From 88d5abcd8aafd3a2040cecd7de6332ab15343e3f Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Wed, 22 Jul 2026 13:56:06 +0800 Subject: [PATCH 1/9] ci: replace cpp-linter-action with cpp-linter CLI cpp-linter/cpp-linter-action is frozen at v2.15.1: v2.16+ introduced an untrusted dependency and was blocked by ASF Infra (apache/infrastructure-actions#325), and the ASF gateway ignores newer versions. The pinned action still runs but can no longer be updated. The action is a thin wrapper around the cpp-linter PyPI package, which is not affected by the block. Install that package plus matching clang tools with pip and call the cpp-linter CLI with the same options the action used, keeping the checks-failed output and the Fail fast step. This is a run: step rather than a uses: reference, so it adds no new third-party action to the ASF allowlist. Fixes #336. --- .github/workflows/cpp-linter.yml | 38 +++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 13 deletions(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 44dd6e350..38e352393 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -91,24 +91,36 @@ jobs: with: path: ${{ github.workspace }}/.sccache key: sccache-cpp-linter-ubuntu-${{ github.run_id }} - - uses: cpp-linter/cpp-linter-action@0f6d1b8d7e38b584cbee606eb23d850c217d54f8 # v2.15.1 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 + if: github.event_name == 'pull_request' + - name: Install cpp-linter and clang tools + if: github.event_name == 'pull_request' + run: pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8" + - name: Run cpp-linter id: linter if: github.event_name == 'pull_request' continue-on-error: true env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - style: file - tidy-checks: '' - version: 22 - files-changed-only: true - lines-changed-only: true - thread-comments: true - ignore: 'build|cmake_modules|ci|src/iceberg/catalog/hive/gen-cpp' - database: build - verbosity: 'debug' - # need '-fno-builtin-std-forward_like', see https://github.com/llvm/llvm-project/issues/101614 - extra-args: '-std=c++23 -I$PWD/src -I$PWD/build/src -I$PWD/build/_deps/sqlpp23-src/include -I/usr/include/postgresql -I/usr/include/mysql -fno-builtin-std-forward_like' + # need '-fno-builtin-std-forward_like', see https://github.com/llvm/llvm-project/issues/101614 + run: | + cpp-linter \ + --style=file \ + --tidy-checks='' \ + --version=22 \ + --files-changed-only=true \ + --lines-changed-only=true \ + --thread-comments=true \ + --ignore='build|cmake_modules|ci|src/iceberg/catalog/hive/gen-cpp' \ + --database=build \ + --verbosity=debug \ + --extra-arg='-std=c++23' \ + --extra-arg="-I${PWD}/src" \ + --extra-arg="-I${PWD}/build/src" \ + --extra-arg="-I${PWD}/build/_deps/sqlpp23-src/include" \ + --extra-arg='-I/usr/include/postgresql' \ + --extra-arg='-I/usr/include/mysql' \ + --extra-arg='-fno-builtin-std-forward_like' - name: Fail fast?! if: github.event_name == 'pull_request' && steps.linter.outputs.checks-failed != 0 run: | From f8227d7b85360560cd85770aa3398a4a76e66dec Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Wed, 22 Jul 2026 14:58:28 +0800 Subject: [PATCH 2/9] ci: pin python-version and install via python -m pip Address review feedback: pin setup-python to 3.13 so the runner's default Python cannot drift, and install with python -m pip so it targets the interpreter the action set up rather than a bare pip on PATH. --- .github/workflows/cpp-linter.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 38e352393..00352593e 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -93,9 +93,11 @@ jobs: key: sccache-cpp-linter-ubuntu-${{ github.run_id }} - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 if: github.event_name == 'pull_request' + with: + python-version: '3.13' - name: Install cpp-linter and clang tools if: github.event_name == 'pull_request' - run: pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8" + run: python -m pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8" - name: Run cpp-linter id: linter if: github.event_name == 'pull_request' From 6f02d4336670ffa6c051b71d17f3a07e465d52e1 Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Thu, 23 Jul 2026 12:59:54 +0800 Subject: [PATCH 3/9] ci: parameterize cpp-linter and clang tool versions Move the cpp-linter and clang tool versions into the job's env block so they live in one place, and derive the clang-tidy --version major from CLANG_TOOLS_VERSION instead of repeating it. --- .github/workflows/cpp-linter.