ci: S24.11 extend analyze-tidy + analyze-iwyu to platform code

.devcontainer/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   gcc:
-    image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+    image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
     volumes:
       - ..:/workspaces/SolidSyslog:cached
       - ${SSH_AUTH_SOCK:-/dev/null}:/ssh-agent
@@ -102,7 +102,7 @@ services:
     command: sleep infinity
 
   freertos-host:
-    image: ghcr.io/davidcozens/cpputest-freertos:sha-24de138
+    image: ghcr.io/davidcozens/cpputest-freertos:sha-a0c1c0a
     volumes:
       - ..:/workspaces/SolidSyslog:cached
       - ${SSH_AUTH_SOCK:-/dev/null}:/ssh-agent
@@ -153,7 +153,7 @@ services:
           - syslog-ng
 
   freertos-target:
-    image: ghcr.io/davidcozens/cpputest-freertos-cross:sha-24de138
+    image: ghcr.io/davidcozens/cpputest-freertos-cross:sha-a0c1c0a
     volumes:
       - ..:/workspaces/SolidSyslog:cached
       - syslog-ng-ctl-freertos:/var/lib/syslog-ng

.github/workflows/ci.yml

@@ -16,7 +16,7 @@ jobs:
       contents: read
       checks: write
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -76,7 +76,7 @@ jobs:
       contents: read
       checks: write
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -119,7 +119,7 @@ jobs:
     # cpputest-freertos image carries /opt/mbedtls (and exports MBEDTLS_DIR);
     # Tests/MbedTlsIntegration/CMakeLists.txt requires that env var.
     container:
-      image: ghcr.io/davidcozens/cpputest-freertos:sha-24de138
+      image: ghcr.io/davidcozens/cpputest-freertos:sha-a0c1c0a
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -224,7 +224,7 @@ jobs:
       contents: read
       checks: write
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -300,7 +300,7 @@ jobs:
       contents: read
       checks: write
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -340,7 +340,7 @@ jobs:
       pages: write
       id-token: write
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -418,7 +418,7 @@ jobs:
   analyze-tidy:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -471,10 +471,77 @@ jobs:
           path: build/iwyu/iwyu-output.txt
           retention-days: 1
 
+  # Mirrors analyze-tidy but runs on cpputest-freertos so the Platform/{FreeRtos,
+  # PlusTcp,LwipRaw,MbedTls,FatFs} trees and their Tests/* siblings enter the
+  # CMake configure (gated by FREERTOS_KERNEL_PATH / MBEDTLS_DIR / LWIP_PATH /
+  # FATFS_PATH, all set in the freertos image). The base lane on cpputest skips
+  # those trees because the env vars are absent.
+  analyze-tidy-freertos-plustcp:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/davidcozens/cpputest-freertos:sha-a0c1c0a
+      options: --user root
+    env:
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: safe.directory
+      GIT_CONFIG_VALUE_0: '*'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Configure
+        run: cmake --preset tidy
+
+      - name: Build with clang-tidy
+        shell: bash
+        run: set -o pipefail && cmake --build --preset tidy 2>&1 | tee build/tidy/clang-tidy-output.txt
+
+      - name: Upload clang-tidy output
+        if: success() || failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: clang-tidy-report-freertos-plustcp
+          path: build/tidy/clang-tidy-output.txt
+          retention-days: 1
+
+  # Same freertos coverage rationale as analyze-tidy-freertos-plustcp. Overrides
+  # CMAKE_C_COMPILER explicitly to clang-19 because the cpputest-freertos image
+  # (chained from the cpputest gcc base) ships clang-19/clang++-19 but no
+  # `clang`/`clang++` alternative — only the cpputest-clang image creates that
+  # alias. A future image bump could add the alternative to the gcc base and
+  # drop these overrides.
+  analyze-iwyu-freertos-plustcp:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/davidcozens/cpputest-freertos:sha-a0c1c0a
+      options: --user root
+    env:
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: safe.directory
+      GIT_CONFIG_VALUE_0: '*'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Configure
+        run: cmake --preset iwyu -DCMAKE_C_COMPILER=clang-19 -DCMAKE_CXX_COMPILER=clang++-19
+
+      - name: Run include-what-you-use
+        shell: bash
+        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt
+
+      - name: Upload iwyu output
+        if: success() || failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: iwyu-report-freertos-plustcp
+          path: build/iwyu/iwyu-output.txt
+          retention-days: 1
+
   analyze-format:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -492,7 +559,7 @@ jobs:
   analyze-cppcheck:
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/davidcozens/cpputest:sha-18f19e1
+      image: ghcr.io/davidcozens/cpputest:sha-2c7b76b
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -857,7 +924,7 @@ jobs:
       contents: read
       checks: write
     container:
-      image: ghcr.io/davidcozens/cpputest-freertos:sha-24de138
+      image: ghcr.io/davidcozens/cpputest-freertos:sha-a0c1c0a
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -901,7 +968,7 @@ jobs:
     permissions:
       contents: read
     container:
-      image: ghcr.io/davidcozens/cpputest-freertos-cross:sha-24de138
+      image: ghcr.io/davidcozens/cpputest-freertos-cross:sha-a0c1c0a
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -986,7 +1053,7 @@ jobs:
 
