From e9fe91f3b8af45a50ff6f5ecafe58726c3148d70 Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Wed, 20 May 2026 15:03:54 -0700
Subject: [PATCH 01/11] clang-tidy for runtime bindings

---
 .clang-tidy                                   | 71 ++++++++++++++++---
 .github/scripts/build-cpp-runtime-bindings.sh |  1 +
 bindings/cpp/CMakeLists.txt                   | 17 +++++
 cmake/clang-tidy.cmake                        | 26 +++++--
 docker/x86_64/manylinux228/Dockerfile         |  4 +-
 5 files changed, 103 insertions(+), 16 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 2cbeea94a..278e839aa 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,12 +1,63 @@
-Checks: "-*,
-    bugprone*,
-        -bugprone-easily-swappable-parameters,
-        -bugprone-macro-parentheses,
-    clang-analyzer*,
-    readability*,
-        -readability-magic-numbers,
-        -readability-identifier-length"
+Checks: '
+-*,
+bugprone-*,
+-bugprone-easily-swappable-parameters,
+-bugprone-macro-parentheses,
+clang-analyzer-*,
+clang-diagnostic-*,
+-clang-diagnostic-nrvo,
+-clang-diagnostic-missing-designated-field-initializers,
+cppcoreguidelines-pro-type-member-init,
+cppcoreguidelines-special-member-functions,
+google-build-using-namespace,
+misc-definitions-in-headers,
+modernize-use-emplace,
+modernize-use-using,
+performance-faster-string-find,
+performance-for-range-copy,
+performance-implicit-conversion-in-loop,
+performance-inefficient-algorithm,
+performance-inefficient-string-concatenation,
+performance-inefficient-vector-operation,
+performance-move-const-arg,
+performance-move-constructor-init,
+performance-no-automatic-move,
+performance-no-int-to-ptr,
+performance-noexcept-move-constructor,
+performance-trivially-destructible,
+performance-type-promotion-in-math-fn,
+performance-unnecessary-copy-initialization,
+performance-unnecessary-value-param,
+readability-*,
+-readability-magic-numbers,
+-readability-identifier-length,
+'
+
+WarningsAsErrors: '
+bugprone-use-after-move,
+'
 
 CheckOptions:
-    - key:     readability-implicit-bool-conversion.AllowIntegerConditions
-      value:   '1'
+- key: bugprone-easily-swappable-parameters.MinimumLength
+  value: 4
+- key: cppcoreguidelines-special-member-functions.AllowSoleDefaultDtor
+  value: true
+- key: cppcoreguidelines-special-member-functions.AllowImplicitlyDeletedCopyOrMove
+  value: 1
+- key: modernize-use-using.IgnoreExternC
+  value: true
+- key: performance-move-const-arg.CheckTriviallyCopyableMove
+  value: false
+- key: performance-unnecessary-value-param.AllowedTypes
+  value: '[Pp]ointer$;[Pp]tr$;[Rr]ef(erence)?$'
+- key: performance-unnecessary-copy-initialization.AllowedTypes
+  value: '[Pp]ointer$;[Pp]tr$;[Rr]ef(erence)?$'
+- key: readability-operators-representation.BinaryOperators
+  value: '&&;&=;&;|;~;!;!=;||;|=;^;^='
+- key: readability-redundant-string-init.StringNames
+  value: '::std::basic_string'
+- key: readability-named-parameter.InsertPlainNamesInForwardDecls
+  value: true
+- key: readability-implicit-bool-conversion.AllowIntegerConditions
+  value: '1'
+...
diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index c71ff43b6..74ab7990f 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -41,6 +41,7 @@ CMAKE_ARGS=(
     "-DCMAKE_INSTALL_LIBDIR=lib"
     "-DSVS_RUNTIME_ENABLE_LVQ_LEANVEC=${ENABLE_LVQ_LEANVEC:-ON}"
     "-DSVS_RUNTIME_ENABLE_IVF=ON"
+    "-DSVS_EXPERIMENTAL_CLANG_TIDY=ON"
 )
 
 if [ -n "$SVS_URL" ]; then
diff --git a/bindings/cpp/CMakeLists.txt b/bindings/cpp/CMakeLists.txt
index 85db0c724..c8b2dd583 100644
--- a/bindings/cpp/CMakeLists.txt
+++ b/bindings/cpp/CMakeLists.txt
@@ -82,6 +82,23 @@ target_compile_options(${TARGET_NAME} PRIVATE
     -fvisibility=hidden
 )
 
