Add clang-tidy to pre-commit

.clang-tidy

@@ -0,0 +1,70 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Layout is clang-format's job (see .clang-format), so clang-tidy does no
+# formatting of its own (FormatStyle: none below). Each enabled check is meant
+# to be adoptable on its own, so findings can be fixed one check at a time.
+#
+# Checks are opt-in (-*) by group, minus the ones below. They cannot be
+# commented inline because Checks is a single YAML string.
+#
+# Disabled because they conflict with the C-style CUDA driver API idioms:
+#   bugprone-easily-swappable-parameters: wrappers of driver calls take many
+#       adjacent parameters of the same type; the signatures mirror the API.
+#   bugprone-assignment-in-if-condition: `if (CUDA_SUCCESS != (err = CALL(...)))`
+#       is the standard error-handling pattern here.
+#   performance-no-int-to-ptr: opaque handles and file descriptors are
+#       converted to pointers with reinterpret_cast on purpose.
+#   modernize-avoid-c-arrays: arrays are passed to and filled by C APIs.
+#   modernize-return-braced-init-list: `return {};` vs. an explicit type is
+#       left to the author; it adds noise for the driver-API result structs.
+#   bugprone-throwing-static-initialization: the handle registries are
+#       process-lifetime globals whose constructors allocate on some standard
+#       libraries (MSVC); running out of memory while loading the module is
+#       fatal either way.
+#
+# Disabled because they do not match the codebase style:
+#   performance-enum-size: enum underlying types are left as they are.
+#   misc-const-correctness: const on every local is not the convention here.
+#   readability-function-cognitive-complexity: too disruptive.
+#   readability-identifier-length: short names such as the handle parameter `h`
+#       are used throughout.
+#   readability-implicit-bool-conversion: `if (ptr)` and `if (handle)` are the
+#       idiom for pointers and handles.
+#   misc-include-cleaner: too noisy with the CUDA and CPython umbrella headers.
+#   misc-no-recursion: recursion is used deliberately.
+#   misc-use-anonymous-namespace: file-local functions use `static`.
+#   modernize-use-trailing-return-type: the code uses `Type\nname()` layout.
+Checks: >
+  -*,
+  bugprone-*,
+  -bugprone-easily-swappable-parameters,
+  -bugprone-assignment-in-if-condition,
+  -bugprone-throwing-static-initialization,
+  clang-analyzer-*,
+  misc-*,
+  -misc-include-cleaner,
+  -misc-const-correctness,
+  -misc-no-recursion,
+  -misc-use-anonymous-namespace,
+  modernize-*,
+  -modernize-use-trailing-return-type,
+  -modernize-avoid-c-arrays,
+  -modernize-return-braced-init-list,
+  performance-*,
+  -performance-enum-size,
+  -performance-no-int-to-ptr,
+  readability-*,
+  -readability-function-cognitive-complexity,
+  -readability-identifier-length,
+  -readability-implicit-bool-conversion
+FormatStyle: none
+CheckOptions:
+  # Records whose members are all public (the *Box and guard structs) are plain
+  # data holders; only a mix of public and private members is flagged.
+  misc-non-private-member-variables-in-classes.IgnoreClassesWithAllMemberVariablesBeingPublic: true
+WarningsAsErrors: '*'
+# Only report diagnostics for our own headers, not CUDA/CPython/libstdc++.
+HeaderFilterRegex: 'cuda_core/cuda/core/_(cpp|include)/'
+ExcludeHeaderFilterRegex: 'cuda_core/cuda/core/_include/(dlpack|aoti_shim)\.h'

.pre-commit-config.yaml

@@ -41,6 +41,14 @@ repos:
 
   - repo: local
     hooks:
+      # cuda.h and nvrtc.h come from pinned nvidia-cuda-* wheels, so no local CUDA Toolkit is needed.
+      - id: clang-tidy
+        name: clang-tidy
+        entry: python ./toolshed/run_clang_tidy.py --cuda-wheel
+        language: python
+        files: ^cuda_core/cuda/core/_cpp/.*\.cpp$
+        additional_dependencies: [clang-tidy==22.1.8, nvidia-cuda-runtime==13.4.92, nvidia-cuda-nvrtc==13.4.92]
+
       - id: check-precommit-installed
         name: Warn if the pre-commit git hook is not installed
         entry: python ./toolshed/check_precommit_installed.py

CONTRIBUTING.md

@@ -32,6 +32,7 @@ Thank you for your interest in contributing to CUDA Python! Based on the type of
     - [Review Guidance](#review-guidance)
     - [Pull Request Reviews](#pull-request-reviews)
   - [Pixi lockfiles](#pixi-lockfiles)
+  - [Secret Scanning](#secret-scanning)
   - [Signing Your Work](#signing-your-work)
   - [Code signing](#code-signing)
   - [Developer Certificate of Origin (DCO)](#developer-certificate-of-origin-dco)
@@ -247,6 +248,12 @@ hook environment, so no system-wide installation is required. Vendored code
 `.pre-commit-config.yaml`. To format in your editor, install the same version
 with `pip install clang-format==23.1.3`.
 