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 00352593e..8900f6179 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -48,6 +48,8 @@ jobs: env: SCCACHE_DIR: ${{ github.workspace }}/.sccache SCCACHE_CACHE_SIZE: "2G" + CPP_LINTER_VERSION: "1.13.0" + CLANG_TOOLS_VERSION: "22.1.8" steps: - name: Checkout iceberg-cpp uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -97,7 +99,7 @@ jobs: python-version: '3.13' - name: Install cpp-linter and clang tools if: github.event_name == 'pull_request' - run: python -m pip install "cpp-linter==1.13.0" "clang-format==22.1.8" "clang-tidy==22.1.8" + run: python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-format==${CLANG_TOOLS_VERSION}" "clang-tidy==${CLANG_TOOLS_VERSION}" - name: Run cpp-linter id: linter if: github.event_name == 'pull_request' @@ -109,7 +111,7 @@ jobs: cpp-linter \ --style=file \ --tidy-checks='' \ - --version=22 \ + --version="${CLANG_TOOLS_VERSION%%.*}" \ --files-changed-only=true \ --lines-changed-only=true \ --thread-comments=true \ From 1989d0ccff9264d73c7e8066c0e64528d53d1b60 Mon Sep 17 00:00:00 2001 From: Gang Wu Date: Thu, 23 Jul 2026 15:41:27 +0800 Subject: [PATCH 4/9] Update .github/workflows/cpp-linter.yml --- .github/workflows/cpp-linter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 8900f6179..855906b9b 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -49,7 +49,7 @@ jobs: SCCACHE_DIR: ${{ github.workspace }}/.sccache SCCACHE_CACHE_SIZE: "2G" CPP_LINTER_VERSION: "1.13.0" - CLANG_TOOLS_VERSION: "22.1.8" + CLANG_TOOLS_VERSION: "22.1.5" # Don't forget to update .pre-commit-config.yaml steps: - name: Checkout iceberg-cpp uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 From 81c2d6fdf49373928f6cf5f15649b13c172271e7 Mon Sep 17 00:00:00 2001 From: Gang Wu Date: Thu, 23 Jul 2026 15:55:22 +0800 Subject: [PATCH 5/9] Apply suggestion from @wgtmac --- .github/workflows/cpp-linter.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 855906b9b..8900f6179 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -49,7 +49,7 @@ jobs: SCCACHE_DIR: ${{ github.workspace }}/.sccache SCCACHE_CACHE_SIZE: "2G" CPP_LINTER_VERSION: "1.13.0" - CLANG_TOOLS_VERSION: "22.1.5" # Don't forget to update .pre-commit-config.yaml + CLANG_TOOLS_VERSION: "22.1.8" steps: - name: Checkout iceberg-cpp uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 From 3f52a6236662ea3e5c20c0d252ea7e76f2a4e262 Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Thu, 23 Jul 2026 16:25:50 +0800 Subject: [PATCH 6/9] ci: upgrade pip before installing cpp-linter Match the pip-upgrade step used in test.yml so the linter job doesn't rely on the runner's bundled pip. --- .github/workflows/cpp-linter.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 8900f6179..9983c051f 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -99,7 +99,9 @@ jobs: python-version: '3.13' - name: Install cpp-linter and clang tools if: github.event_name == 'pull_request' - run: python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-format==${CLANG_TOOLS_VERSION}" "clang-tidy==${CLANG_TOOLS_VERSION}" + run: | + python -m pip install --upgrade pip + python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-format==${CLANG_TOOLS_VERSION}" "clang-tidy==${CLANG_TOOLS_VERSION}" - name: Run cpp-linter id: linter if: github.event_name == 'pull_request' From 46bf35ef073a7d030db7a8e0702de6fe6432b771 Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Thu, 23 Jul 2026 17:02:04 +0800 Subject: [PATCH 7/9] ci: split clang-format and clang-tidy versions Decouple the two tools as CLANG_FORMAT_VERSION and CLANG_TIDY_VERSION so the format version can track .pre-commit-config.yaml (22.1.5) while clang-tidy uses 22.1.8, which is the nearest version published on PyPI. A comment marks the format version as the one to keep in sync. --- .github/workflows/cpp-linter.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 9983c051f..9cb8a1074 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -49,7 +49,10 @@ jobs: SCCACHE_DIR: ${{ github.workspace }}/.sccache SCCACHE_CACHE_SIZE: "2G" CPP_LINTER_VERSION: "1.13.0" - CLANG_TOOLS_VERSION: "22.1.8" + # clang-format is kept in sync with .pre-commit-config.yaml; clang-tidy is + # pinned separately because that version is not published on PyPI. + CLANG_FORMAT_VERSION: "22.1.5" + CLANG_TIDY_VERSION: "22.1.8" steps: - name: Checkout iceberg-cpp uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 @@ -101,7 +104,7 @@ jobs: if: github.event_name == 'pull_request' run: | python -m pip install --upgrade pip - python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-format==${CLANG_TOOLS_VERSION}" "clang-tidy==${CLANG_TOOLS_VERSION}" + python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-format==${CLANG_FORMAT_VERSION}" "clang-tidy==${CLANG_TIDY_VERSION}" - name: Run cpp-linter id: linter if: github.event_name == 'pull_request' @@ -113,7 +116,7 @@ jobs: cpp-linter \ --style=file \ --tidy-checks='' \ - --version="${CLANG_TOOLS_VERSION%%.