{"id":15047966,"url":"https://github.com/platisd/clang-tidy-pr-comments","last_synced_at":"2025-10-19T15:02:24.891Z","repository":{"id":41891611,"uuid":"356900234","full_name":"platisd/clang-tidy-pr-comments","owner":"platisd","description":"Turn clang-tidy warnings and fixes to comments in your pull request","archived":false,"fork":false,"pushed_at":"2025-09-08T23:20:57.000Z","size":135,"stargazers_count":45,"open_issues_count":2,"forks_count":25,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-10-11T05:31:59.913Z","etag":null,"topics":["clang-tidy","code-quality","code-review","cpp","pull-requests","review-comments"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/platisd.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-04-11T15:08:59.000Z","updated_at":"2025-09-28T12:37:06.000Z","dependencies_parsed_at":"2024-02-03T13:33:03.878Z","dependency_job_id":"dcd50def-8309-4602-9cb9-0dd40aade3de","html_url":"https://github.com/platisd/clang-tidy-pr-comments","commit_stats":{"total_commits":115,"total_committers":10,"mean_commits":11.5,"dds":0.4347826086956522,"last_synced_commit":"817f9e911bea85d7ea977797dca2862de59905f8"},"previous_names":[],"tags_count":25,"template":false,"template_full_name":null,"purl":"pkg:github/platisd/clang-tidy-pr-comments","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/platisd%2Fclang-tidy-pr-comments","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/platisd%2Fclang-tidy-pr-comments/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/platisd%2Fclang-tidy-pr-comments/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/platisd%2Fclang-tidy-pr-comments/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/platisd","download_url":"https://codeload.github.com/platisd/clang-tidy-pr-comments/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/platisd%2Fclang-tidy-pr-comments/sbom","scorecard":{"id":737322,"data":{"date":"2025-08-11","repo":{"name":"github.com/platisd/clang-tidy-pr-comments","commit":"636dc9b2c977ca4b8adb42d969eab47cd41daebc"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.5,"checks":[{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Maintained","score":5,"reason":"5 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 5","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/actions-tagger.yaml:1","Warn: no topLevel permission defined: .github/workflows/black.yaml:1","Warn: no topLevel permission defined: .github/workflows/github-release.yaml:1","Warn: no topLevel permission defined: .github/workflows/pull-request-tests.yaml:1","Warn: no topLevel permission defined: .github/workflows/pylint.yaml:1","Warn: no topLevel permission defined: .github/workflows/shellcheck.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: third-party GitHubAction not pinned by hash: .github/workflows/actions-tagger.yaml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/actions-tagger.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/black.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/black.yaml/master?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/black.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/black.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/github-release.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/github-release.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request-tests.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/pull-request-tests.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request-tests.yaml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/pull-request-tests.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request-tests.yaml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/pull-request-tests.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request-tests.yaml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/pull-request-tests.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pylint.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/pylint.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pylint.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/pylint.yaml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/shellcheck.