Please work

.checkov.yml

@@ -0,0 +1,6 @@
+---
+# You can see all available properties here: https://github.com/bridgecrewio/checkov#configuration-using-a-config-file
+quiet: true
+skip-check:
+  - CKV_DOCKER_2
+  - CKV_GHA_7

.clang-format

@@ -24,6 +24,7 @@ ExperimentalAutoDetectBinPacking: false
 IndentCaseLabels: true
 IndentFunctionDeclarationAfterType: true
 IndentWidth:     2
+InsertNewlineAtEOF: true
 # It is broken on windows. Breaks all #include "header.h"
 ---
 Language:        Cpp
@@ -38,7 +39,60 @@ PenaltyBreakFirstLessLess: 120
 PenaltyBreakString: 1000
 PenaltyExcessCharacter: 1000000
 PenaltyReturnTypeOnItsOwnLine: 200
-SortIncludes: false
+SortIncludes: CaseSensitive
+IncludeBlocks: Regroup
+IncludeCategories:
+  # O2Physics, PWG
+  - Regex: ^(<|")PWG[A-Z]{2}/.*\.h
+    Priority: 2
+    CaseSensitive: true
+  # O2Physics, non-PWG
+  - Regex: ^(<|")(Common|ALICE3|DPG|EventFiltering|Tools|Tutorials)/.*\.h
+    Priority: 3
+    CaseSensitive: true
+  # O2
+  - Regex: ^(<|")(Algorithm|CCDB|Common[A-Z]|DataFormats|DCAFitter|Detectors|EMCAL|Field|Framework|FT0|FV0|GlobalTracking|GPU|ITS|MathUtils|MFT|MCH|MID|PHOS|PID|ReconstructionDataFormats|SimulationDataFormat|TOF|TPC|ZDC).*/.*\.h
+    Priority: 4
+    CaseSensitive: true
+  # ROOT
+  - Regex: ^(<|")(T[A-Z]|Math/|Roo[A-Z])[[:alnum:]/]+\.h
+    Priority: 5
+    CaseSensitive: true
+  # known third-party: KFParticle
+  - Regex: ^(<|")KF[A-Z][[:alnum:]]+\.h
+    Priority: 6
+    CaseSensitive: true
+  # known third-party: FastJet
+  - Regex: ^(<|")fastjet/
+    Priority: 6
+    CaseSensitive: true
+  # known third-party: ONNX runtime
+  - Regex: ^(<|")onnxruntime
+    Priority: 6
+    CaseSensitive: true
+  # incomplete path to DataModel
+  - Regex: ^(<|").*DataModel/
+    Priority: 1
+    CaseSensitive: true
+  # other third-party
+  - Regex: ^(<|")([[:alnum:]_]+/)+[[:alnum:]_]+\.h
+    Priority: 6
+    CaseSensitive: true
+  # other local-looking file
+  - Regex: ^".*\.
+    Priority: 1
+    CaseSensitive: true
+  # C system
+  - Regex: ^(<|")[[:lower:]_]+\.h(>|")
+    Priority: 102
+    CaseSensitive: true
+  # C++ system
+  - Regex: ^(<|")[[:lower:]_/]+(>|")
+    Priority: 101
+    CaseSensitive: true
+  # rest
+  - Regex: .*
+    Priority: 100
 SpaceBeforeAssignmentOperators: true
 SpaceBeforeParens: ControlStatements
 SpaceInEmptyParentheses: false

.clang-tidy

@@ -1,3 +1,21 @@
 CheckOptions:
-  - key: CheckPathRegex
-    value: '.*/O2/.*'
+  # Naming conventions
+  - { key: readability-identifier-naming.ClassCase, value: CamelCase }
+  - { key: readability-identifier-naming.ClassMemberPrefix, value: m }
+  - { key: readability-identifier-naming.ConceptCase, value: CamelCase }
+  - { key: readability-identifier-naming.ConstexprVariableCase, value: CamelCase }
+  - { key: readability-identifier-naming.EnumCase, value: CamelCase }
+  - { key: readability-identifier-naming.EnumConstantCase, value: CamelCase }
+  - { key: readability-identifier-naming.EnumConstantIgnoredRegexp, value: "^k?[A-Z][a-zA-Z0-9_]*$" }  # Allow "k" prefix and non-trailing underscores in PDG names.
+  - { key: readability-identifier-naming.FunctionCase, value: camelBack }
+  - { key: readability-identifier-naming.MacroDefinitionCase, value: UPPER_CASE }
+  - { key: readability-identifier-naming.MacroDefinitionIgnoredRegexp, value: "^[A-Z][A-Z0-9_]*_$" }  # Allow the trailing underscore in header guards.
+  - { key: readability-identifier-naming.MemberCase, value: camelBack }
+  - { key: readability-identifier-naming.NamespaceCase, value: lower_case }
+  - { key: readability-identifier-naming.ParameterCase, value: camelBack }
+  - { key: readability-identifier-naming.StructCase, value: CamelCase }
+  - { key: readability-identifier-naming.TemplateParameterCase, value: CamelCase }
+  - { key: readability-identifier-naming.TypeAliasCase, value: CamelCase }
+  - { key: readability-identifier-naming.TypedefCase, value: CamelCase }
+  - { key: readability-identifier-naming.TypeTemplateParameterCase, value: CamelCase }
+  - { key: readability-identifier-naming.VariableCase, value: camelBack }