   summary:
     if: always() && github.event_name == 'pull_request'
-    needs: [build-linux-gcc, build-linux-tunable-override, build-linux-clang, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-cppcheck, analyze-format, analyze-iwyu, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl, integration-linux-mbedtls, integration-windows-openssl, build-freertos-host-tdd-plustcp, build-freertos-target-plustcp, bdd-freertos-qemu-plustcp]
+    needs: [build-linux-gcc, build-linux-tunable-override, build-linux-clang, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-tidy-freertos-plustcp, analyze-cppcheck, analyze-format, analyze-iwyu, analyze-iwyu-freertos-plustcp, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl, integration-linux-mbedtls, integration-windows-openssl, build-freertos-host-tdd-plustcp, build-freertos-target-plustcp, bdd-freertos-qemu-plustcp]
     runs-on: ubuntu-latest
     permissions:
       contents: read

Bdd/Targets/FreeRtos/Common/CmsdkUart.c

@@ -3,6 +3,14 @@
 #include <stdbool.h>
 #include <stddef.h>
 
+// The CMSDK UART register-offset, control-bit and status-bit macros below
+// mirror the ARM CMSDK UART hardware datasheet exactly, plus the integer-
+// valued YIELD_MILLISECONDS yield interval. The macro form is intentional —
+// a future reader can grep `DATA_OFFSET` against vendor docs and land on
+// these definitions verbatim. Converting them to enums would obscure that
+// mapping, so we keep them as #defines. Mirrors the suppression in
+// Tests/FreeRtos/CmsdkUartFake.c.
+// NOLINTBEGIN(cppcoreguidelines-macro-to-enum,modernize-macro-to-enum)
 #define DATA_OFFSET 0x000U
 #define STATE_OFFSET 0x004U
 #define CTRL_OFFSET 0x008U
@@ -15,6 +23,7 @@
 #define RX_FULL_BIT 0x02U
 
 #define YIELD_MILLISECONDS 1
+// NOLINTEND(cppcoreguidelines-macro-to-enum,modernize-macro-to-enum)
 
 static const CmsdkUartMemoryAccess* memoryAccess = NULL;
 static uintptr_t base = 0U;

CLAUDE.md

@@ -17,11 +17,16 @@ All changes to `main` must go via a pull request — direct pushes are blocked b
 **Merge strategy:** Squash merge only. This keeps a linear history on `main` and means the PR title
 becomes the single commit message — so the PR title must follow Conventional Commits format (see below).
 
-**Before raising a PR — run locally:**
-- build-linux-gcc, build-linux-clang, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-cppcheck, analyze-format
-- Windows, BDD, and OpenSSL integration jobs are CI's responsibility — running them locally would slow development too much
-- Commits on the branch can be informal (work-in-progress messages are fine)
-- The PR title is what matters — it becomes the permanent commit message on `main`
+**Before raising a PR — see [docs/local-checks.md](docs/local-checks.md)** for the
+full tiered pre-PR check budget. One-line summary:
+
+- Per-commit: `debug` build + tests for the matching preset (~30–60 s)
+- Pre-push (only when production source changed): IWYU + `clang-format` reflow + `scripts/misra_renumber.py` (~3–5 min)
+- Everything else (`tidy`, `sanitize`, `coverage`, Windows, BDD, integration, FreeRTOS host/cross) — CI's job; do not run locally
+- If CI surfaces a finding you missed, fix in another commit on the same branch rather than re-running every lane locally
+
+Commits on the branch can be informal (WIP messages are fine). The PR title is
+what matters — it becomes the permanent commit message on `main` on squash merge.
 
