ci: replace cpp-linter-action with cpp-linter CLI by LuciferYang · Pull Request #838 · apache/iceberg-cpp

LuciferYang · 2026-07-22T06:33:36Z

What

cpp-linter/cpp-linter-action is frozen at v2.15.1. Its v2.16 release pulled in
an untrusted dependency and was blocked by ASF Infra
(apache/infrastructure-actions#325), and the ASF gateway ignores newer versions.
The pinned action still runs, but it can no longer be updated.

How

The action is a thin wrapper around the cpp-linter PyPI package, and the block
does not touch that package. This installs it plus matching clang tools with
pip and calls the cpp-linter CLI with the same options the action used. The
checks-failed output and the Fail fast step stay as they were. Because it is a
run: step and not a uses: reference, it adds no new third-party action to the
ASF allowlist.

I also looked at emitting SARIF and uploading it with
github/codeql-action/upload-sarif, which is allowed since it is a github/*
action. That route loses the thread comment and needs an extra conversion step,
so calling the CLI directly stays closer to what we have now.

Verified

I ran the CLI locally against this repo's .clang-format and .clang-tidy on a
file containing a NULL and a mis-named member. Both clang-format and
clang-tidy ran, emitted ::warning annotations, and wrote checks-failed to
GITHUB_OUTPUT. The PR also carries a temporary probe commit that trips the
linter on purpose so CI exercises the new path; I will drop it before merge.

This contribution was authored with assistance from Claude Opus 4.8, in line with
the Iceberg guidelines for AI-assisted contributions
(https://iceberg.apache.org/contribute/#guidelines-for-ai-assisted-contributions).
All changes were reviewed and tested by the author.

Closes #336

cpp-linter/cpp-linter-action is frozen at v2.15.1: v2.16+ introduced an untrusted dependency and was blocked by ASF Infra (apache/infrastructure-actions#325), and the ASF gateway ignores newer versions. The pinned action still runs but can no longer be updated. The action is a thin wrapper around the cpp-linter PyPI package, which is not affected by the block. Install that package plus matching clang tools with pip and call the cpp-linter CLI with the same options the action used, keeping the checks-failed output and the Fail fast step. This is a run: step rather than a uses: reference, so it adds no new third-party action to the ASF allowlist. Fixes apache#336.

Copilot

Pull request overview

This PR updates the C++ linter workflow to stop using the frozen cpp-linter/cpp-linter-action wrapper and instead install and run the cpp-linter PyPI CLI directly, keeping the existing “checks-failed” / fail-fast behavior while avoiding adding a new third‑party action reference.

Changes:

Replace cpp-linter/cpp-linter-action with a setup-python + pip install + cpp-linter CLI invocation in the CI workflow.
Add a temporary probe C++ source file intended to intentionally trigger clang-tidy/naming warnings to exercise the new linter path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/iceberg/temp_linter_probe.cc`	Adds a temporary intentionally-noncompliant file to force the linter to report findings.
`.github/workflows/cpp-linter.yml`	Switches from the GitHub Action wrapper to installing and running the `cpp-linter` CLI with equivalent arguments.

LuciferYang · 2026-07-22T06:41:46Z

+// TEMP verification file — will be dropped before merge.
+// Intentionally violates .clang-tidy to confirm the new cpp-linter CLI runs.


This is a temporary test for lint validation and will be deleted after testing.

It looks like the check is taking effect. I will revert this file and run the tests again.

LuciferYang · 2026-07-22T06:58:43Z

+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        if: github.event_name == 'pull_request'
+      - name: Install cpp-linter and clang tools
+        if: github.event_name == 'pull_request'
+        run: pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8"


Good catch, done. Pinned setup-python to 3.13 and switched to python -m pip install so it uses the interpreter the action set up. I kept the run step as cpp-linter (its console entry point) since the package has no __main__, so it can't be called with python -m; it's installed into the same interpreter, so they stay in sync.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/cpp-linter.yml:98

actions/setup-python is invoked without specifying python-version, which makes the job dependent on the runner’s preinstalled Python (and which pip it provides). That can change over time and can also result in pip resolving to a different interpreter than the one setup-python put on PATH. Specify a Python version (consistent with other workflows) and use python -m pip for the installs.