+`cuda_core`'s C++ sources are also checked with `clang-tidy`, configured by
+[`.clang-tidy`](.clang-tidy).  To apply automatic fixes, run the script directly
+with clang-tidy's `--fix` option (without `--cuda-wheel` it uses `CUDA_PATH` or
+`CUDA_HOME`) and then run clang-format on the result: `python
+toolshed/run_clang_tidy.py --fix <files>`.
+
 ## CodeRabbit
 
 This section explains how to use CodeRabbit for CUDA Python pull request review.

cuda_core/cuda/core/_cpp/rt/context.cpp

@@ -125,15 +125,15 @@ struct GreenCtxBox {
     CUgreenCtx resource;
 };
 
-static const ContextBox *
+const ContextBox *
 get_box(const ContextHandle &h) noexcept
 {
     const CUcontext *p = h.get();
     return reinterpret_cast<const ContextBox *>(reinterpret_cast<const char *>(p) - offsetof(ContextBox, resource));
 }
 
 // See REGISTRY_DESIGN.md (Level 1: Driver Handle -> Resource Handle)
-static HandleRegistry<CUcontext, ContextHandle> context_registry;
+HandleRegistry<CUcontext, ContextHandle> context_registry;
 
 // Create a context handle reference, with optional green context as source.
 ContextHandle

cuda_core/cuda/core/_cpp/rt/context_scope.hpp

@@ -126,7 +126,7 @@ cleanup_in_context(
     }
     std::invoke(std::forward<AfterCleanup>(after_cleanup));
     if (status != CUDA_SUCCESS || restore != CUDA_SUCCESS) {
-        char operation_name[160];
+        char operation_name[kOperationNameSize];
         format_operation(operation_name, sizeof(operation_name), name, handle);
         if (status != CUDA_SUCCESS) {
             report_cuda_error(operation_name, status, detail);

cuda_core/cuda/core/_cpp/rt/driver_api.cpp

@@ -9,7 +9,7 @@
 namespace cuda_core::rt {
 
 // The pointers. Null until ensure_fn_table() fills the table. See driver_api.hpp.
-#define CUDA_CORE_DEFINE_DRIVER_FN(name, introduced) decltype(&name) p_##name = nullptr;
+#define CUDA_CORE_DEFINE_DRIVER_FN(name, introduced) decltype(&(name)) p_##name = nullptr;
 CUDA_CORE_DRIVER_FUNCTIONS(CUDA_CORE_DEFINE_DRIVER_FN)
 #undef CUDA_CORE_DEFINE_DRIVER_FN
 

cuda_core/cuda/core/_cpp/rt/driver_api.hpp

@@ -141,7 +141,7 @@ namespace cuda_core::rt {
     X(cuStreamIsCapturing, 10000)                                               \
     X(cuThreadExchangeStreamCaptureMode, 10010)
 
-#define CUDA_CORE_DECLARE_DRIVER_FN(name, introduced) extern decltype(&name) p_##name;
+#define CUDA_CORE_DECLARE_DRIVER_FN(name, introduced) extern decltype(&(name)) p_##name;
 CUDA_CORE_DRIVER_FUNCTIONS(CUDA_CORE_DECLARE_DRIVER_FN)
 #undef CUDA_CORE_DECLARE_DRIVER_FN
 
@@ -229,7 +229,7 @@ struct Unavailable;
 template <class R, class... A>
 struct Unavailable<R (*)(A...)> {
     static R
-    call(A...) noexcept
+    call(A... /*unused*/) noexcept
     {
         return UnavailableStatus<R>::value;
     }

cuda_core/cuda/core/_cpp/rt/error.cpp

@@ -27,8 +27,8 @@ namespace {
 // Thread-local detail attached to the next raised CUDAError with a matching
 // status (see take_last_error_detail()). Written only by propagating helpers.
 // The taken copy stays valid until the next take on the same thread.
-thread_local char last_error_detail[512] = {0};
-thread_local char taken_error_detail[512] = {0};
+thread_local char last_error_detail[kErrorMessageSize] = {0};
+thread_local char taken_error_detail[kErrorMessageSize] = {0};
 thread_local CUresult last_error_detail_status = CUDA_SUCCESS;
 }  // namespace
 
