cpp-linter.yml

name: cpp-linter

on:
  pull_request:
    types: [opened, reopened, synchronize]
    paths: &paths ['**.c', '**.h', '**.cpp', '**.hpp', '.clang-format', '.github/workflows/cpp-linter.yml']
  push:
    # Branch-scoped, path filters are ignored for tag pushes so every release tag would re-lint
    branches: [develop, beta, master]
    paths: *paths
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

defaults:
  run:
    shell: bash

jobs:
  cpp-linter:
    name: C/C++ Linter
    runs-on: ubuntu-latest
    timeout-minutes: 10

    permissions:
      contents: read
      pull-requests: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      # clang-format only, so no ESP-IDF or compile database is needed
      - uses: cpp-linter/cpp-linter-action@774040af57f011a5fc47911f08ff0c3059d1835a # v2.24.0
        id: linter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          style: file
          version: 21
          tidy-checks: '-*' # clang-tidy rejects the gcc-only flags of the ESP-IDF compile DB, CodeQL covers static analysis
          files-changed-only: false # GitHub returns 406 for very large PR diffs
          ignore: '.github|build|managed_components|components/flatbuffers|components/serialization/include/serialization/_fbs'
          thread-comments: ${{ github.event_name == 'pull_request' && 'update' || 'false' }} # Commit comments on push need contents:write

      # Advisory on beta and master (pushes and PRs targeting them): findings are still reported, but they don't fail the job
      - name: Fail on lint errors
        if: steps.linter.outputs.checks-failed > 0 && !contains(fromJSON('["beta", "master"]'), github.base_ref || github.ref_name)
        run: |
          echo "::error::Some files failed the linting checks!"
          exit 1