 **Branch protection rules (configured on GitHub):**
 - Direct pushes to `main` are blocked

DEVLOG.md

@@ -12323,3 +12323,101 @@ MISRA rule — different category, doesn't set precedent.
   clang container) but needs re-applying via the IDE before the next
   Rebuild Container. Format pipeline going forward: filter
   `git diff --name-only` for `.c|.cpp|.h|.hpp$` extensions.
+
+## 2026-05-26 — S24.11: freertos-aware analyze-tidy + analyze-iwyu, misra_renumber tool, tiered pre-PR doc
+
+### Decisions
+
+- **Extend analyzer CI rather than add new gates.** S24.11's scope was
+  narrowed to "wire the existing `tidy` / `iwyu` presets through the
+  freertos image" — single `analyze-tidy-freertos-plustcp` +
+  `analyze-iwyu-freertos-plustcp` pair. Avoids per-backend duplication
+  (LWIP deferred to S28.06).
+
+- **Single image bump cascades through the chain.** Built IWYU 0.23 from
+  the `clang_19` upstream branch into `cpputest` (gcc base) so it
+  matches the version in `cpputest-clang`. `cpputest-freertos` chains
+  `FROM cpputest`, so the rebase inherits IWYU automatically. New SHAs:
+  `cpputest:sha-2c7b76b`, `cpputest-freertos:sha-a0c1c0a`,
+  `cpputest-freertos-cross:sha-a0c1c0a`.
+
+- **FreeRTOS umbrella-header convention codified in `scripts/iwyu_filter.py`.**
+  IWYU sees specific types in `task.h` / `portmacro.h` /
+  `FreeRTOS_DNS_Globals.h` and suggests including them directly,
+  removing `FreeRTOS.h` / `FreeRTOS_IP.h`. Both umbrellas must stay first
+  to set up the build environment from `FreeRTOSConfig.h`. Filter now
+  drops removals of those umbrellas and adds of the private sub-headers.
+
+- **Tidy treatment: A2 (per-file NOLINTBEGIN/END) over A1 (tier-wide).**
+  David's preference shifted mid-session — first picked A2 for
+  `Tests/FreeRtos/CmsdkUartFake.c` register macros, then flagged
+  dislike of inline suppression generally. We kept the A2 form for
+  consistency with the BDD-side `Bdd/Targets/FreeRtos/Common/CmsdkUart.c`
+  (mirrors the test fake) and queued S24.12 (#461) as the tier-wide
+  audit follow-up.
+
+- **`bugprone-easily-swappable-parameters` disabled tier-wide in
+  `Tests/.clang-tidy`.** The rule fires too often for legitimate
+  MMIO-helper / equality-assertion patterns; real arg-swap bugs in tests
+  get caught by the test itself.
+
+- **MbedTls struct names exempted at `Platform/MbedTls/.clang-tidy`.**
+  Forward declarations of `mbedtls_ctr_drbg_context`, `mbedtls_x509_crt`,
+  `mbedtls_pk_context` violate `StructCase` + `StructPrefix` rules but
+  renaming is impossible. New per-platform-component `.clang-tidy` with
+  a `StructIgnoredRegexp` override (re-stating the root whitelist plus
+  `mbedtls_[a-z0-9_]+`). clang-tidy CheckOption values don't merge
+  across the hierarchy — the override file restates the root pattern
+  verbatim.
+
+- **`scripts/misra_renumber.py` shipped early.** Originally planned as the
+  S24.11 closing commit; brought forward when the IWYU apply shifted
+  line numbers in `Platform/PlusTcp/Source/SolidSyslogPlusTcpAddress.c`
+  and `SolidSyslogPlusTcpDatagram.c`, breaking
+  `misra_suppressions.txt`. Two-pass design: pass 1 audits against
+  unsuppressed findings; pass 2 catches per-location dedup
+  shadowing (cppcheck only reports the first rule fired at a line, so
+  a 11.3 hiding behind a 11.2 surfaces only when run with the existing
+  suppressions list).
+
+- **Tiered pre-PR check budget written to `docs/local-checks.md`.**
+  Replaces the old "run 8 presets locally" guidance (30+ min) with:
+  per-commit `debug` build + tests (~30–60s); pre-push IWYU + format
+  + `misra_renumber.py` only when production source changed (~3–5 min);
+  CI owns everything else.
+
+### Deferred
+
+- **S24.12 (#461) — inline-suppression audit.** Promote tests-only
+  rules to tier-level, fix where possible, move MISRA cases to
+  `misra_suppressions.txt`, keep inline only as last resort. David's
+  open question: how many non-MISRA cppcheck inline suppressions
+  remain after that cleanup?
+
+- **LWIP analyzer lane.** S28.06 (when the lwIP backend is feature-
+  complete) is where adding an `analyze-tidy-freertos-lwip` /
+  `analyze-iwyu-freertos-lwip` lane belongs naturally. Today the
+  freertos image carries both backends, but only PLUSTCP is wired into
+  the new lanes.
+
+- **Removing the `-DCMAKE_C_COMPILER=clang-19` override.** The
+  `cpputest` gcc base image carries `clang-19` with no `clang`
+  alternative, so the freertos-aware IWYU lane spells the version
+  explicitly. Adding `update-alternatives --install /usr/bin/clang
+  clang /usr/bin/clang-19 100` to the gcc Dockerfile in a future image
+  bump would let the override drop.
+
+### Open questions
+
+- The dead `cppcheck-suppress` entries that `misra_renumber.py`'s pass-1
+  flagged (`new=[]`) — are they stale (rule no longer fires at all) or
+  shadowed by inline suppressions? S24.12 should resolve case by case.
+
+- `Platform/Windows/Source/SolidSyslogWindowsAtomicCounter.c`'s
+  `unreadVariable` finding had been sitting silently in
+  `cppcheck-report.xml` for many CI runs (the XML-report step doesn't
+  carry `--error-exitcode=1`). Should we tighten that step to
+  `--error-exitcode=1` so quiet style findings can't accumulate? Risk:
+  every untriaged style finding becomes a hard gate. Worth E24
+  discussion.
+

