Add clang-tidy check in CI (#37226)

This will make sure we keep our headers standalone and don't introduce
any new cyclic header dependencies

.clang-tidy

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+---
+Checks: '
+    -*,
+    misc-header-include-cycle
+'
+WarningsAsErrors: '*'
+HeaderFileExtensions:
+  - h
+ImplementationFileExtensions:
+  - c
+...

.clang-tidy-ignore

@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+man/*
+# These contain external headers that we don't want to check.
+src/basic/include/*
+# clang-tidy can't parse BPF source files.
+src/core/bpf/*
+src/network/bpf/*
+src/nsresourced/bpf/*
+# The glib headers contain cyclic dependencies and clang-tidy
+# can't distinguish between our code and glib headers so we
+# exclude this test.
+src/libsystemd/sd-bus/test-bus-marshal.c

.clangd

@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: LGPL-2.1-or-later
+
+Diagnostics:
+  UnusedIncludes: None

.github/workflows/linter.yml

@@ -36,29 +36,46 @@ jobs:
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_GITHUB_ACTIONS: true
 
+      - uses: systemd/mkosi@dbb4020beee2cdf250f93a425794f1cf8b0fe693
+
       - name: Check that tabs are not used in Python code
         run: sh -c '! git grep -P "\\t" -- src/boot/generate-hwids-section.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py'
 
-      - name: Install ruff and mypy
+      - name: Build tools tree
         run: |
-          python3 -m pip install --break-system-packages --upgrade setuptools wheel pip
-          python3 -m pip install --break-system-packages mypy types-Pillow ruff
+          tee mkosi/mkosi.local.conf <<EOF
+          [Build]
+          ToolsTreeDistribution=fedora
+          ToolsTreeRelease=rawhide
+          EOF
+
+          mkosi -f sandbox -- true
 
       - name: Run mypy
         run: |
-          python3 -m mypy --version
-          python3 -m mypy src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
+          mkosi sandbox -- mypy --version
+          mkosi sandbox -- mypy src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
 
       - name: Run ruff check
         run: |
-          ruff --version
-          ruff check src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
+          mkosi sandbox -- ruff --version
+          mkosi sandbox -- ruff check src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
 
       - name: Run ruff format
         run: |
-          ruff --version
-          if ! ruff format --check src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
+          mkosi sandbox -- ruff --version
+          if ! mkosi sandbox -- ruff format --check src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
           then
               echo "Please run 'ruff format' on the above files or apply the diffs below manually"
-              ruff format --check --quiet --diff  src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
+              mkosi sandbox -- ruff format --check --quiet --diff src/boot/generate-hwids-section.py src/test/generate-sym-test.py src/ukify/ukify.py test/integration-tests/integration-test-wrapper.py
           fi
+
+      - name: Configure meson
+        run: mkosi sandbox -- env CC=clang CXX=clang++ meson setup build
+
+        # Make sure all generated source files are actually generated by doing a full build.
+      - name: Build systemd
+        run: mkosi sandbox -- ninja -C build
+
+      - name: Run clang-tidy
+        run: mkosi sandbox -- ninja -C build clang-tidy

tools/fetch-mkosi.py

@@ -15,7 +15,7 @@ from pathlib import Path
 URL = 'https://github.com/systemd/mkosi'
 BRANCH = 'main'  # We only want to ever use commits on upstream 'main' branch
 CONFIG = Path('mkosi/mkosi.conf')
-WORKFLOWS = [Path('.github/workflows/mkosi.yml'), Path('.github/workflows/coverage.yml')]
+WORKFLOWS = [Path('.github/workflows') / f for f in ['mkosi.yml', 'coverage.yml', 'linter.yml']]
 
 def parse_args():
     p = argparse.ArgumentParser(