Commit 1e515580 for libheif

commit 1e5155806417e5a27c011d980c48b63e53926d30
Author: Dirk Farin <dirk.farin@gmail.com>
Date:   Thu Aug 27 00:38:02 2026 +0200

    .clang-tidy: list the checks that were actually enforced

    "performance-*" was the last entry of a folded YAML scalar and therefore
    reached clang-tidy as "performance-*\n". clang-tidy 12, which the CI used
    until now, trims only spaces from glob entries, so the pattern matched
    nothing and the tidy job never enforced any performance check. The
    Enabled-checks list in the CI logs confirms this.

    clang-tidy 18 trims the newline and reports about 200 sites in the CI
    configuration: 98 performance-enum-size on enums (mostly the public C API
    enums, whose base type is part of the ABI) and 96 other performance-*
    findings. Write the check list as a single string with exactly the checks
    that were enforced so far, so that the compiler upgrade does not change
    the policy by accident; enabling performance-* is a separate decision.

    Also disable clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
    the C11 Annex K check, like its strcat/strcpy siblings. It only applies
    to C code and fires on glib's inline memcpy helpers included by the
    gdk-pixbuf loader.

diff --git a/.clang-tidy b/.clang-tidy
index 7cb3c166..585e9c8b 100644
--- a/.clang-tidy
+++ b/.clang-tidy
@@ -1,13 +1,12 @@
 ---
-Checks: >
-  -clang-analyzer-security.insecureAPI.strcat,
-  -clang-analyzer-security.insecureAPI.strcpy,
-  modernize-shrink-to-fit,
-  modernize-use-default-member-init,
-  modernize-use-equals-default,
-  modernize-use-equals-delete,
-  modernize-use-override,
-  performance-*
+# Note: "performance-*" was listed here for years but never took effect in the
+# CI: as the last entry of a folded YAML scalar it carried a trailing newline,
+# which the clang-tidy 12 used by the CI did not strip from the glob. With a
+# current clang-tidy the family fires on about 200 sites, roughly half of them
+# performance-enum-size on the public C API enums (whose base type is part of
+# the ABI). Enable it deliberately, together with the code changes, not as a
+# side effect of a compiler upgrade.
+Checks: '-clang-analyzer-security.insecureAPI.strcat,-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,modernize-shrink-to-fit,modernize-use-default-member-init,modernize-use-equals-default,modernize-use-equals-delete,modernize-use-override'
 HeaderFilterRegex: .*
 WarningsAsErrors: '*'
 ...