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/platisd/clang-tidy-pr-comments/shellcheck.yaml/master?enable=pin","Warn: pipCommand not pinned by hash: .github/workflows/pull-request-tests.yaml:51","Warn: pipCommand not pinned by hash: .github/workflows/pull-request-tests.yaml:25","Warn: pipCommand not pinned by hash: .github/workflows/pylint.yaml:19","Warn: pipCommand not pinned by hash: .github/workflows/pylint.yaml:20","Warn: pipCommand not pinned by hash: .github/workflows/pylint.yaml:21","Info:   0 out of   9 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   2 third-party GitHubAction dependencies pinned","Info:   0 out of   5 pipCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":6,"reason":"4 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-9hjg-9r4m-mvj7","Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56","Warn: Project is vulnerable to: PYSEC-2023-74 / GHSA-j8r2-6x86-q33q","Warn: Project is vulnerable to: PYSEC-2018-28 / GHSA-x84v-xcm2-53pg"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-22T16:15:09.629Z","repository_id":41891611,"created_at":"2025-08-22T16:15:09.629Z","updated_at":"2025-08-22T16:15:09.629Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279836154,"owners_count":26233619,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-19T02:00:07.647Z","response_time":64,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["clang-tidy","code-quality","code-review","cpp","pull-requests","review-comments"],"created_at":"2024-09-24T21:06:22.185Z","updated_at":"2025-10-19T15:02:24.844Z","avatar_url":"https://github.com/platisd.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# clang-tidy pull request comments\n\n[![clang-tidy-8 support]](https://releases.llvm.org/8.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-9 support]](https://releases.llvm.org/9.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-10 support]](https://releases.llvm.org/10.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-11 support]](https://releases.llvm.org/11.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-12 support]](https://releases.llvm.org/12.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-13 support]](https://releases.llvm.org/13.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-14 support]](https://releases.llvm.org/14.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-15 support]](https://releases.llvm.org/15.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-16 support]](https://releases.llvm.org/16.0.0/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-17 support]](https://releases.llvm.org/17.0.1/tools/clang/tools/extra/docs/clang-tidy/index.html)\n[![clang-tidy-18 support]](https://releases.llvm.org/18.1.1/tools/clang/tools/extra/docs/clang-tidy/index.html)\n\nA GitHub Action to post `clang-tidy` warnings and suggestions as review comments on your pull request.\n\n![action preview](https://i.imgur.com/lQiFdT9.png)\n\n* [What](#what)\n  * [Supported clang-tidy versions](#supported-clang-tidy-versions)\n* [How](#how)\n  * [Basic configuration example](#basic-configuration-example)\n  * [Triggering this Action manually](#triggering-this-action-manually)\n  * [Using this Action to safely perform analysis of pull requests from forks](#using-this-action-to-safely-perform-analysis-of-pull-requests-from-forks)\n* [Who's using this action?](#whos-using-this-action)\n\n## What\n\n`platisd/clang-tidy-pr-comments` is a GitHub Action that utilizes the *exported fixes* of\n`clang-tidy` for your C++ project and posts them as **code review comments** in the related **pull request**.\n\nIf `clang-tidy` has a concrete recommendation on how you should modify your code to fix the issue that's detected,\nthen it will be presented as a *suggested change* that can be committed directly. Alternatively,\nthe offending line will be highlighted along with a description of the warning.\n\nThe GitHub Action can be configured to *request changes* if `clang-tidy` warnings are found or merely\nleave a comment without blocking the pull request from being merged. It should fail only if it has been\nmisconfigured by you, due to a bug (please contact me if that's the case) or the GitHub API acting up.\n\nPlease note the following:\n\n* It will **not** run `clang-tidy` for you. You are responsible for doing that and then supply the Action with\n  the path to your generated report (see [examples](#how) below). You can generate a\n  YAML report that includes *fixes* for a pull request using the following methods:\n\n  * Using the `run-clang-tidy` utility script with the `-export-fixes` argument. This script usually\n    comes with the `clang-tidy` packages. You can use it to run checks *for the entire codebase* of a\n    project at once.