}
          prebuilt-sha256: ${{ vars.GOOGLESQL_PREBUILT_SHA256 }}

      - name: cppcheck on first-party C++ tree
        run: task lint:cpp:cppcheck

      - name: Generate compile_commands.json
        env:
          GOOGLESQL_SOURCE: ${{ steps.googlesql.outputs.googlesql-source }}
        run: task lint:cpp:compile-commands

      - name: clang-tidy (changed first-party files)
        env:
          BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
          HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
          JOBS: "4"
          LOG: lint-cpp-tidy.log
        run: task lint:cpp:tidy-changed

      - name: Upload clang-tidy log on failure
        if: failure()
        uses: actions/upload-artifact@v6
        with:
          name: lint-cpp-tidy-log
          path: lint-cpp-tidy.log
          if-no-files-found: ignore
          retention-days: 7

      - name: Release Bazel daemon
        if: always()
        run: timeout 60 bazel shutdown || true