+# Optional clang-tidy integration. Reuses the top-level repo's
+# cmake/clang-tidy.cmake module so the runtime build runs the same
+# .clang-tidy config as the rest of the library.
+option(SVS_EXPERIMENTAL_CLANG_TIDY
+    "Run the clang-tidy static analyzer on the cpp runtime bindings."
+    OFF
+)
+if(SVS_EXPERIMENTAL_CLANG_TIDY)
+    list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_LIST_DIR}/../../cmake")
+    include(clang-tidy)
+    if(CLANG_TIDY_COMMAND)
+        set_target_properties(${TARGET_NAME}
+            PROPERTIES CXX_CLANG_TIDY "${CLANG_TIDY_COMMAND}"
+        )
+    endif()
+endif()
+
 if(UNIX AND NOT APPLE)
     # Don't export 3rd-party symbols from the lib
     target_link_options(${TARGET_NAME} PRIVATE "SHELL:-Wl,--exclude-libs,ALL")
diff --git a/cmake/clang-tidy.cmake b/cmake/clang-tidy.cmake
index 167f5b7c1..5f770d2e1 100644
--- a/cmake/clang-tidy.cmake
+++ b/cmake/clang-tidy.cmake
@@ -17,18 +17,36 @@
 #####
 
 if(SVS_EXPERIMENTAL_CLANG_TIDY)
-    find_program(CLANG_TIDY_EXE NAMES clang-tidy-14 clang-tidy-13 clang-tidy-12 clang-tidy)
+    find_program(CLANG_TIDY_EXE
+        NAMES
+            clang-tidy-20 clang-tidy-19 clang-tidy-18 clang-tidy-17 clang-tidy-16
+            clang-tidy-15 clang-tidy-14 clang-tidy-13 clang-tidy-12 clang-tidy
+    )
 
     if(NOT CLANG_TIDY_EXE)
         message(WARNING "SVS_EXPERIMENTAL_CLANG_TIDY is ON but clang-tidy is not found!")
         set(CLANG_TIDY_COMMAND "" CACHE STRING "" FORCE)
     else()
+        # Resolve the .clang-tidy config from the top-level repo root. When the
+        # runtime bindings are built standalone (bindings/cpp as source root),
+        # CMAKE_SOURCE_DIR points at bindings/cpp, so walk up two directories.
+        if(EXISTS "${CMAKE_SOURCE_DIR}/.clang-tidy")
+            set(SVS_CLANG_TIDY_CONFIG "${CMAKE_SOURCE_DIR}/.clang-tidy")
+            set(SVS_CLANG_TIDY_HEADER_FILTER "${CMAKE_SOURCE_DIR}/include/svs/.*")
+        elseif(EXISTS "${CMAKE_SOURCE_DIR}/../../.clang-tidy")
+            set(SVS_CLANG_TIDY_CONFIG "${CMAKE_SOURCE_DIR}/../../.clang-tidy")
+            set(SVS_CLANG_TIDY_HEADER_FILTER "${CMAKE_SOURCE_DIR}/include/svs/.*")
+        else()
+            message(FATAL_ERROR "SVS_EXPERIMENTAL_CLANG_TIDY is ON but no .clang-tidy was found")
+        endif()
+
         set(CLANG_TIDY_COMMAND
             "${CLANG_TIDY_EXE}"
             "--format-style=file"
-            "--config-file=${CMAKE_SOURCE_DIR}/.clang-tidy"
-            "--header-filter=${CMAKE_SOURCE_DIR}/include/svs/*"
+            "--config-file=${SVS_CLANG_TIDY_CONFIG}"
+            "--header-filter=${SVS_CLANG_TIDY_HEADER_FILTER}"
+            "--warnings-as-errors=*"
         )
-        message("Clang tidy command: ${CLANG_TIDY_COMMAND}")
+        message(STATUS "Clang tidy command: ${CLANG_TIDY_COMMAND}")
     endif()
 endif()
diff --git a/docker/x86_64/manylinux228/Dockerfile b/docker/x86_64/manylinux228/Dockerfile
index 0818982e2..d8ee79d10 100644
--- a/docker/x86_64/manylinux228/Dockerfile
+++ b/docker/x86_64/manylinux228/Dockerfile
@@ -20,8 +20,8 @@ RUN yum install -y cmake-3.26.5 \
     && (if [ -x /usr/local/bin/cmake ]; then rm /usr/local/bin/cmake; fi) \
     && ln -sf /usr/bin/cmake3 /usr/local/bin/cmake
 
