clang-format.yml

name: Code Style Check

on:
  pull_request_target:
    paths:
      - '**.c'
      - '**.cpp'
      - '**.h'
      - '**.hpp'
      - '.clang-format'

jobs:
  cpp-linter:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      # Security note: Checking out fork code with pull_request_target is safe here
      # because clang-format only parses source files for formatting, it does not
      # execute any code. No build scripts or PR code are run.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Run cpp-linter
        uses: cpp-linter/cpp-linter-action@b6edc0625e3941baa1797f4b4326adeab6890c97 # v2.16.7
        id: linter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          style: 'file'
          tidy-checks: '-*'
          version: '18'
          files-changed-only: true
          lines-changed-only: false
          # Disable thread-comments to avoid 403 errors
          # The commits comments API requires contents:write which is unsafe with pull_request_target
          # Use step-summary and file-annotations for feedback instead
          thread-comments: false
          step-summary: true
          file-annotations: true
          extensions: 'c,cpp,h,hpp'

      - name: Fail if formatting issues found
        if: steps.linter.outputs.format-checks-failed > 0
        run: |
          echo "::error::Found ${{ steps.linter.outputs.format-checks-failed }} formatting issues"
          exit 1