[dependabot]

Bumps the org group with 1 update in the / directory: cpp-linter.

Updates cpp-linter from 1.14.1 to 1.15.1

Release notes

Sourced from cpp-linter's releases.

v1.15.1

🐛 Bug fixes

• fix: support a --repo-root in a sub-folder of the git repo by @​shenxianpeng in #247
• fix: stop changing into --repo-root and only accept one inside the working directory by @​shenxianpeng in #246
• fix: raise when git cannot read the original file by @​shenxianpeng in #242
• fix: replace pygit2 with a git diff subprocess by @​shenxianpeng in #240

📝 Documentation updates

• docs: fix outdated CI note, docs build steps and CLI doc generation by @​shenxianpeng in #238
• docs: add Google Analytics and a sitemap by @​shenxianpeng in #237

✍ Other changes

• test: cover missing-token exits and 404 responses by @​shenxianpeng in #249
• chore(dev): test against Python 3.15 and the 3.16 pre-release by @​shenxianpeng in #241
• chore: count only binary downloads in funding.json by @​shenxianpeng in #243

📦 Dependency updates

• build(deps): bump certifi from 2025.10.5 to 2026.10.19 by @dependabot[bot] in #244
• build: bump git-bot-feedback from 0.2.6 to 0.2.9 by @​2bndy5 in #239
• chore: update pre-commit hooks by @​shenxianpeng in #235

Full Changelog: cpp-linter/cpp-linter@v1.15.0...v1.15.1

v1.15.0

🚀 New features and improvements

• feat: migrate to git-bot-feedback by @​2bndy5 in #226
• feat: redesign the comment footer with website, star and sponsor links by @​shenxianpeng in #228

🐛 Bug fixes

• fix: use git, not the GitHub API, outside GitHub Actions by @​shenxianpeng in #221
• docs: link the logging levels to the Python docs by @​shenxianpeng in #218

👷 Changes for developers

• chore(dev): limit concurrent workflow runs by @​2bndy5 in #230
• chore: add funding.json manifest for FLOSS/fund by @​shenxianpeng in #231
• test: measure coverage by package name and cover the worker log fallback by @​shenxianpeng in #222

📝 Documentation updates

• docs: update PR review caveats for reused reviews by @​shenxianpeng in #234
• feat: migrate to git-bot-feedback by @​2bndy5 in #226

... (truncated)

Commits

• 0df0602 fix: support a --repo-root in a sub-folder of the git repo (#247)
• 8f369e7 test: cover missing-token exits and 404 responses, keep tests off real GitHub...
• 55cf791 fix: stop changing into --repo-root and only accept one inside the working ...
• 2a37247 build(deps): bump certifi from 2025.10.5 to 2026.10.19 (#244)
• d08ee70 chore(dev): test against Python 3.15 and the 3.16 pre-release (#241)
• 188e1fd chore: count only binary downloads in funding.json (#243)
• 79c3660 fix: raise when git cannot read the original file (#242)
• db00cfb build: bump git-bot-feedback from 0.2.6 to 0.2.9 (#239)
• 0619384 fix: replace pygit2 with a git diff subprocess (#240)
• a5bc7db docs: fix outdated CI note, docs build steps and CLI doc generation (#238)
• Additional commits viewable in compare view

[github-actions]

Cpp-Linter Report ⚠️

Some files did not pass the configured checks!

clang-format (v16.0.6) reports: 2 file(s) not formatted

• docs/examples/demo/demo.cpp
• docs/examples/demo/demo.hpp

clang-tidy (v16.0.6) reports: 7 concern(s)

• docs/examples/demo/demo.cpp:3:10: warning: [modernize-deprecated-headers]

  inclusion of deprecated C++ header 'stdio.h'; consider using 'cstdio' instead

  #include <stdio.h>
           ^~~~~~~~~
           <cstdio>

• docs/examples/demo/demo.cpp:8:5: warning: [modernize-use-trailing-return-type]