-# Install gcc-11
-RUN yum install -y gcc-toolset-11-11.1-1.el8 wget-1.19.5 \
+# Install gcc-11 and clang-tools (for clang-tidy)
+RUN yum install -y gcc-toolset-11-11.1-1.el8 wget-1.19.5 clang-tools-extra \
     && yum clean all
 
 # Configure environment setup properly without recursion

From 5b0c7dc0dbdc597a671102f3d4f0429c0b9746ab Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Mon, 18 May 2026 16:35:42 -0700
Subject: [PATCH 02/11] address gnu/clang-tidy incompatibilities

---
 bindings/cpp/CMakeLists.txt | 13 +++++++++++++
 cmake/clang-tidy.cmake      | 14 +++++++++++---
 cmake/options.cmake         | 19 ++++++++++++-------
 3 files changed, 36 insertions(+), 10 deletions(-)

diff --git a/bindings/cpp/CMakeLists.txt b/bindings/cpp/CMakeLists.txt
index c8b2dd583..db6053f97 100644
--- a/bindings/cpp/CMakeLists.txt
+++ b/bindings/cpp/CMakeLists.txt
@@ -159,6 +159,19 @@ if (SVS_RUNTIME_ENABLE_LVQ_LEANVEC)
         FetchContent_MakeAvailable(svs)
         list(APPEND CMAKE_PREFIX_PATH "${svs_SOURCE_DIR}")
         find_package(svs REQUIRED)
+
+	# Strip svs::svs_compile_options gcc-only flags for clang-tidy
+        if(SVS_EXPERIMENTAL_CLANG_TIDY AND TARGET svs::svs_compile_options)
+            get_target_property(_svs_co_opts svs::svs_compile_options INTERFACE_COMPILE_OPTIONS)
+            if(_svs_co_opts)
+                list(FILTER _svs_co_opts EXCLUDE REGEX "^-fconcepts-diagnostics-depth")
+                list(FILTER _svs_co_opts EXCLUDE REGEX "^-ftemplate-backtrace-limit")
+                set_property(TARGET svs::svs_compile_options
+                    PROPERTY INTERFACE_COMPILE_OPTIONS "${_svs_co_opts}"
+                )
+            endif()
+        endif()
+
         target_link_libraries(${TARGET_NAME} PRIVATE
             svs::svs
             svs::svs_compile_options
diff --git a/cmake/clang-tidy.cmake b/cmake/clang-tidy.cmake
index 5f770d2e1..ab8d8001f 100644
--- a/cmake/clang-tidy.cmake
+++ b/cmake/clang-tidy.cmake
@@ -27,9 +27,7 @@ if(SVS_EXPERIMENTAL_CLANG_TIDY)
         message(WARNING "SVS_EXPERIMENTAL_CLANG_TIDY is ON but clang-tidy is not found!")
         set(CLANG_TIDY_COMMAND "" CACHE STRING "" FORCE)
     else()
-        # Resolve the .clang-tidy config from the top-level repo root. When the
-        # runtime bindings are built standalone (bindings/cpp as source root),
-        # CMAKE_SOURCE_DIR points at bindings/cpp, so walk up two directories.
+        # Walk up to find .clang-tidy when built standalone from bindings/cpp.
         if(EXISTS "${CMAKE_SOURCE_DIR}/.clang-tidy")
             set(SVS_CLANG_TIDY_CONFIG "${CMAKE_SOURCE_DIR}/.clang-tidy")
             set(SVS_CLANG_TIDY_HEADER_FILTER "${CMAKE_SOURCE_DIR}/include/svs/.*")
@@ -47,6 +45,16 @@ if(SVS_EXPERIMENTAL_CLANG_TIDY)
             "--header-filter=${SVS_CLANG_TIDY_HEADER_FILTER}"
             "--warnings-as-errors=*"
         )
+
+        # Point clang-tidy at gcc's toolchain so it can find libstdc++ headers.
+        if(CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
+            get_filename_component(_svs_gcc_bin_dir "${CMAKE_CXX_COMPILER}" DIRECTORY)
+            get_filename_component(_svs_gcc_toolchain "${_svs_gcc_bin_dir}" DIRECTORY)
+            list(APPEND CLANG_TIDY_COMMAND
+                "--extra-arg=--gcc-toolchain=${_svs_gcc_toolchain}"
+            )
+        endif()
+
         message(STATUS "Clang tidy command: ${CLANG_TIDY_COMMAND}")
     endif()
 endif()
diff --git a/cmake/options.cmake b/cmake/options.cmake
index d83b179a4..b02b6785c 100644
--- a/cmake/options.cmake
+++ b/cmake/options.cmake
@@ -201,14 +201,19 @@ if (CMAKE_CXX_COMPILER_ID STREQUAL "Clang" OR CMAKE_CXX_COMPILER_ID STREQUAL "In
     endif()
 endif()
 
