# clang-tidy configuration: a deliberately narrow, warning-free baseline so CI can run
# with warnings-as-errors; broaden incrementally rather than suppressing findings in code.
#
# Checks disabled because they conflict with deliberate project conventions:
# - bugprone-easily-swappable-parameters: a protocol RP/RS library passes many same-typed
#   OIDC/OAuth/HTTP inputs per call by design (see the accepted SonarCloud S107 findings)
# - bugprone-macro-parentheses: the token-pasting config accessor-macro framework in
#   cfg/ (OIDC_*_MEMBER_FUNCS*) cannot parenthesize its arguments
# - bugprone-reserved-identifier: the NULL-safe _oidc_* wrapper naming convention
# - bugprone-assignment-in-if-condition: the pervasive "if ((x = f()) == NULL)" idiom
# - bugprone-branch-clone: explicit enum cases and parallel condition branches are
#   spelled out for readability
# - bugprone-narrowing-conversions, bugprone-implicit-widening-of-multiplication-result:
#   type-conversion pedantry; surfaced via compiler flags when needed instead
# - bugprone-integer-division: apr_time_sec() truncation in log output is intended
# - bugprone-multi-level-implicit-pointer-conversion: the APR void* container idiom
#   (apr_array_pop, apr_hash_get) would need casts on every use
#
# misc-const-correctness is not listed: it does not analyze C code; pointer-const
# hygiene (SonarCloud S5350) remains covered by SonarCloud.
#
# clang-analyzer-* is the path-sensitive analyzer (leaks, double frees, use-after-free,
# null dereferences along a specific execution path) - a different class of finding from
# the syntactic bugprone-* checks, and complementary to gcc's -fanalyzer in the CI job of
# the same name. Its core.*/unix.* checks are clean; three groups are excluded:
# - security.insecureAPI.DeprecatedOrUnsafeBufferHandling: fires on every memcpy/memset and
#   demands the C11 Annex K _s variants, which glibc does not implement
# - security.insecureAPI.strcpy: a blanket ban on strcpy; both call sites are bounded by an
#   explicit length check first (cache/shm.c rejects oversize values before storing,
#   util/html.c checks the remaining output space per escape)
# - optin.*: opt-in advice rather than defects, and it reads the deliberate config design as
#   a bug - the OIDC_CONFIG_POS_INT_UNSET (-1) sentinel and the OR-ed pass_idtoken_as flags
#   are intentionally values outside their enum's range
# - valist.Uninitialized: a false positive on _oidc_jose_error_set() (src/jose.c), reported by
#   clang-tidy 18 (the CI runner) but not by 21. It walks the path where the `fmt` argument is
#   NULL and concludes the va_list is uninitialized, but va_start() takes the *name* of the
#   last named parameter - the value passed for it is irrelevant to whether `ap` is initialized
#
# NB: the exact clang-analyzer finding set varies by clang version, so a runner upgrade can
# surface new ones here even with the source unchanged.
Checks: >
  -*,
  bugprone-*,
  clang-analyzer-*,
  -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
  -clang-analyzer-security.insecureAPI.strcpy,
  -clang-analyzer-optin.*,
  -clang-analyzer-valist.Uninitialized,
  -bugprone-easily-swappable-parameters,
  -bugprone-macro-parentheses,
  -bugprone-reserved-identifier,
  -bugprone-assignment-in-if-condition,
  -bugprone-branch-clone,
  -bugprone-narrowing-conversions,
  -bugprone-implicit-widening-of-multiplication-result,
  -bugprone-integer-division,
  -bugprone-multi-level-implicit-pointer-conversion,
  readability-avoid-nested-conditional-operator
WarningsAsErrors: '*'
HeaderFilterRegex: '.*/src/.*\.h$'
FormatStyle: file