  use a trailing return type for this function

  int main(){
  ~~~ ^
  auto       -> int

• docs/examples/demo/demo.cpp:10:13: warning: [readability-braces-around-statements]

  statement should be inside braces

      for (;;) break;
              ^
               {

• docs/examples/demo/demo.cpp:13:5: warning: [cppcoreguidelines-pro-type-vararg]

  do not call c-style vararg functions

      printf("Hello world!\n");
      ^

• docs/examples/demo/demo.hpp:6:11: warning: [modernize-use-default-member-init]

  use default member initializer for 'useless'

      char* useless;
            ^
                   {"\0"}

• docs/examples/demo/demo.hpp:7:9: warning: [modernize-use-default-member-init]

  use default member initializer for 'numb'

      int numb;
          ^
              {0}

• docs/examples/demo/demo.hpp:11:11: warning: [modernize-use-trailing-return-type]

  use a trailing return type for this function

      void *not_useful(char *str){useless = str;}
      ~~~~~~^
      auto                        -> void *

---

_{✨ Powered by cpp-linter -- ⭐ Star • ❤️ Sponsor • 💬 Feedback}

[2bndy5]

We should probably run this branch through the test repo.

[shenxianpeng]

I agree

[shenxianpeng]

Ran this branch through the test repo (temporary PR cpp-linter/test-cpp-linter-action#64, now closed), next to a baseline of main (cpp-linter 1.14.1), on push and pull_request events.

Works the same as 1.14.1 on ubuntu-latest, ubuntu-24.04-arm, macos-latest and windows-latest:

• thread comment: posted on the PR and updated in place on re-runs; on push it is a commit comment. New footer links present.
• tidy-review / format-review: posted; on re-runs, comments already posted are reused and no new review is posted when nothing is new.
• file annotations, step summary and the checks-failed outputs match the baseline.
• auto-fix pushes the formatting commit.

Runs: https://github.com/cpp-linter/test-cpp-linter-action/actions/runs/38806552518 (pull_request), https://github.com/cpp-linter/test-cpp-linter-action/actions/runs/38806544496 (push)

Not caused by this PR:

• windows-11-arm fails on main too: pygit2 1.18.1 has no win-arm64 wheel and the source build can't find git2.h.
• The odd suggestions on [DO NOT MERGE] test cpp-linter-action#501 (cpp-linter 1.15.0) test-cpp-linter-action#64 (include reorder split into remove + add; the } insertion landing on line 26) come from v1 patch logic that is unchanged since 1.14.1. One suggestion was stale because my auto-fix job pushed while the review was running.
• Cosmetic: the review body now contains the <!-- cpp linter action --> marker twice (cpp-linter adds it and git-bot-feedback adds it again).

Found since, and the reason to hold this PR:

• GitHub Enterprise Server: with 1.15.0, git-bot-feedback joins API paths onto GITHUB_API_URL with Url::join, which drops the /v3 segment when the URL has no trailing slash (https://ghe.example.com/api/v3 -> https://ghe.example.com/api/repos/...), so API calls 404. Reproduced locally against a fake API server. 1.14.1 is fine.
• --ignore=build no longer skips a nested src/build/ directory. Is this intended with the git-bot-feedback file filter?

Suggest keeping this open until a 1.15.x release fixes the GHES URL.

[2bndy5]

Cosmetic: the review body now contains the <!-- cpp linter action --> marker twice (cpp-linter adds it and git-bot-feedback adds it again)

This should not be happening. I'll review the code in git-bot-feedback. It should automatically detect the marker is present before prepending it. Maybe that check was only applied to thread-comments.

GitHub Enterprise Server: with 1.15.0, git-bot-feedback joins API paths onto GITHUB_API_URL with Url::join, which drops the /v3 segment when the URL has no trailing slash (https://ghe.example.com/api/v3 -> https://ghe.example.com/api/repos/...), so API calls 404. Reproduced locally against a fake API server. 1.14.1 is fine.

Needs to be raised in git-bot-feedback repo.

--ignore=build no longer skips a nested src/build/ directory. Is this intended with the git-bot-feedback file filter?

Yes and no. Depends on what exactly was observed. git-bot-feedback will still traverse ignore paths in case there is an unignored rule for a nested file/folder.

Technically speaking, I think it is wrong if v1.14 ignored src/build when the ignore rule is only build, because it is not a glob pattern and build/ is different from src/build/.

Ultimately, there should be no files reported from /src/build (to borrow your example) if the --ignore=src/build and there is no unignored rules like !/src/build/*/CMakeCache.txt. There are tests to ensure this behavior, so if there's a regression, I need a reproduction case.

[2bndy5]

--ignore=build no longer skips a nested src/build/ directory. Is this intended with the git-bot-feedback file filter?

I looked into this more. First, I could not find evidence of this problem in the linked CI runs. Secondly, I think you stumbled upon a bug in v1.14. An ignore pattern of build is taken as a relative path to the repo-root. So, --ignore=build should not exclude sources from src/build/. However, --ignore=*/build/ should exclude from src/build/

I guess switching to git-bot-feedback abstracted (and fixed) that problem in v1.15. 🎉

---

I raised issues for the other 2 findings.

• fix support for GitHub Enterprise REST API URL 2bndy5/git-bot-feedback#138
• conditionally prepend comment marker in review summary 2bndy5/git-bot-feedback#137
  • fix: conditionally prepend marker to Gitea PR review summary 2bndy5/git-bot-feedback#141

---

windows-11-arm fails on main too: pygit2 1.18.1 has no win-arm64 wheel and the source build can't find git2.h

Believe it or not, I'm the reason pygit2 now builds windows wheels with cibuildwheels in their CI. But when trying to add windows-arm64 builds, the build env needed too much special attention to feasibly create win-arm64 wheels. Maybe that's changed since the arm containers migrated to GH-controlled repo... IDK.

We could instead just remove pygit2 and switch to difflib or the third-party (pure-python) unidiff lib. Because the git-bot-feedback lib now does most of our diff parsing about changed files. pygit2 is really only used to get the diff between original source and clang tools' fixes.

[shenxianpeng]

Pushed ac143e0: uv.lock now pins git-bot-feedback 0.2.9 (was 0.2.6). 0.2.9 carries the two GitHub Enterprise Server fixes (REST base URL keeps /api/v3, GraphQL uses GITHUB_GRAPHQL_URL), so this PR no longer breaks on GHES. Only uv.lock changed.

Release note for this bump: with cpp-linter 1.15, ignore: build only skips the top-level build directory. Nested ones such as src/build need */build/. 1.14 matched nested directories by mistake.

---

Generated by Claude Code

[2bndy5]

We should wait for v1.15.1 to release. That way, no uv.lock hacks would be needed.

[shenxianpeng]

@dependabot recreate