-# Provide better diagnostics for broken templates.
 if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU")
-    target_compile_options(
-        svs_compile_options
-        INTERFACE
-        -fconcepts-diagnostics-depth=10
-        -ftemplate-backtrace-limit=0
-    )
+    # Provide better diagnostics for broken templates.
+    # These flags are gcc-only; clang-tidy uses the clang frontend to parse the
+    # compile command and would error with "unknown argument", so skip them when
+    # clang-tidy is enabled.
+    if (NOT SVS_EXPERIMENTAL_CLANG_TIDY)
+        target_compile_options(
+            svs_compile_options
+            INTERFACE
+            -fconcepts-diagnostics-depth=10
+            -ftemplate-backtrace-limit=0
+        )
+    endif()
 
     if (CMAKE_CXX_COMPILER_VERSION GREATER_EQUAL 12.0)
         # GCC-12 throws errors in its own intrinsics library with uninitialized variables.

From fb3115e613e7a07af5187d24216150ec24519419 Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Mon, 18 May 2026 17:02:50 -0700
Subject: [PATCH 03/11] further faiss alignment

---
 .clang-tidy                           | 15 ++++++---------
 cmake/clang-tidy.cmake                |  5 ++---
 docker/x86_64/manylinux228/Dockerfile |  9 +++++++--
 3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/.clang-tidy b/.clang-tidy
index 278e839aa..5b53f3ac1 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,9 +1,8 @@
 Checks: '
 -*,
-bugprone-*,
--bugprone-easily-swappable-parameters,
--bugprone-macro-parentheses,
-clang-analyzer-*,
+bugprone-argument-comment,
+bugprone-sizeof-*,
+bugprone-use-after-move,
 clang-diagnostic-*,
 -clang-diagnostic-nrvo,
 -clang-diagnostic-missing-designated-field-initializers,
@@ -28,9 +27,9 @@ performance-trivially-destructible,
 performance-type-promotion-in-math-fn,
 performance-unnecessary-copy-initialization,
 performance-unnecessary-value-param,
-readability-*,
--readability-magic-numbers,
--readability-identifier-length,
+readability-operators-representation,
+readability-redundant-string-init,
+readability-braces-around-statements,
 '
 
 WarningsAsErrors: '
@@ -58,6 +57,4 @@ CheckOptions:
   value: '::std::basic_string'
 - key: readability-named-parameter.InsertPlainNamesInForwardDecls
   value: true
-- key: readability-implicit-bool-conversion.AllowIntegerConditions
-  value: '1'
 ...
diff --git a/cmake/clang-tidy.cmake b/cmake/clang-tidy.cmake
index ab8d8001f..00cafa2fc 100644
--- a/cmake/clang-tidy.cmake
+++ b/cmake/clang-tidy.cmake
@@ -19,8 +19,7 @@
 if(SVS_EXPERIMENTAL_CLANG_TIDY)
     find_program(CLANG_TIDY_EXE
         NAMES
-            clang-tidy-20 clang-tidy-19 clang-tidy-18 clang-tidy-17 clang-tidy-16
-            clang-tidy-15 clang-tidy-14 clang-tidy-13 clang-tidy-12 clang-tidy
+            clang-tidy-17 clang-tidy-18 clang-tidy
     )
 
     if(NOT CLANG_TIDY_EXE)
@@ -43,7 +42,7 @@ if(SVS_EXPERIMENTAL_CLANG_TIDY)
             "--format-style=file"
             "--config-file=${SVS_CLANG_TIDY_CONFIG}"
             "--header-filter=${SVS_CLANG_TIDY_HEADER_FILTER}"
-            "--warnings-as-errors=*"
+            "--warnings-as-errors=clang-diagnostic-*,bugprone-use-after-move"
         )
 
