[GitHub][CI] Add clang-tidy premerge workflow (#154829)

**KEY POINTS**

- MVP workflow to automatically lint C++ files, located **only** in
`clang-tools-extra/clang-tidy`. It's chosen this way as
`clang-tools-extra/clang-tidy` is almost 100% `clang-tidy` complaint,
thus we would automatically enforce a [high quality standard for
clang-tidy source
code](https://discourse.llvm.org/t/rfc-create-hardened-clang-tidy-config-for-clang-tidy-directory/87247).
(#147793)
- Implementation is very similar to code-format job, but without the
ability to run `code-lint-helper.py` locally.

**FOUND ISSUES** + open questions

- Speed: it takes ~ 1m40sec to download and unpack `clang-tidy` plus
additional ~4 mins to configure and CodeGen targets. I see that
`premerge.yaml` runs on special `llvm-premerge-linux-runners` runners
which can use `sccache` for speed. Can we use the same runners for this
job? Exact timings can be found
[here](https://github.com/llvm/llvm-project/actions/runs/17135749067/job/48611150680?pr=154223).

**TO DO**
 
- Place common components from `code-lint-helper.py` and
`code-format-helper.py` into a separate file and reuse it in both CI's.
- Compute CodeGen targets based on `projects_to_build`, for now
`clang-tablegen-targets` is hardcoded for `clang-tools-extra/`.
- Automatically generate and upload `.yaml` for
`clang-apply-replacements`
- Create an RFC with a plan how to enable `clang-tidy` in other projects
so that Maintainers of LLVM components could choose if they want
`clang-tidy` or not.
- Add more linters like `pylint`, `ruff` in the future.

Author: vbvictor

.github/workflows/issue-write.yml

@@ -6,6 +6,7 @@ on:
       - "Check code formatting"
       - "Check for private emails used in PRs"
       - "PR Request Release Note"
+      - "Code lint"
     types:
       - completed
 

.github/workflows/pr-code-lint.yml

@@ -0,0 +1,123 @@
+name: "Code lint"
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'users/**'
+    paths:
+      - 'clang-tools-extra/clang-tidy/**'
+
+jobs:
+  code_linter:
+    if: github.repository_owner == 'llvm'
+    runs-on: ubuntu-24.04
+    defaults:
+      run:
+        shell: bash
+    container:
+      image: 'ghcr.io/llvm/ci-ubuntu-24.04:latest'
+    timeout-minutes: 60
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Fetch LLVM sources
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          fetch-depth: 2
+      
+      - name: Get changed files
+        id: changed-files
+        uses: step-security/changed-files@3dbe17c78367e7d60f00d78ae6781a35be47b4a1 # v45.0.1
+        with:
+          separator: ","
+          skip_initial_fetch: true
+          base_sha: 'HEAD~1'
+          sha: 'HEAD'
+      
+      - name: Listed files
+        env:
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+        run: |
+          echo "Changed files:"
+          echo "$CHANGED_FILES"
+      
+      - name: Fetch code linting utils
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.base_ref }}
+          sparse-checkout: |
+            llvm/utils/git/code-lint-helper.py
+            llvm/utils/git/requirements_linting.txt
+            clang-tools-extra/clang-tidy/tool/clang-tidy-diff.py
+          sparse-checkout-cone-mode: false
+          path: code-lint-tools
+
+      - name: Install clang-tidy
+        uses: aminya/setup-cpp@17c11551771948abc5752bbf3183482567c7caf0 # v1.1.1
+        with:
+          clang-tidy: 20.1.8
+      
+      - name: Setup Python env
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        with:
+          python-version: '3.12'
+
+      - name: Install Python dependencies
+        run: python3 -m pip install -r code-lint-tools/llvm/utils/git/requirements_linting.txt
+      
+      # TODO: create special mapping for 'codegen' targets, for now build predefined set
+      # TODO: add entrypoint in 'compute_projects.py' that only adds a project and its direct dependencies
+      - name: Configure and CodeGen
+        run: |
+          git config --global --add safe.directory '*'
+
+          . <(git diff --name-only HEAD~1...HEAD | python3 .ci/compute_projects.py)
+
+          if [[ "${projects_to_build}" == "" ]]; then
+            echo "No projects to analyze"
+            exit 0
+          fi
+
+          cmake -G Ninja \
+                -B build \
+                -S llvm \
+                -DLLVM_ENABLE_ASSERTIONS=OFF \
+                -DLLVM_ENABLE_PROJECTS="${projects_to_build}" \
+                -DCMAKE_CXX_COMPILER=clang++ \
+                -DCMAKE_C_COMPILER=clang \
+                -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
+                -DLLVM_INCLUDE_TESTS=OFF \
+                -DCLANG_INCLUDE_TESTS=OFF \
+                -DCMAKE_BUILD_TYPE=Release
+          
+          ninja -C build \
+                clang-tablegen-targets \
+                genconfusable               # for "ConfusableIdentifierCheck.h"
+
+      - name: Run code linter
+        env:
+          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
+          CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+        run: |
+          echo "[]" > comments &&
+          python3 ./code-lint-tools/llvm/utils/git/code-lint-helper.py \
+            --token ${{ secrets.GITHUB_TOKEN }} \
+            --issue-number $GITHUB_PR_NUMBER \
+            --start-rev HEAD~1 \
+            --end-rev HEAD \
+            --verbose \
+            --changed-files "$CHANGED_FILES"
+      
+      - name: Upload results
+        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 #v4.3.0
+        if: always()
+        with:
+          name: workflow-args
+          path: |
+            comments