Merge branch 'master' into helicity_MCTruth

Author: a-m-andrushko

.clang-format

@@ -39,7 +39,60 @@ PenaltyBreakFirstLessLess: 120
 PenaltyBreakString: 1000
 PenaltyExcessCharacter: 1000000
 PenaltyReturnTypeOnItsOwnLine: 200
-SortIncludes: false
+SortIncludes: CaseSensitive
+IncludeBlocks: Regroup
+IncludeCategories:
+  # O2Physics, PWG
+  - Regex: ^(<|")PWG[A-Z]{2}/.*\.h
+    Priority: 2
+    CaseSensitive: true
+  # O2Physics, non-PWG
+  - Regex: ^(<|")(Common|ALICE3|DPG|EventFiltering|Tools|Tutorials)/.*\.h
+    Priority: 3
+    CaseSensitive: true
+  # O2
+  - Regex: ^(<|")(Algorithm|CCDB|Common[A-Z]|DataFormats|DCAFitter|Detectors|EMCAL|Field|Framework|FT0|FV0|GlobalTracking|ITS|MathUtils|MFT|MCH|MID|PHOS|PID|ReconstructionDataFormats|SimulationDataFormat|TOF|TPC|ZDC).*/.*\.h
+    Priority: 4
+    CaseSensitive: true
+  # ROOT
+  - Regex: ^(<|")(T[A-Z]|Math/|Roo[A-Z])[[:alnum:]/]+\.h
+    Priority: 5
+    CaseSensitive: true
+  # known third-party: KFParticle
+  - Regex: ^(<|")KF[A-Z][[:alnum:]]+\.h
+    Priority: 6
+    CaseSensitive: true
+  # known third-party: FastJet
+  - Regex: ^(<|")fastjet/
+    Priority: 6
+    CaseSensitive: true
+  # known third-party: ONNX runtime
+  - Regex: ^(<|")onnxruntime
+    Priority: 6
+    CaseSensitive: true
+  # incomplete path to DataModel
+  - Regex: ^(<|").*DataModel/
+    Priority: 1
+    CaseSensitive: true
+  # other third-party
+  - Regex: ^(<|")([[:alnum:]_]+/)+[[:alnum:]_]+\.h
+    Priority: 6
+    CaseSensitive: true
+  # other local-looking file
+  - Regex: ^".*\.
+    Priority: 1
+    CaseSensitive: true
+  # C system
+  - Regex: ^(<|")[[:lower:]_]+\.h(>|")
+    Priority: 102
+    CaseSensitive: true
+  # C++ system
+  - Regex: ^(<|")[[:lower:]_/]+(>|")
+    Priority: 101
+    CaseSensitive: true
+  # rest
+  - Regex: .*
+    Priority: 100
 SpaceBeforeAssignmentOperators: true
 SpaceBeforeParens: ControlStatements
 SpaceInEmptyParentheses: false

.clang-tidy

@@ -1,3 +1,23 @@
 CheckOptions:
-  - key: CheckPathRegex
-    value: '.*/O2/.*'
+  - { key: CheckPathRegex, value: ".*/O2/.*" }
+  # Naming conventions
+  - { key: readability-identifier-naming.ClassCase, value: CamelCase }
+  - { key: readability-identifier-naming.ClassMemberPrefix, value: m }
+  - { key: readability-identifier-naming.ConceptCase, value: CamelCase }
+  - { key: readability-identifier-naming.ConstexprVariableCase, value: CamelCase }
+  - { key: readability-identifier-naming.ConstexprVariableIgnoredRegexp, value: "^k[A-Z].*$" }  # Allow "k" prefix.
+  - { key: readability-identifier-naming.EnumCase, value: CamelCase }
+  - { key: readability-identifier-naming.EnumConstantCase, value: CamelCase }
+  - { key: readability-identifier-naming.EnumConstantIgnoredRegexp, value: "^k[A-Z].*$" }  # Allow "k" prefix.
+  - { key: readability-identifier-naming.FunctionCase, value: camelBack }
+  - { key: readability-identifier-naming.MacroDefinitionCase, value: UPPER_CASE }
+  - { key: readability-identifier-naming.MacroDefinitionIgnoredRegexp, value: "^[A-Z]+(_[A-Z]+)*_$" }  # Allow the trailing underscore in header guards.
+  - { key: readability-identifier-naming.MemberCase, value: camelBack }
+  - { key: readability-identifier-naming.NamespaceCase, value: lower_case }
+  - { key: readability-identifier-naming.ParameterCase, value: camelBack }
+  - { key: readability-identifier-naming.StructCase, value: CamelCase }
+  - { key: readability-identifier-naming.TemplateParameterCase, value: CamelCase }
+  - { key: readability-identifier-naming.TypeAliasCase, value: CamelCase }
+  - { key: readability-identifier-naming.TypedefCase, value: CamelCase }
+  - { key: readability-identifier-naming.TypeTemplateParameterCase, value: CamelCase }
+  - { key: readability-identifier-naming.VariableCase, value: camelBack }

.git-blame-ignore-revs

@@ -0,0 +1,10 @@
+---
+# Dependabot configuration
+# Reference: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/dependabot.yml