         # Point clang-tidy at gcc's toolchain so it can find libstdc++ headers.
diff --git a/docker/x86_64/manylinux228/Dockerfile b/docker/x86_64/manylinux228/Dockerfile
index d8ee79d10..28881fd7e 100644
--- a/docker/x86_64/manylinux228/Dockerfile
+++ b/docker/x86_64/manylinux228/Dockerfile
@@ -20,8 +20,13 @@ RUN yum install -y cmake-3.26.5 \
     && (if [ -x /usr/local/bin/cmake ]; then rm /usr/local/bin/cmake; fi) \
     && ln -sf /usr/bin/cmake3 /usr/local/bin/cmake
 
-# Install gcc-11 and clang-tools (for clang-tidy)
-RUN yum install -y gcc-toolset-11-11.1-1.el8 wget-1.19.5 clang-tools-extra \
+# Install gcc-11
+RUN yum install -y gcc-toolset-11-11.1-1.el8 wget-1.19.5 \
+    && yum clean all
+
+# Install clang-tidy via the LLVM 17 module; newer versions crash on our templates.
+RUN dnf module install -y llvm-toolset \
+    && yum install -y clang-tools-extra \
     && yum clean all
 
 # Configure environment setup properly without recursion

From e35a8e8497cdd1c1452ac4d2491ef72156ff649c Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Mon, 18 May 2026 17:36:57 -0700
Subject: [PATCH 04/11] address errors

---
 cmake/clang-tidy.cmake                | 3 +++
 docker/x86_64/manylinux228/Dockerfile | 6 +++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/cmake/clang-tidy.cmake b/cmake/clang-tidy.cmake
index 00cafa2fc..6df315e7a 100644
--- a/cmake/clang-tidy.cmake
+++ b/cmake/clang-tidy.cmake
@@ -43,6 +43,9 @@ if(SVS_EXPERIMENTAL_CLANG_TIDY)
             "--config-file=${SVS_CLANG_TIDY_CONFIG}"
             "--header-filter=${SVS_CLANG_TIDY_HEADER_FILTER}"
             "--warnings-as-errors=clang-diagnostic-*,bugprone-use-after-move"
+            # Suppress noise from args (e.g. --gcc-toolchain) that affect link-time
+            # paths but are unused during clang-tidy's parse-only invocation.
+            "--extra-arg=-Wno-unused-command-line-argument"
         )
 
         # Point clang-tidy at gcc's toolchain so it can find libstdc++ headers.
diff --git a/docker/x86_64/manylinux228/Dockerfile b/docker/x86_64/manylinux228/Dockerfile
index 28881fd7e..491ca196e 100644
--- a/docker/x86_64/manylinux228/Dockerfile
+++ b/docker/x86_64/manylinux228/Dockerfile
@@ -25,7 +25,11 @@ RUN yum install -y gcc-toolset-11-11.1-1.el8 wget-1.19.5 \
     && yum clean all
 
 # Install clang-tidy via the LLVM 17 module; newer versions crash on our templates.
-RUN dnf module install -y llvm-toolset \
+# The base image ships LLVM 21.x by default, so remove it first to ensure the
+# module's older binary wins on PATH.
+RUN yum remove -y clang-tools-extra clang || true \
+    && dnf module reset -y llvm-toolset \
+    && dnf module install -y llvm-toolset:rhel8 \
     && yum install -y clang-tools-extra \
     && yum clean all
 

From 45ec6cf2547d079ac247e707cbf39062f4e64d8b Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 11:44:22 -0700
Subject: [PATCH 05/11] temporary try pip install of clang-toosl 17

---
 .github/scripts/build-cpp-runtime-bindings.sh | 4 ++++
 docker/x86_64/manylinux228/Dockerfile         | 9 ---------
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index 74ab7990f..bb41146ac 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -18,6 +18,10 @@ set -e  # Exit on error
 # Source environment setup (for compiler)
 source /etc/bashrc || true
 