\n\n  * Using the `clang-tidy-diff` utility script with the `-export-fixes` argument. This script also usually\n    comes with the `clang-tidy` packages, and and it can be used to run checks only for code fragments that\n    *have been changed* in a specific pull request.\n\n  * Alternatively, you may use `--export-fixes` with `clang-tidy` itself in your own script.\n\n  In any case, specify the path where you would like the report to be exported. The very same path should\n  be supplied to this Action.\n\n* It will *only* comment on files and lines changed in the pull request. This is due to GitHub not allowing\n  comments on other files outside the pull request `diff`.\n  This means that there may be more warnings in your project. Make sure you fix them *before* starting to\n  use this Action to ensure new warnings will not be introduced in the future.\n\n* This Action *respects* existing comments and doesn't repeat the same warnings for the same line (no spam).\n\n* This Action allows analysis to be performed *separately* from the posting of the analysis results (using\n  separate workflows with different privileges), which\n  [allows you to safely analyze pull requests from forks](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)\n  (see [example](#using-this-action-to-safely-perform-analysis-of-pull-requests-from-forks) below).\n\n### Supported clang-tidy versions\n\nYAML files containing generated fixes by the following `clang-tidy` versions are currently supported:\n* `clang-tidy-8`\n* `clang-tidy-9`\n* `clang-tidy-10`\n* `clang-tidy-11`\n* `clang-tidy-12`\n* `clang-tidy-13`\n* `clang-tidy-14`\n* `clang-tidy-15`\n* `clang-tidy-16`\n* `clang-tidy-17`\n* `clang-tidy-18`\n\n## How\n\nSince this action comments on files changed in pull requests, naturally, it can be only run\non `pull_request` events. That being said, if it happens to be triggered in a different context,\ne.g. a `push` event, it will **not** run and fail *softly* by returning a *success* code.\n\n### Basic configuration example\n\nA basic configuration for the `platisd/clang-tidy-pr-comments` action (for a `CMake`-based project\nusing the `clang-tidy-diff` script) can be seen below:\n\n```yaml\nname: Static analysis\n\non: pull_request\n\njobs:\n  clang-tidy:\n    runs-on: ubuntu-22.04\n    permissions:\n      pull-requests: write\n      # OPTIONAL: auto-closing conversations requires the `contents` permission\n      contents: write\n    steps:\n    - uses: actions/checkout@v4\n      with:\n        ref: ${{ github.event.pull_request.head.sha }}\n        fetch-depth: 0\n    - name: Fetch base branch\n      run: |\n        git remote add upstream \"https://github.com/${{ github.event.pull_request.base.repo.full_name }}\"\n        git fetch --no-tags --no-recurse-submodules upstream \"${{ github.event.pull_request.base.ref }}\"\n    - name: Install clang-tidy\n      run: |\n        sudo apt-get update\n        sudo apt-get install -y clang-tidy\n    - name: Prepare compile_commands.json\n      run: |\n        cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON\n    - name: Create results directory\n      run: |\n        mkdir clang-tidy-result\n    - name: Analyze\n      run: |\n        git diff -U0 \"$(git merge-base HEAD \"upstream/${{ github.event.pull_request.base.ref }}\")\" | clang-tidy-diff -p1 -path build -export-fixes clang-tidy-result/fixes.yml\n    - name: Run clang-tidy-pr-comments action\n      uses: platisd/clang-tidy-pr-comments@v1\n      with:\n        # The GitHub token (or a personal access token)\n        github_token: ${{ secrets.GITHUB_TOKEN }}\n        # The path to the clang-tidy fixes generated previously\n        clang_tidy_fixes: clang-tidy-result/fixes.yml\n        # Optionally set to true if you want the Action to request\n        # changes in case warnings are found\n        request_changes: true\n        # Optionally set the number of comments per review\n        # to avoid GitHub API timeouts for heavily loaded\n        # pull requests\n        suggestions_per_comment: 10\n```\n\n### Triggering this Action manually\n\nIf you want to trigger this Action manually, i.e. by leaving a comment with a particular *keyword*\nin the pull request, then you can try the following:\n\n```yaml\nname: Static analysis\n\n# Don't trigger it on