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        if: github.event_name == 'pull_request'
      - name: Install cpp-linter and clang tools
        if: github.event_name == 'pull_request'
        run: pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8"

Address review feedback: pin setup-python to 3.13 so the runner's default Python cannot drift, and install with python -m pip so it targets the interpreter the action set up rather than a bare pip on PATH.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

LuciferYang · 2026-07-22T07:33:30Z

+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        if: github.event_name == 'pull_request'
+        with:
+          python-version: '3.13'
+      - name: Install cpp-linter and clang tools


#838 (comment)

have previously tested this by introducing a faulty temporary file.

LuciferYang · 2026-07-22T07:35:26Z

cc @wgtmac

wgtmac

Nice job! Thanks a lot, @LuciferYang!

wgtmac · 2026-07-22T07:59:12Z

+          python-version: '3.13'
+      - name: Install cpp-linter and clang tools
+        if: github.event_name == 'pull_request'
+        run: python -m pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8"


Should we parameterize these versions somewhere?

Copilot AI review requested due to automatic review settings July 22, 2026 06:33

LuciferYang mentioned this pull request Jul 22, 2026

Find alternative to cpp-linter/cpp-linter-action #336

Open

Copilot started reviewing on behalf of LuciferYang July 22, 2026 06:34 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

LuciferYang commented Jul 22, 2026

View reviewed changes

Comment thread src/iceberg/temp_linter_probe.cc Outdated

Copilot AI review requested due to automatic review settings July 22, 2026 06:51

LuciferYang force-pushed the replace-cpp-linter-action branch from 7889803 to 88d5abc Compare July 22, 2026 06:51

Copilot started reviewing on behalf of LuciferYang July 22, 2026 06:51 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

ci: pin python-version and install via python -m pip

f8227d7

Address review feedback: pin setup-python to 3.13 so the runner's default Python cannot drift, and install with python -m pip so it targets the interpreter the action set up rather than a bare pip on PATH.

Copilot AI review requested due to automatic review settings July 22, 2026 06:58

Copilot started reviewing on behalf of LuciferYang July 22, 2026 06:59 View session

Copilot AI reviewed Jul 22, 2026

View reviewed changes

wgtmac approved these changes Jul 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: replace cpp-linter-action with cpp-linter CLI#838

ci: replace cpp-linter-action with cpp-linter CLI#838
LuciferYang wants to merge 2 commits into
apache:mainfrom
LuciferYang:replace-cpp-linter-action

LuciferYang commented Jul 22, 2026 •

edited by wgtmac

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

LuciferYang Jul 22, 2026

Uh oh!

LuciferYang Jul 22, 2026 •

edited

Loading

Uh oh!

LuciferYang Jul 22, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

LuciferYang Jul 22, 2026

Uh oh!

LuciferYang commented Jul 22, 2026

Uh oh!

wgtmac left a comment

Uh oh!

wgtmac Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// TEMP verification file — will be dropped before merge.
		// Intentionally violates .clang-tidy to confirm the new cpp-linter CLI runs.

Uh oh!

Conversation

LuciferYang commented Jul 22, 2026 • edited by wgtmac Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

How

Verified

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

LuciferYang Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

LuciferYang Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

LuciferYang Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

LuciferYang Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

LuciferYang commented Jul 22, 2026

Uh oh!

wgtmac left a comment

Choose a reason for hiding this comment

Uh oh!

wgtmac Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

LuciferYang commented Jul 22, 2026 •

edited by wgtmac

Loading

LuciferYang Jul 22, 2026 •

edited

Loading