+# Temporary: pip-install clang-tidy 17 to test whether the system clang-tidy
+# version is the cause of the template crash. Remove once resolved.
+pip install clang-tidy==17.0.6
+
 # Source MKL environment (required for IVF)
 if [ -f /opt/intel/oneapi/setvars.sh ]; then
     source /opt/intel/oneapi/setvars.sh --include-intel-llvm 2>/dev/null || true
diff --git a/docker/x86_64/manylinux228/Dockerfile b/docker/x86_64/manylinux228/Dockerfile
index 491ca196e..0818982e2 100644
--- a/docker/x86_64/manylinux228/Dockerfile
+++ b/docker/x86_64/manylinux228/Dockerfile
@@ -24,15 +24,6 @@ RUN yum install -y cmake-3.26.5 \
 RUN yum install -y gcc-toolset-11-11.1-1.el8 wget-1.19.5 \
     && yum clean all
 
-# Install clang-tidy via the LLVM 17 module; newer versions crash on our templates.
-# The base image ships LLVM 21.x by default, so remove it first to ensure the
-# module's older binary wins on PATH.
-RUN yum remove -y clang-tools-extra clang || true \
-    && dnf module reset -y llvm-toolset \
-    && dnf module install -y llvm-toolset:rhel8 \
-    && yum install -y clang-tools-extra \
-    && yum clean all
-
 # Configure environment setup properly without recursion
 RUN echo '# Configure gcc-11' > /etc/profile.d/01-gcc.sh && \
     echo 'source scl_source enable gcc-toolset-11' >> /etc/profile.d/01-gcc.sh && \

From 884219cb478b03103497a60ab96984328f498022 Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 12:04:04 -0700
Subject: [PATCH 06/11] pip version tweak

---
 .github/scripts/build-cpp-runtime-bindings.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index bb41146ac..ec1dcfd21 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -20,7 +20,7 @@ source /etc/bashrc || true
 
 # Temporary: pip-install clang-tidy 17 to test whether the system clang-tidy
 # version is the cause of the template crash. Remove once resolved.
-pip install clang-tidy==17.0.6
+pip install clang-tidy==17.0.1
 
 # Source MKL environment (required for IVF)
 if [ -f /opt/intel/oneapi/setvars.sh ]; then

From bdd955bc409785119904b17e48182ea77d50497c Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 13:53:07 -0700
Subject: [PATCH 07/11] conda install instead

---
 .github/scripts/build-cpp-runtime-bindings.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index ec1dcfd21..f1d5bf45f 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -18,9 +18,9 @@ set -e  # Exit on error
 # Source environment setup (for compiler)
 source /etc/bashrc || true
 
-# Temporary: pip-install clang-tidy 17 to test whether the system clang-tidy
-# version is the cause of the template crash. Remove once resolved.
-pip install clang-tidy==17.0.1
+# Temporary: install clang-tidy 17 from conda-forge to test whether the system
+# clang-tidy version is the cause of the template crash. Remove once resolved.
+conda install -y -c conda-forge clang-tools=17
 
 # Source MKL environment (required for IVF)
 if [ -f /opt/intel/oneapi/setvars.sh ]; then

From 89e842ee6d2341cc739bf9937905a31386b0a17b Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 16:45:34 -0700
Subject: [PATCH 08/11] back to pip...

---
 .github/scripts/build-cpp-runtime-bindings.sh | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index f1d5bf45f..191080de7 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -18,9 +18,11 @@ set -e  # Exit on error
 # Source environment setup (for compiler)
 source /etc/bashrc || true
 
-# Temporary: install clang-tidy 17 from conda-forge to test whether the system
-# clang-tidy version is the cause of the template crash. Remove once resolved.
-conda install -y -c conda-forge clang-tools=17
+# Temporary: pip-install clang-tidy 17 to test whether the system clang-tidy
+# version is the cause of the template crash. setuptools is needed because the
+# wheel's wrapper script imports pkg_resources (gone from Python 3.13 stdlib).
+# Remove once resolved.
+pip install setuptools clang-tidy==17.0.1
 
 # Source MKL environment (required for IVF)
 if [ -f /opt/intel/oneapi/setvars.sh ]; then

From cdbdddd270d418c424bf1aa98c90b2c388dd2d4f Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 20:42:26 -0700
Subject: [PATCH 09/11] install official clang-tidy 17 binary

---
 .github/scripts/build-cpp-runtime-bindings.sh | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index 191080de7..aeeb78f38 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -18,11 +18,16 @@ set -e  # Exit on error
 # Source environment setup (for compiler)
 source /etc/bashrc || true
 