pull_request events but issue_comment instead\non: issue_comment\n\njobs:\n  clang-tidy:\n    # Trigger the job only when someone comments: run_clang_tidy\n    if: ${{ github.event.issue.pull_request \u0026\u0026 contains(github.event.comment.body, 'run_clang_tidy') }}\n    runs-on: ubuntu-22.04\n    permissions:\n      pull-requests: write\n      # OPTIONAL: auto-closing conversations requires the `contents` permission\n      contents: write\n    steps:\n    - uses: actions/checkout@v4\n      with:\n        ref: ${{ github.event.pull_request.head.sha }}\n        fetch-depth: 0\n    - name: Fetch base branch\n      run: |\n        git remote add upstream \"https://github.com/${{ github.event.pull_request.base.repo.full_name }}\"\n        git fetch --no-tags --no-recurse-submodules upstream \"${{ github.event.pull_request.base.ref }}\"\n    - name: Install clang-tidy\n      run: |\n        sudo apt-get update\n        sudo apt-get install -y clang-tidy\n    - name: Prepare compile_commands.json\n      run: |\n        cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON\n    - name: Create results directory\n      run: |\n        mkdir clang-tidy-result\n    - name: Analyze\n      run: |\n        git diff -U0 \"$(git merge-base HEAD \"upstream/${{ github.event.pull_request.base.ref }}\")\" | clang-tidy-diff -p1 -path build -export-fixes clang-tidy-result/fixes.yml\n    - name: Run clang-tidy-pr-comments action\n      uses: platisd/clang-tidy-pr-comments@v1\n      with:\n        github_token: ${{ secrets.GITHUB_TOKEN }}\n        clang_tidy_fixes: clang-tidy-result/fixes.yml\n```\n\n### Using this Action to safely perform analysis of pull requests from forks\n\nIf you want to trigger this Action using the `workflow_run` event to run analysis on pull requests\nfrom forks in a\n[secure manner](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/),\nthen you can use the following combination of workflows:\n\n```yaml\n# Insecure workflow with limited permissions that should provide analysis results through an artifact\nname: Static analysis\n\non: pull_request\n\njobs:\n  clang-tidy:\n    runs-on: ubuntu-22.04\n    steps:\n    - uses: actions/checkout@v4\n      with:\n        ref: ${{ github.event.pull_request.head.sha }}\n        fetch-depth: 0\n    - name: Fetch base branch\n      run: |\n        git remote add upstream \"https://github.com/${{ github.event.pull_request.base.repo.full_name }}\"\n        git fetch --no-tags --no-recurse-submodules upstream \"${{ github.event.pull_request.base.ref }}\"\n    - name: Install clang-tidy\n      run: |\n        sudo apt-get update\n        sudo apt-get install -y clang-tidy\n    - name: Prepare compile_commands.json\n      run: |\n        cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON\n    - name: Create results directory\n      run: |\n        mkdir clang-tidy-result\n    - name: Analyze\n      run: |\n        git diff -U0 \"$(git merge-base HEAD \"upstream/${{ github.event.pull_request.base.ref }}\")\" | clang-tidy-diff -p1 -path build -export-fixes clang-tidy-result/fixes.yml\n    - name: Save PR metadata\n      run: |\n        echo \"${{ github.event.number }}\" \u003e clang-tidy-result/pr-id.txt\n        echo \"${{ github.event.pull_request.head.repo.full_name }}\" \u003e clang-tidy-result/pr-head-repo.txt\n        echo \"${{ github.event.pull_request.head.sha }}\" \u003e clang-tidy-result/pr-head-sha.txt\n    - uses: actions/upload-artifact@v4\n      with:\n        name: clang-tidy-result\n        path: clang-tidy-result/\n```\n\n```yaml\n# Secure workflow with access to repository secrets and GitHub token for posting analysis results\nname: Post the static analysis results\n\non:\n  workflow_run:\n    workflows: [ \"Static analysis\" ]\n    types: [ completed ]\n\njobs:\n  clang-tidy-results:\n    # Trigger the job only if the previous (insecure) workflow completed successfully\n    if: ${{ github.event.workflow_run.event == 'pull_request' \u0026\u0026 github.event.workflow_run.conclusion == 'success' }}\n    runs-on: ubuntu-22.04\n    permissions:\n      pull-requests: write\n      # OPTIONAL: auto-closing conversations requires the `contents` permission\n      contents: write\n    steps:\n    - name: Download analysis results\n      uses: actions/github-script@v7\n      with:\n        script: |\n          const artifacts = await github.rest.actions.listWorkflowRunArtifacts({\n              