@@ -16,6 +16,7 @@ infrastructure:
           - '.github/**'
           - '.checkov.yml'
           - '.mega-linter.yml'
+          - '.pre-commit-config.yaml'
           - 'cmake/**'
           - 'CODEOWNERS'
           - 'CPPLINT.cfg'
@@ -25,7 +26,7 @@ infrastructure:
 
 datamodel:
   - changed-files:
-      - any-glob-to-any-file: ['DataModel/**', '*/DataModel/**']
+      - any-glob-to-any-file: ['DataModel/**', '**/DataModel/**']
 
 dpg:
   - changed-files:

.github/labeler.yml

@@ -38,7 +38,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.io/flavors/
-        uses: oxsecurity/megalinter@v8.3.0
+        uses: oxsecurity/megalinter@v8.7.0
         env:
           # All available variables are described in documentation:
           # https://megalinter.io/configuration/

.github/workflows/mega-linter.yml

@@ -2,10 +2,10 @@
 # Find issues in O2 code
 name: O2 linter
 
-'on': [pull_request, push]
+"on": [pull_request_target, push]
 permissions: {}
 env:
-  MAIN_BRANCH: master
+  BRANCH_MAIN: master
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
@@ -15,20 +15,47 @@ jobs:
   o2-linter:
     name: O2 linter
     runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
     steps:
+      - name: Set branches
+        run: |
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            branch_head="${{ github.ref }}"
+            branch_base="${{ env.BRANCH_MAIN }}"
+          else
+            branch_head="refs/pull/${{ github.event.pull_request.number }}/merge"
+            branch_base="${{ github.event.pull_request.base.ref }}"
+          fi
+          echo BRANCH_HEAD="$branch_head" >> "$GITHUB_ENV"
+          echo BRANCH_BASE="$branch_base" >> "$GITHUB_ENV"
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
+          ref: ${{ env.BRANCH_HEAD }}
           fetch-depth: 0 # needed to get the full history
       - name: Run tests
+        id: linter
         run: |
-          # Diff against the common ancestor of the source branch and the main branch.
-          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.MAIN_BRANCH }}...)
+          # Diff against the common ancestor of the source (head) branch and the target (base) branch.
+          echo "Diffing ${{ env.BRANCH_HEAD }} against ${{ env.BRANCH_BASE }}."
+          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.BRANCH_BASE }}...)
           if [ ${#files[@]} -eq 0 ]; then
               echo "::notice::No files to lint."
+              echo "linter_ran=0" >> "$GITHUB_OUTPUT"
               exit 0
           fi
-          [ ${{ github.event_name }} == 'pull_request' ] && options="-g"
+          echo "linter_ran=1" >> "$GITHUB_OUTPUT"
+          [[ "${{ github.event_name }}" == "pull_request_target" ]] && options="-g"
           # shellcheck disable=SC2086 # Ignore unquoted options.
           python3 Scripts/o2_linter.py $options "${files[@]}"
           echo "Tip: If you allow actions in your fork repository, O2 linter will run when you push commits."
+      - name: Comment PR
+        if: (success() || failure()) && (github.event_name == 'pull_request_target' && steps.linter.outputs.linter_ran == 1)
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          comment-tag: o2-linter
+          message: "**O2 linter results:**
+            ❌ ${{ steps.linter.outputs.n_issues }} errors,
+            ⚠️ ${{ steps.linter.outputs.n_tolerated }} warnings,
+            🔕 ${{ steps.linter.outputs.n_disabled }} disabled"

.github/workflows/o2-linter.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v1
+      - uses: actions/stale@v9
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: 'This PR has not been updated in the last 30 days. Is it still needed? Unless further action is taken, it will be closed in 5 days.'

.github/workflows/stale.yml

@@ -15,7 +15,11 @@ DISABLE_LINTERS:
   - BASH_SHFMT
   - CPP_CLANG_FORMAT
   - JSON_PRETTIER
+  - PYTHON_BLACK
+  - PYTHON_FLAKE8
+  - PYTHON_ISORT
   - REPOSITORY_DEVSKIM
+  - REPOSITORY_GITLEAKS
   - REPOSITORY_KICS
   - REPOSITORY_SECRETLINT
   - REPOSITORY_TRIVY
@@ -35,3 +39,5 @@ PYTHON_PYRIGHT_CONFIG_FILE: pyproject.toml
 PYTHON_RUFF_CONFIG_FILE: pyproject.toml
 CPP_CPPLINT_FILE_EXTENSIONS: [".C", ".c", ".c++", ".cc", ".cl", ".cpp", ".cu", ".cuh", ".cxx", ".cxx.in", ".h", ".h++", ".hh", ".h.in", ".hpp", ".hxx", ".inc", ".inl", ".macro"]
 CPP_CLANG_FORMAT_FILE_EXTENSIONS: [".C", ".c", ".c++", ".cc", ".cl", ".cpp", ".cu", ".cuh", ".cxx", ".cxx.in", ".h", ".h++", ".hh", ".h.in", ".hpp", ".hxx", ".inc", ".inl", ".macro"]
+CPP_CPPCHECK_ARGUMENTS: --language=c++ --std=c++20 --check-level=exhaustive --suppressions-list=cppcheck_config
+REPOSITORY_GITLEAKS_PR_COMMITS_SCAN: true

.mega-linter.yml

@@ -0,0 +1,16 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+  - repo: https://github.com/pre-commit/mirrors-clang-format
+    rev: v20.1.5 # clang-format version
+    hooks:
+      - id: clang-format
+  - repo: https://github.com/cpplint/cpplint
+    rev: 2.0.2
+    hooks:
+      - id: cpplint