(iceberg-cpp) branch main updated: ci: replace cpp-linter-action with cpp-linter CLI (#838)

[ga...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

wgtmac pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/iceberg-cpp.git


The following commit(s) were added to refs/heads/main by this push:
     new f9e83ff9 ci: replace cpp-linter-action with cpp-linter CLI (#838)
f9e83ff9 is described below

commit f9e83ff9324f1fd7bb9880f318222204ca17117e
Author: YangJie <ya...@baidu.com>
AuthorDate: Thu Jul 23 23:58:00 2026 +0800

    ci: replace cpp-linter-action with cpp-linter CLI (#838)
    
    ## What
    
    `cpp-linter/cpp-linter-action` is frozen at v2.15.1. Its v2.16 release
    pulled in an untrusted dependency and was blocked by ASF Infra
    (apache/infrastructure-actions#325), and the ASF gateway ignores newer
    versions. The pinned action still runs, but it can no longer be updated.
    
    ## How
    
    The action is a thin wrapper around the `cpp-linter` PyPI package, and
    the block does not touch that package. This installs it with pip and
    calls the `cpp-linter` CLI to run clang-tidy. Because it is a `run:`
    step and not a `uses:` reference, it adds no new third-party action to
    the ASF allowlist. The `checks-failed` output and the Fail fast step
    stay as they were.
    
    Formatting is left to the pre-commit workflow, which already runs the
    pinned clang-format hook on every PR. So cpp-linter runs tidy-only:
    `--style=''`, and clang-format is not installed here. This keeps the
    clang-format version in one place instead of tracking it in two.
    `--version` points at the setup-python bin directory so clang-tidy
    resolves to the pip-installed version rather than a system clang-tidy on
    PATH.
    
    I also looked at emitting SARIF and uploading it with
    `github/codeql-action/upload-sarif`, which is allowed since it is a
    `github/*` action. That route loses the thread comment and needs an
    extra conversion step, so calling the CLI directly stays closer to what
    we have now.
    
    ## Verified
    
    CI ran the job on a temporary probe file seeded with a `NULL` and a
    mis-named member. clang-tidy resolved to the pip-installed 22.1.8 (not a
    system clang-tidy-22), flagged both issues, and set `checks-failed`, so
    the Fail fast step failed as expected. The probe has since been removed.
    
    ---
    This contribution was authored with assistance from Claude Opus 4.8, in
    line with the Iceberg guidelines for AI-assisted contributions
    (https://iceberg.apache.org/contribute/#guidelines-for-ai-assisted-contributions).
    All changes were reviewed and tested by the author.
    
    Closes #336
---
 .github/workflows/cpp-linter.yml | 46 ++++++++++++++++++++++++++++------------
 1 file changed, 33 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml
index 44dd6e35..acd6613a 100644
--- a/.github/workflows/cpp-linter.yml
+++ b/.github/workflows/cpp-linter.yml
@@ -48,6 +48,10 @@ jobs:
     env:
       SCCACHE_DIR: ${{ github.workspace }}/.sccache
       SCCACHE_CACHE_SIZE: "2G"
+      CPP_LINTER_VERSION: "1.13.0"
+      # clang-format is handled by the pre-commit workflow; cpp-linter runs
+      # clang-tidy only.
+      CLANG_TIDY_VERSION: "22.1.8"
     steps:
       - name: Checkout iceberg-cpp
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -91,24 +95,40 @@ jobs:
         with:
           path: ${{ github.workspace }}/.sccache
           key: sccache-cpp-linter-ubuntu-${{ github.run_id }}
-      - uses: cpp-linter/cpp-linter-action@0f6d1b8d7e38b584cbee606eb23d850c217d54f8 # v2.15.1
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        if: github.event_name == 'pull_request'
+        with:
+          python-version: '3.13'
+      - name: Install cpp-linter and clang tools
+        if: github.event_name == 'pull_request'
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-tidy==${CLANG_TIDY_VERSION}"
+      - name: Run cpp-linter
         id: linter
         if: github.event_name == 'pull_request'
         continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          style: file
-          tidy-checks: ''
-          version: 22
-          files-changed-only: true
-          lines-changed-only: true
-          thread-comments: true
-          ignore: 'build|cmake_modules|ci|src/iceberg/catalog/hive/gen-cpp'
-          database: build
-          verbosity: 'debug'
-          # need '-fno-builtin-std-forward_like', see https://github.com/llvm/llvm-project/issues/101614
-          extra-args: '-std=c++23 -I$PWD/src -I$PWD/build/src -I$PWD/build/_deps/sqlpp23-src/include -I/usr/include/postgresql -I/usr/include/mysql -fno-builtin-std-forward_like'
+        # need '-fno-builtin-std-forward_like', see https://github.com/llvm/llvm-project/issues/101614
+        run: |
+          cpp-linter \
+            --style='' \
+            --tidy-checks='' \
+            --version="${pythonLocation}/bin" \
+            --files-changed-only=true \
+            --lines-changed-only=true \
+            --thread-comments=true \
+            --ignore='build|cmake_modules|ci|src/iceberg/catalog/hive/gen-cpp' \
+            --database=build \
+            --verbosity=debug \
+            --extra-arg='-std=c++23' \
+            --extra-arg="-I${PWD}/src" \
+            --extra-arg="-I${PWD}/build/src" \
+            --extra-arg="-I${PWD}/build/_deps/sqlpp23-src/include" \
+            --extra-arg='-I/usr/include/postgresql' \
+            --extra-arg='-I/usr/include/mysql' \
+            --extra-arg='-fno-builtin-std-forward_like'
       - name: Fail fast?!
         if: github.event_name == 'pull_request' && steps.linter.outputs.checks-failed != 0
         run: |