*}" \ + --version="${CLANG_FORMAT_VERSION%%.*}" \ --files-changed-only=true \ --lines-changed-only=true \ --thread-comments=true \ From 4ed30366e059087cfbf2480a857adc68255cb779 Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Thu, 23 Jul 2026 18:53:42 +0800 Subject: [PATCH 8/9] ci: make cpp-linter tidy-only and use pip-installed clang-tidy Drop clang-format from the cpp-linter job (pre-commit already runs the pinned clang-format hook on every PR) and point --version at the setup-python bin dir so clang-tidy resolves to the pip-installed 22.1.8 instead of a system clang-tidy-22. Adds a temporary probe to exercise CI; will be dropped. --- .github/workflows/cpp-linter.yml | 11 +++++------ src/iceberg/temp_linter_probe.cc | 17 +++++++++++++++++ 2 files changed, 22 insertions(+), 6 deletions(-) create mode 100644 src/iceberg/temp_linter_probe.cc diff --git a/.github/workflows/cpp-linter.yml b/.github/workflows/cpp-linter.yml index 9cb8a1074..acd6613a6 100644 --- a/.github/workflows/cpp-linter.yml +++ b/.github/workflows/cpp-linter.yml @@ -49,9 +49,8 @@ jobs: SCCACHE_DIR: ${{ github.workspace }}/.sccache SCCACHE_CACHE_SIZE: "2G" CPP_LINTER_VERSION: "1.13.0" - # clang-format is kept in sync with .pre-commit-config.yaml; clang-tidy is - # pinned separately because that version is not published on PyPI. - CLANG_FORMAT_VERSION: "22.1.5" + # clang-format is handled by the pre-commit workflow; cpp-linter runs + # clang-tidy only. CLANG_TIDY_VERSION: "22.1.8" steps: - name: Checkout iceberg-cpp @@ -104,7 +103,7 @@ jobs: if: github.event_name == 'pull_request' run: | python -m pip install --upgrade pip - python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-format==${CLANG_FORMAT_VERSION}" "clang-tidy==${CLANG_TIDY_VERSION}" + python -m pip install "cpp-linter==${CPP_LINTER_VERSION}" "clang-tidy==${CLANG_TIDY_VERSION}" - name: Run cpp-linter id: linter if: github.event_name == 'pull_request' @@ -114,9 +113,9 @@ jobs: # need '-fno-builtin-std-forward_like', see https://github.com/llvm/llvm-project/issues/101614 run: | cpp-linter \ - --style=file \ + --style='' \ --tidy-checks='' \ - --version="${CLANG_FORMAT_VERSION%%.*}" \ + --version="${pythonLocation}/bin" \ --files-changed-only=true \ --lines-changed-only=true \ --thread-comments=true \ diff --git a/src/iceberg/temp_linter_probe.cc b/src/iceberg/temp_linter_probe.cc new file mode 100644 index 000000000..b3f8a6789 --- /dev/null +++ b/src/iceberg/temp_linter_probe.cc @@ -0,0 +1,17 @@ +// TEMP verification file — will be dropped before merge. +// Confirms cpp-linter runs clang-tidy with the pip-installed binary +// (via --version=${pythonLocation}/bin) after dropping clang-format. +namespace iceberg { + +class TempLinterProbe { + public: + int* probe() { + int* ptr = 0; // modernize-use-nullptr should flag this + return ptr; + } + + private: + int badMember; // readability-identifier-naming: missing trailing underscore +}; + +} // namespace iceberg From d679da7d75efa6f48594ba2ae85d568dae801c2e Mon Sep 17 00:00:00 2001 From: yangjie01 Date: Thu, 23 Jul 2026 19:20:36 +0800 Subject: [PATCH 9/9] test: remove temporary linter probe Drop the probe added to exercise the tidy-only cpp-linter path in CI. CI confirmed clang-tidy resolves to the pip-installed 22.1.8 and reports the seeded violations. --- src/iceberg/temp_linter_probe.cc | 17 ----------------- 1 file changed, 17 deletions(-) delete mode 100644 src/iceberg/temp_linter_probe.cc diff --git a/src/iceberg/temp_linter_probe.cc b/src/iceberg/temp_linter_probe.cc deleted file mode 100644 index b3f8a6789..000000000 --- a/src/iceberg/temp_linter_probe.cc +++ /dev/null @@ -1,17 +0,0 @@ -// TEMP verification file — will be dropped before merge. -// Confirms cpp-linter runs clang-tidy with the pip-installed binary -// (via --version=${pythonLocation}/bin) after dropping clang-format. -namespace iceberg { - -class TempLinterProbe { - public: - int* probe() { - int* ptr = 0; // modernize-use-nullptr should flag this - return ptr; - } - - private: - int badMember; // readability-identifier-naming: missing trailing underscore -}; - -} // namespace iceberg