Fix review comments for clang-tidy PR adoption

Author: RSingh1511

.clang-tidy

@@ -1,5 +1,5 @@
 # *******************************************************************************
-# Copyright (c) 2025 Contributors to the Eclipse Foundation
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
 # information regarding copyright ownership.
@@ -12,10 +12,22 @@
 # *******************************************************************************
 
 # Clang-tidy configuration for score_logging.
-Checks: >
-  -*, clang-analyzer-*, cert-*, cppcoreguidelines-*, bugprone-*, misc-*, performance-*, readability-*, modernize-* #magic___^_^___line
-WarningsAsErrors: >
-  clang-analyzer-*, #magic___^_^___line
-HeaderFilterRegex: '^(?!.*/third_party/).*'
+Checks: >-
+  -*,
+  clang-analyzer-*,
+  cert-*,
+  cppcoreguidelines-*,
+  bugprone-*,
+  misc-*,
+  performance-*,
+  readability-*,
+  modernize-*
+
+# NOTE: WarningsAsErrors is yet subject to be expanded per module as compliance increases.
+WarningsAsErrors: >-
+  clang-analyzer-*
+
+# Exclude third-party, generated, and external-repo headers from analysis.
+HeaderFilterRegex: '^(?!.*/(third_party|external|bazel-out)/).*$'
 
 FormatStyle: file

.github/workflows/clang_tidy.yml

@@ -18,14 +18,27 @@ on:
     types: [opened, reopened, synchronize]
   merge_group:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: clang-tidy-${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   clang-tidy:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - name: Setup Bazel
         uses: bazel-contrib/setup-bazel@0.15.0
         with:
           bazelisk-version: 1.26.0
+          disk-cache: clang-tidy
+          repository-cache: true
+          external-cache: true
       - name: Run clang-tidy
+        # Scope limited to //score/mw/... because Rust/QNX targets are not yet
+        # validated against this configuration. Expand once they pass.
         run: bazel test --config=clang-tidy --lockfile_mode=error //score/mw/...

MODULE.bazel

@@ -21,12 +21,13 @@ bazel_dep(name = "rules_python", version = "1.4.1")
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "rules_rust", version = "0.68.1-score")
 bazel_dep(name = "rules_cc", version = "0.1.1")
-bazel_dep(name = "aspect_rules_lint", version = "1.0.3")
+bazel_dep(name = "aspect_rules_lint", version = "2.5.0")
 
 bazel_dep(name = "score_cpp_policies", version = "0.0.0", dev_dependency = True)
 git_override(
     module_name = "score_cpp_policies",
-    commit = "87b5b33dea15ff2e2dde1b0aae9cb982f49bc277",
+    # TODO: replace with merged commit on eclipse-score/score_cpp_policies once PR #2 lands.
+    commit = "f147fc8",
     remote = "https://github.com/RSingh1511/score_cpp_policies.git",
 )