.github/dependabot.yml

@@ -0,0 +1,10 @@
+---
+# Dependabot configuration
+# Reference: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/labeler.yml

@@ -0,0 +1,69 @@
+---
+alice3:
+  - changed-files:
+      - any-glob-to-any-file: ['ALICE3/**']
+
+common:
+  - changed-files:
+      - any-glob-to-any-file: ['Common/**']
+
+infrastructure:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '.clang-format'
+          - '.clang-tidy'
+          - '.flake8'
+          - '.github/**'
+          - '.checkov.yml'
+          - '.mega-linter.yml'
+          - '.pre-commit-config.yaml'
+          - 'cmake/**'
+          - 'CODEOWNERS'
+          - 'CPPLINT.cfg'
+          - 'dependencies/**'
+          - 'packaging/**'
+          - 'pyproject.toml'
+
+datamodel:
+  - changed-files:
+      - any-glob-to-any-file: ['DataModel/**', '**/DataModel/**']
+
+dpg:
+  - changed-files:
+      - any-glob-to-any-file: ['DPG/**']
+
+pwgcf:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGCF/**', '*/PWGCF/**']
+
+pwgdq:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGDQ/**', '*/PWGDQ/**']
+
+pwgem:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGEM/**', '*/PWGEM/**']
+
+pwghf:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGHF/**', '*/PWGHF/**']
+
+pwgje:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGJE/**', '*/PWGJE/**']
+
+pwglf:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGLF/**', '*/PWGLF/**', 'PWGMM/**', '*/PWGMM/**']
+
+pwgud:
+  - changed-files:
+      - any-glob-to-any-file: ['PWGUD/**', '*/PWGUD/**']
+
+trigger:
+  - changed-files:
+      - any-glob-to-any-file: ['EventFiltering/**']
+
+tutorial:
+  - changed-files:
+      - any-glob-to-any-file: ['Tutorials/**']

.github/workflows/clean-test.yml

@@ -0,0 +1,51 @@
+---
+name: Clean PR checks
+
+'on':
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: PR number in this repo to be cleaned
+        type: string   # can't use number here
+        required: true
+      message:
+        description: Human-readable message displayed on the new pending status
+        type: string
+        required: false
+        default: ''
+
+      # Warning: GitHub limits the total number of inputs to 10, so a maximum of
+      # 8 checks is allowed here!
+      # Warning: the check_* keys are magic and must consist of the string
+      # "check_" followed by the applicable check name exactly. The
+      # "description" field is only the human-readable label for the input.
+      'check_build/O2Physics/o2/macOS-arm':
+        description: build/O2Physics/o2/macOS-arm
+        type: boolean
+        default: true
+
+      'check_build/O2Physics/o2/macOS':
+        description: build/O2Physics/o2/macOS
+        type: boolean
+        default: true
+
+      'check_build/O2Physics/o2':
+        description: build/O2Physics/o2
+        type: boolean
+        default: true
+
+permissions: {}
+
+jobs:
+  clean:
+    name: Clean PR checks
+    uses: alisw/ali-bot/.github/workflows/clean-pr-checks.yml@master
+    with:
+      owner: ${{ github.event.repository.owner.login }}
+      repo: ${{ github.event.repository.name }}
+      pr: ${{ github.event.inputs.pr }}
+      message: ${{ github.event.inputs.message }}
+      checks: ${{ toJSON(github.event.inputs) }}
+    permissions:
+      pull-requests: read  # to get last commit for pr (octokit/graphql-action)
+      statuses: write      # for set-github-status

.github/workflows/codeowner-self-approval.yml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   approve:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     # Only run if the PR author enabled auto-merge, not someone else.
     # Also run if a new approval was created, as this affects whether we can
     # auto-approve. There is a risk of infinite loops here, though -- when we

