CI: Add clang-tidy action

This contains two invocations of clang-tidy. One as Github action
that should also provide annotations and another one as part of our
Docker.run script which is only run on Ubuntu-24.04 docker.

Signed-off-by: Andreas Fuchs <andreas.fuchs@infineon.com>

Author: AndreasFuchsTPM

.ci/docker.run

@@ -95,6 +95,11 @@ fi
 
 if [ "$SCANBUILD" == "yes" ]; then
   scan-build --status-bugs make -j
+elif [ "$CC" == "clang" -a "$DOCKER_IMAGE" == "ubuntu-24.04" ]; then
+  make -j compile_commands.json
+  run-clang-tidy -header-filter $PWD $(find src include -name '*.c' -o -name '*.h') 2>&1 | tee clang-tidy.log
+  make -j clean
+  make -j distcheck
 elif [ "$CC" == "clang" ]; then
   make -j distcheck
 else

.github/workflows/clang-tidy.yml

@@ -0,0 +1,25 @@
+# SPDX-FileCopyrightText: Copyright (c) 2023-2024 Infineon Technologies AG
+#
+# SPDX-License-Identifier: BSD-2-Clause
+
+name: clang-tidy-check
+on: [push, pull_request]
+
+jobs:
+  clang-tidy-check:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/tpm2-software/ubuntu-24.04
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Generate compile_commands.json
+      run: |
+        git config --global --add safe.directory /__w/tpm2-tss/tpm2-tss
+        ./bootstrap
+        ./configure CC=clang --enable-unit --enable-integration
+        make -j1 compile_commands.json
+    - uses: ZehMatt/clang-tidy-annotations@v1.1.2
+      with:
+        only_affected_lines: false