Add a clang-tidy configuration and CI lane

[derobins]

Add .clang-tidy with an aggressive set of checks that leans toward security and modern C++, and a CI workflow that fails on any finding.

The configuration enables these groups in full: bugprone, cert, clang-analyzer, concurrency, cppcoreguidelines, misc, modernize, performance, portability, and readability. It also enables android-cloexec-* (file descriptors leaking into child processes) and google-runtime-int (AGENTS.md's rule against long). The hicpp checks it names only exist under those names before LLVM 23. Every finding is an error. ExcludeHeaderFilterRegex means it needs clang-tidy 19 or later.

• 81 checks report problems in the current code. Each is turned off on its own line, marked TODO with the number of places it reports, so it can be turned back on once that code is fixed. Checks with an alias or an older name are turned off under every name.
• Four style-only checks that contradict the project's conventions or tooling are turned off for good: trailing return types, identifier length, #pragma once, and misc-include-cleaner (IWYU covers includes, and AGENTS.md makes its suggestions advisory).
• The public header (C11) and src/common/ibv-core.h (mirrors libibverbs' C ABI, so its enums can't change type) aren't checked.
• examples/.clang-tidy turns off the checks whose fixes need C++14 or later, since the examples are written to C++11 but built as C++20.

The new hipobject-clang-tidy.yml lane builds the default configuration with HIPOBJ_USE_CLANG_TIDY in the usual ROCm 10.0 image, with amdclang++ as the compiler. As in hipFile's clang-tidy workflow, it installs upstream clang-tidy 23 from apt.llvm.org, because ROCm's clang-tidy is built without the clang-analyzer checks, and 23 matches ROCm 10.0's LLVM. apt only trusts the key with apt.llvm.org's known fingerprint, and only for that repository. The build keeps going after a failure, so one run reports every finding, and a failed run lists the findings per check in the job summary.

The Build, IWYU, and MinIO Integration Check workflows no longer run for a change to only the .clang-tidy files. AGENTS.md now describes the configuration and the lane.

[Copilot]

🟡 Changes recommended

The check configurations use an unsupported YAML shape, preventing clang-tidy from running successfully.

3 open findings

• Use scalar Checks syntax in clang-tidy configuration · New
• Use scalar Checks syntax for inherited exclusions · New
• Support mixed-case clang-tidy diagnostic IDs in filters · New

What changed in this PR

Adds strict clang-tidy configuration and a dedicated CI lane.

Changes:

• Enables security, correctness, modernization, and portability checks.
• Adds LLVM 23 clang-tidy CI with finding summaries.
• Adjusts workflow triggers and contributor guidance.

File	Description
.clang-tidy	Defines repository-wide checks and exclusions.
examples/​.clang-tidy	Disables checks requiring post-C++11 features.
.github/​workflows/​hipobject-clang-tidy.yml	Adds the clang-tidy CI lane.
.github/​workflows/​hipobject-build.yml	Excludes tidy-only changes.
.github/​workflows/​hipobject-iwyu.yml	Excludes tidy-only changes.
.github/​workflows/​hipobject-minio-integration-check.yml	Excludes tidy-only changes.
AGENTS.md	Documents clang-tidy usage and CI.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The configuration references a nonexistent CLANG_TIDY_NOTES.md file.

1 open finding

• Referenced CLANG_TIDY_NOTES.md file is missing · New

3 resolved since last review

• Use scalar Checks syntax for inherited exclusions
• Use scalar Checks syntax in clang-tidy configuration
• Support mixed-case clang-tidy diagnostic IDs in filters

🧠 Review effort: Balanced