Adopt clang-tidy support from @score_cpp_policies

.bazelrc

@@ -138,3 +138,8 @@ test:tsan --cxxopt=-O1
 test:tsan --test_tag_filters=-no-tsan
 test:tsan --@score_cpp_policies//sanitizers/flags:sanitizer=tsan
 test:tsan --run_under=@score_cpp_policies//sanitizers:wrapper
+
+# Clang-tidy: bazel test --config=clang-tidy //score/...
+test:clang-tidy --aspects=//tools/lint:linters.bzl%clang_tidy_aspect
+test:clang-tidy --output_groups=+rules_lint_report
+test:clang-tidy --extra_toolchains=@llvm_toolchain//:cc-toolchain-x86_64-linux

.clang-tidy

@@ -0,0 +1,26 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+# score_logging-specific overrides applied on top of the S-CORE baseline.
+# Do NOT duplicate baseline checks here; only add local tightenings.
+
+# Only analyze headers under score_logging's own source tree.
+# POSIX ERE-compatible (no lookaheads). Adjust if source paths change.
+HeaderFilterRegex: 'score/'
+
+# Promote additional families to errors as score_logging compliance increases.
+# WarningsAsErrors: >-
+#   clang-analyzer-*,
+#   bugprone-*
+
+---

.github/workflows/clang_tidy.yml

@@ -0,0 +1,44 @@
+# *******************************************************************************
+# Copyright (c) 2025 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+name: Clang-Tidy
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  merge_group:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: clang-tidy-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  clang-tidy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.15.0
+        with:
+          bazelisk-version: 1.26.0
+          disk-cache: clang-tidy
+          repository-cache: true
+          external-cache: true
+      - name: Run clang-tidy
+        # Scope limited to C++ targets. Rust targets are not yet validated against
+        # this configuration and are explicitly excluded.
+        run: bazel test --config=clang-tidy --lockfile_mode=error -- //score/mw/log/... //score/datarouter/... -//score/mw/log/rust/...

.github/workflows/integration_tests.yml

@@ -87,6 +87,12 @@ jobs:
           sudo udevadm control --reload-rules
           sudo udevadm trigger --name-match=kvm
 
+      - name: Setup tap0 network interface for QEMU
+        run: |
+          sudo ip tuntap add dev tap0 mode tap user runner
+          sudo ip link set dev tap0 up
+          sudo ip addr add 169.254.21.88/16 dev tap0
+
       - name: Allow unprivileged user namespaces
         run: |
           sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0

BUILD

@@ -42,6 +42,7 @@ use_format_targets()
 
 exports_files([
     "MODULE.bazel",
+    ".clang-tidy",
 ])
 
 # Creates all documentation targets:

MODULE.bazel

@@ -21,7 +21,17 @@ bazel_dep(name = "rules_python", version = "1.8.5")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "rules_rust", version = "0.68.1-score")
 bazel_dep(name = "rules_cc", version = "0.2.17")
-bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
+bazel_dep(name = "aspect_rules_lint", version = "2.5.0")
+
+bazel_dep(name = "score_cpp_policies", version = "0.0.0", dev_dependency = True)
+git_override(
+    module_name = "score_cpp_policies",
+    commit = "b6551c217fbb0daf948b493c4ba69eb7fe8359a5",
+    remote = "https://github.com/eclipse-score/score_cpp_policies.git",
+)
+
+bazel_dep(name = "toolchains_llvm", version = "1.7.0", dev_dependency = True)
+
 bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
 bazel_dep(name = "platforms", version = "1.0.0")
 
@@ -79,12 +89,6 @@ use_repo(oci, "ubuntu_24_04", "ubuntu_24_04_linux_amd64")
 # Toolchains and extensions
 bazel_dep(name = "score_bazel_cpp_toolchains", version = "0.5.1", dev_dependency = True)
 bazel_dep(name = "score_toolchains_rust", version = "0.8.0", dev_dependency = True)
-bazel_dep(name = "score_cpp_policies", version = "0.0.0", dev_dependency = True)
-git_override(
-    module_name = "score_cpp_policies",
-    commit = "6348b27",
-    remote = "https://github.com/eclipse-score/score_cpp_policies.git",
-)
 
 # S-CORE crates
 bazel_dep(name = "score_crates", version = "0.0.9")
@@ -129,6 +133,16 @@ use_repo(
     "score_qcc_x86_64_toolchain_pkg",
 )
 
+llvm = use_extension(
+    "@toolchains_llvm//toolchain/extensions:llvm.bzl",
+    "llvm",
+    dev_dependency = True,
+)
+llvm.toolchain(
+    llvm_version = "19.1.7",
+)
+use_repo(llvm, "llvm_toolchain")
+
 PYTHON_VERSION = "3.12"
 
 python = use_extension("@rules_python//python/extensions:python.bzl", "python", dev_dependency = True)