owner: context.repo.owner,\n              repo: context.repo.repo,\n              run_id: ${{ github.event.workflow_run.id }},\n          });\n          const matchArtifact = artifacts.data.artifacts.filter((artifact) =\u003e {\n              return artifact.name == \"clang-tidy-result\"\n          })[0];\n          const download = await github.rest.actions.downloadArtifact({\n              owner: context.repo.owner,\n              repo: context.repo.repo,\n              artifact_id: matchArtifact.id,\n              archive_format: \"zip\",\n          });\n          const fs = require(\"fs\");\n          fs.writeFileSync(\"${{ github.workspace }}/clang-tidy-result.zip\", Buffer.from(download.data));\n    - name: Extract analysis results\n      run: |\n        mkdir clang-tidy-result\n        unzip -j clang-tidy-result.zip -d clang-tidy-result\n    - name: Set environment variables\n      uses: actions/github-script@v7\n      with:\n        script: |\n          const assert = require(\"node:assert\").strict;\n          const fs = require(\"fs\");\n          function exportVar(varName, fileName, regEx) {\n              const val = fs.readFileSync(\"${{ github.workspace }}/clang-tidy-result/\" + fileName, {\n                  encoding: \"ascii\"\n              }).trimEnd();\n              assert.ok(regEx.test(val), \"Invalid value format for \" + varName);\n              core.exportVariable(varName, val);\n          }\n          exportVar(\"PR_ID\", \"pr-id.txt\", /^[0-9]+$/);\n          exportVar(\"PR_HEAD_REPO\", \"pr-head-repo.txt\", /^[-./0-9A-Z_a-z]+$/);\n          exportVar(\"PR_HEAD_SHA\", \"pr-head-sha.txt\", /^[0-9A-Fa-f]+$/);\n    - uses: actions/checkout@v4\n      with:\n        repository: ${{ env.PR_HEAD_REPO }}\n        ref: ${{ env.PR_HEAD_SHA }}\n        persist-credentials: false\n    - name: Redownload analysis results\n      uses: actions/github-script@v7\n      with:\n        script: |\n          const artifacts = await github.rest.actions.listWorkflowRunArtifacts({\n              owner: context.repo.owner,\n              repo: context.repo.repo,\n              run_id: ${{ github.event.workflow_run.id }},\n          });\n          const matchArtifact = artifacts.data.artifacts.filter((artifact) =\u003e {\n              return artifact.name == \"clang-tidy-result\"\n          })[0];\n          const download = await github.rest.actions.downloadArtifact({\n              owner: context.repo.owner,\n              repo: context.repo.repo,\n              artifact_id: matchArtifact.id,\n              archive_format: \"zip\",\n          });\n          const fs = require(\"fs\");\n          fs.writeFileSync(\"${{ github.workspace }}/clang-tidy-result.zip\", Buffer.from(download.data));\n    - name: Extract analysis results\n      run: |\n        mkdir clang-tidy-result\n        unzip -j clang-tidy-result.zip -d clang-tidy-result\n    - name: Run clang-tidy-pr-comments action\n      uses: platisd/clang-tidy-pr-comments@v1\n      with:\n        github_token: ${{ secrets.GITHUB_TOKEN }}\n        clang_tidy_fixes: clang-tidy-result/fixes.yml\n        pull_request_id: ${{ env.PR_ID }}\n```\n\n## Who's using this action?\n\nSee the [Action dependency graph](https://github.com/platisd/clang-tidy-pr-comments/network/dependents).\n\n[clang-tidy-8 support]: https://img.shields.io/badge/clang--tidy-8-green\n[clang-tidy-9 support]: https://img.shields.io/badge/clang--tidy-9-green\n[clang-tidy-10 support]: https://img.shields.io/badge/clang--tidy-10-green\n[clang-tidy-11 support]: https://img.shields.io/badge/clang--tidy-11-green\n[clang-tidy-12 support]: https://img.shields.io/badge/clang--tidy-12-green\n[clang-tidy-13 support]: https://img.shields.io/badge/clang--tidy-13-green\n[clang-tidy-14 support]: https://img.shields.io/badge/clang--tidy-14-green\n[clang-tidy-15 support]: https://img.shields.io/badge/clang--tidy-15-green\n[clang-tidy-16 support]: https://img.shields.io/badge/clang--tidy-16-green\n[clang-tidy-17 support]: https://img.shields.io/badge/clang--tidy-17-green\n[clang-tidy-18 support]: https://img.shields.io/badge/clang--tidy-18-green\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplatisd%2Fclang-tidy-pr-comments","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fplatisd%2Fclang-tidy-pr-comments","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fplatisd%2Fclang-tidy-pr-comments/lists"}