-# Temporary: pip-install clang-tidy 17 to test whether the system clang-tidy
-# version is the cause of the template crash. setuptools is needed because the
-# wheel's wrapper script imports pkg_resources (gone from Python 3.13 stdlib).
-# Remove once resolved.
-pip install setuptools clang-tidy==17.0.1
+# Temporary: download official LLVM 17.0.6 tarball to test whether the system
+# clang-tidy version is the cause of the template crash. Remove once resolved.
+LLVM_DIR=/opt/llvm17
+if [ ! -x "$LLVM_DIR/bin/clang-tidy" ]; then
+    mkdir -p "$LLVM_DIR"
+    wget -nv https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/clang+llvm-17.0.6-x86_64-linux-gnu-ubuntu-22.04.tar.xz -O /tmp/llvm17.tar.xz
+    tar -xJf /tmp/llvm17.tar.xz -C "$LLVM_DIR" --strip-components=1
+    rm /tmp/llvm17.tar.xz
+fi
+export PATH="$LLVM_DIR/bin:$PATH"
 
 # Source MKL environment (required for IVF)
 if [ -f /opt/intel/oneapi/setvars.sh ]; then

From 78005d9cd0373397f23fe3b6e848709c3062e377 Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 22:35:13 -0700
Subject: [PATCH 10/11] use rhel8 tarball instead of ubuntu22

---
 .github/scripts/build-cpp-runtime-bindings.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index aeeb78f38..39c23efe5 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -23,7 +23,7 @@ source /etc/bashrc || true
 LLVM_DIR=/opt/llvm17
 if [ ! -x "$LLVM_DIR/bin/clang-tidy" ]; then
     mkdir -p "$LLVM_DIR"
-    wget -nv https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/clang+llvm-17.0.6-x86_64-linux-gnu-ubuntu-22.04.tar.xz -O /tmp/llvm17.tar.xz
+    wget -nv https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/clang+llvm-17.0.6-x86_64-linux-gnu-rhel-8.4.tar.xz -O /tmp/llvm17.tar.xz
     tar -xJf /tmp/llvm17.tar.xz -C "$LLVM_DIR" --strip-components=1
     rm /tmp/llvm17.tar.xz
 fi

From 3891e3767551f9e452c97e57833f57f404a384aa Mon Sep 17 00:00:00 2001
From: ethanglaser <ethan.glaser@intel.com>
Date: Thu, 21 May 2026 23:10:08 -0700
Subject: [PATCH 11/11] another pip attempt

---
 .github/scripts/build-cpp-runtime-bindings.sh | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/.github/scripts/build-cpp-runtime-bindings.sh b/.github/scripts/build-cpp-runtime-bindings.sh
index 39c23efe5..ac3fc8ae6 100644
--- a/.github/scripts/build-cpp-runtime-bindings.sh
+++ b/.github/scripts/build-cpp-runtime-bindings.sh
@@ -18,16 +18,11 @@ set -e  # Exit on error
 # Source environment setup (for compiler)
 source /etc/bashrc || true
 
-# Temporary: download official LLVM 17.0.6 tarball to test whether the system
-# clang-tidy version is the cause of the template crash. Remove once resolved.
-LLVM_DIR=/opt/llvm17
-if [ ! -x "$LLVM_DIR/bin/clang-tidy" ]; then
-    mkdir -p "$LLVM_DIR"
-    wget -nv https://github.com/llvm/llvm-project/releases/download/llvmorg-17.0.6/clang+llvm-17.0.6-x86_64-linux-gnu-rhel-8.4.tar.xz -O /tmp/llvm17.tar.xz
-    tar -xJf /tmp/llvm17.tar.xz -C "$LLVM_DIR" --strip-components=1
-    rm /tmp/llvm17.tar.xz
-fi
-export PATH="$LLVM_DIR/bin:$PATH"
+# Temporary: pip-install clang-tidy 17 to test whether the system clang-tidy
+# version is the cause of the template crash. Pin setuptools <81 because the
+# wheel's wrapper imports pkg_resources, which setuptools 81 removed.
+# Remove once resolved.
+pip install 'setuptools<81' clang-tidy==17.0.1
 
 # Source MKL environment (required for IVF)
 if [ -f /opt/intel/oneapi/setvars.sh ]; then