Platform/LwipRaw/Source/SolidSyslogLwipRawResolver.c

@@ -1,13 +1,12 @@
-#include "SolidSyslogLwipRawResolverPrivate.h"
-
 #include <stdbool.h>
 #include <stdint.h>
 
+#include "SolidSyslogLwipRawResolverPrivate.h"
 #include "lwip/ip_addr.h"
-
 #include "SolidSyslogLwipRawAddressPrivate.h"
 #include "SolidSyslogNullResolver.h"
 #include "SolidSyslogResolverDefinition.h"
+#include "SolidSyslogTransport.h"
 
 struct SolidSyslogAddress;
 

Platform/MbedTls/.clang-tidy

@@ -0,0 +1,22 @@
+---
+# Pragmatic tier per docs/NAMING.md — Platform/MbedTls.
+#
+# Inherits the root .clang-tidy. SolidSyslogMbedTlsStream.h (Interface/) and
+# SolidSyslogMbedTlsStream.c (Source/) both refer to upstream Mbed TLS struct
+# types — `mbedtls_ctr_drbg_context`, `mbedtls_x509_crt`, `mbedtls_pk_context`,
+# `mbedtls_ssl_context`, … — because the integrator-supplied handles in
+# SolidSyslogMbedTlsStreamConfig are those types (see
+# project_mbedtls_di_handles). The upstream names use snake_case prefixed with
+# `mbedtls_`, which violates the project's StructCase + StructPrefix rule, but
+# renaming is impossible (they're third-party). Extend StructIgnoredRegexp
+# locally so the rule exempts the mbedTLS namespace.
+#
+# clang-tidy CheckOption values do not merge across the hierarchy — the
+# latest-encountered value wins. The pattern below therefore re-states the
+# root .clang-tidy whitelist plus the mbedtls_ namespace. Keep in sync.
+InheritParentConfig: true
+CheckOptions:
+  - {
+      key: readability-identifier-naming.StructIgnoredRegexp,
+      value: "^(SolidSyslog|EscapedContext|BlockPresence|OpenHandle|mbedtls_[a-z0-9_]+)$",
+    }