.github/workflows/labeler.yml

@@ -0,0 +1,122 @@
+---
+name: "Pull Request Labeler"
+'on':
+  pull_request_target:
+    types: [opened, synchronize, reopened, edited]
+permissions: read-all
+
+jobs:
+  labeler:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    outputs:
+      labels: ${{ steps.labeler.outputs.all-labels }}
+    steps:
+      - name: Label the PR
+        id: labeler
+        uses: actions/labeler@v6
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: true
+  title-prefix-checker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    needs: labeler
+    steps:
+      - name: Check the PR title prefix
+        id: check-prefix
+        env:
+          title: ${{ github.event.pull_request.title }}
+          labels: ${{ needs.labeler.outputs.labels }}
+        shell: python
+        run: |
+          import os
+          import re
+          import sys
+          title = os.environ['title']
+          labels = os.environ['labels']
+          tags = {
+              "infrastructure": "Infrastructure",
+              "common": "Common",
+              "alice3": "ALICE3",
+              "pwgcf": "PWGCF",
+              "pwgdq": "PWGDQ",
+              "pwgem": "PWGEM",
+              "pwghf": "PWGHF",
+              "pwgje": "PWGJE",
+              "pwglf": "PWGLF",
+              "pwgud": "PWGUD",
+              "dpg": "DPG",
+              "trigger": "Trigger",
+              "tutorial": "Tutorial",
+          }
+          print(f'PR title: "{title}"')
+          print(f'PR labels: "{labels}"')
+          tags_relevant = [tags[label] for label in tags if label in labels.split(",")]
+          print("Relevant title tags:", ",".join(tags_relevant))
+          passed = True
+          prefix_good = ",".join(tags_relevant)
+          prefix_good = f"[{prefix_good}] "
+          print(f"Generated prefix: {prefix_good}")
+          replace_title = 0
+          title_new = title
+          # If there is a prefix which contains a known tag, check it for correct tags, and reformat it if needed.
+          # If there is a prefix which does not contain any known tag, add the tag prefix.
+          # If there is no prefix, add the tag prefix.
+          if match := re.match(r"\[?(\w[\w, /\+-]+)[\]:]+ ", title):
+              prefix_title = match.group(1)
+              words_prefix_title = prefix_title.replace(",", " ").replace("/", " ").split()
+              title_stripped = title[len(match.group()) :]
+              print(f'PR title prefix: "{prefix_title}" -> tags: {words_prefix_title}')
+              print(f'Stripped PR title: "{title_stripped}"')
+              if any(tag in words_prefix_title for tag in tags.values()):
+                  for tag in tags.values():
+                      if tag in tags_relevant and tag not in words_prefix_title:
+                          print(f'::error::Relevant tag "{tag}" not found in the prefix of the PR title.')
+                          passed = False
+                      if tag not in tags_relevant and tag in words_prefix_title:
+                          print(f'::error::Irrelevant tag "{tag}" found in the prefix of the PR title.')
+                          passed = False
+                  # Format a valid prefix.
+                  if passed:
+                      prefix_good = ",".join(w for w in prefix_title.replace(",", " ").split() if w)
+                      prefix_good = f"[{prefix_good}] "
+                      print(f"::notice::Reformatted prefix: {prefix_good}")
+                      if match.group() != prefix_good:
+                          replace_title = 1
+                          title_new = prefix_good + title_stripped
+              else:
+                  print("::warning::No known tags found in the prefix.")
+                  if tags_relevant:
+                      replace_title = 1
+                      title_new = prefix_good + title
+          else:
+              print("::warning::No valid prefix found in the PR title.")
+              if tags_relevant:
+                  replace_title = 1
+                  title_new = prefix_good + title
+          if not passed:
+              print("::error::Problems were found in the PR title prefix.")
+              print('::notice::Use the form "tags: title" or "[tags] title".')
+              sys.exit(1)
+          if replace_title:
+              print("::warning::The PR title prefix with tags needs to be added or adjusted.")
+              print(f'::warning::New title: "{title_new}".')
+          else:
+              print("::notice::The PR title prefix is fine.")
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
+              print(f"replace={replace_title}", file=fh)
+              print(f"title={title_new}", file=fh)
+      - name: Fix the PR title prefix
+        if: ${{ steps.check-prefix.outputs.replace == 1 }}
+        uses: the-wright-jamie/Update-PR-Info-Action@v1.1.0
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"
+          base-branch-regex: master
+          error-on-fail: false
+          title-template: "${{ steps.check-prefix.outputs.title }}"
+          title-update-action: replace

.github/workflows/mega-linter.yml

@@ -23,7 +23,7 @@ jobs:
     steps:
       # Git Checkout
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # Checkout the HEAD of the PR instead of the merge commit.
           ref: ${{ github.event.pull_request.head.sha }}
@@ -38,7 +38,7 @@ jobs:
         id: ml
         # You can override MegaLinter flavor used to have faster performances
         # More info at https://megalinter.io/flavors/
-        uses: oxsecurity/megalinter@v7
+        uses: oxsecurity/megalinter@v9.1.0
         env:
           # All available variables are described in documentation:
           # https://megalinter.io/configuration/
@@ -49,7 +49,7 @@ jobs:
 
       # Upload MegaLinter artifacts
       - name: Archive production artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         if: success() || failure()
         with:
           name: MegaLinter reports