@@ -66,7 +66,7 @@ format_operation(char *buffer, size_t size, const char *operation, unsigned long
 void
 report_status_code(const char *operation, long code) noexcept
 {
-    char message[256];
+    char message[kErrorMessageSize];
     std::snprintf(message, sizeof(message), "%s failed (status %ld)", operation, code);
     report_message(message);
 }
@@ -80,7 +80,7 @@ report_cuda_error(const char *operation, CUresult status, const char *detail) no
     if (status == CUDA_SUCCESS || status == CUDA_ERROR_DEINITIALIZED) {
         return;
     }
-    char message[512];
+    char message[kErrorMessageSize];
     format_cuda_error(message, sizeof(message), operation, status, detail);
     report_message(message);
 }
@@ -122,7 +122,7 @@ note_context_not_restored(CUcontext previous, CUresult operation_status, CUresul
     if (DRIVER_CALL(cuCtxGetCurrent, &current) != CUDA_SUCCESS) {
         current = nullptr;
     }
-    char cause[128] = {0};
+    char cause[kErrorMessageSize] = {0};
     if (operation_status != CUDA_SUCCESS) {
         const char *error_name = nullptr;
         if (DRIVER_CALL(cuGetErrorName, restore_status, &error_name) == CUDA_SUCCESS) {

cuda_core/cuda/core/_cpp/rt/error.hpp

@@ -5,9 +5,17 @@
 #pragma once
 
 #include <cuda.h>
+#include <cstddef>
 
 namespace cuda_core::rt {
 
+// Sizes of the stack buffers that format error text. Messages are truncated by
+// snprintf, never overrun.
+constexpr std::size_t kOperationNameSize = 160;  // "<call> (handle 0x...)" from format_operation()
+constexpr std::size_t kErrorMessageSize = 512;   // a full error message or error detail
+// A message that embeds one error message after some fixed text.
+constexpr std::size_t kNestedMessageSize = kErrorMessageSize + (kErrorMessageSize / 2);
+
 // ============================================================================
 // Thread-local error handling
 // ============================================================================

cuda_core/cuda/core/_cpp/rt/graph.cpp

@@ -83,9 +83,10 @@ struct GraphBox : GraphBoxBase {
     GraphAttachmentMap attachments;       // Non-owning attachment index.
     HandleRegistry<CUgraphNode, GraphNodeHandle> node_handles;
 
+    // Not noexcept: the std::map and HandleRegistry members allocate.
     GraphBox(
         CUgraph resource_, GraphHierarchy *hierarchy_, GraphBox *parent_ = nullptr, CUgraphNode owner_node_ = nullptr
-    ) noexcept
+    )
         : GraphBoxBase{resource_}, hierarchy(hierarchy_), parent(parent_), owner_node(owner_node_)
     {
     }
@@ -106,7 +107,7 @@ struct GraphHierarchy {
 
 // See REGISTRY_DESIGN.md (Level 1: Driver Handle -> Resource Handle)
 using GraphRegistry = HandleRegistry<CUgraph, GraphHandle>;
-static GraphRegistry graph_registry;
+GraphRegistry graph_registry;
 
 // Immutable resource owners for one version of a graph node's parameters.
 // Inheriting DeferredCleanupItem lets CUDA's user-object destructor enqueue
@@ -140,7 +141,7 @@ free_deleter(const void *p) noexcept
 GraphBox *
 get_box(const GraphHandle &h) noexcept
 {
-    auto *value = reinterpret_cast<const GraphBoxBase *>(h.get());
+    const auto *value = reinterpret_cast<const GraphBoxBase *>(h.get());
     return const_cast<GraphBox *>(static_cast<const GraphBox *>(value));
 }
 
@@ -254,7 +255,7 @@ struct PreparedAttachmentState {
     explicit PreparedAttachmentState(GraphHandle h_graph_) : h_graph(std::move(h_graph_)) {}
 };
 
-void
+static void
 rollback_prepared_attachment(PreparedAttachmentState *state) noexcept
 {
     if (!state) {
@@ -290,6 +291,25 @@ struct PreparedChildGraphUpdateState {
     }
 };
 
+// Deleter of the shared hierarchy: it owns the root CUgraph once the root box
+// exists.
+static void
+release_graph_hierarchy(GraphHierarchy *hierarchy)
+{
+    for (const GraphBox &box : hierarchy->graphs) {
+        if (box.resource) {
+            graph_registry.unregister_handle(box.resource);
+        }
+    }
+    GraphBox *root = hierarchy->root();
+    if (root && root->resource) {
+        GILReleaseGuard gil;
+        pw_cuGraphDestroy(root->resource);
+    }
+    retry_deferred_cleanup();
+    delete hierarchy;
+}
+
 GraphHandle
 create_graph_handle(CUgraph graph)
 {
@@ -298,28 +318,21 @@ create_graph_handle(CUgraph graph)
         return {};
     }
 
-    // clang-format off
-    auto hierarchy = std::shared_ptr<GraphHierarchy>(
-        new GraphHierarchy{},
-        [](GraphHierarchy *hierarchy) {
-            for (const GraphBox& box : hierarchy->graphs) {
-                if (box.resource) {
-                    graph_registry.unregister_handle(box.resource);
-                }
-            }
-            GraphBox *root = hierarchy->root();
-            if (root && root->resource) {
-                GILReleaseGuard gil;
-                pw_cuGraphDestroy(root->resource);
-            }
-            retry_deferred_cleanup();
-            delete hierarchy;
-        }
-    );
-    // clang-format on
-    GraphBox &root = hierarchy->graphs.emplace_back(graph, hierarchy.get());
+    // Until the root box exists the hierarchy deleter has nothing to destroy,
+    // so an allocation failure before then must release the graph here.
+    std::shared_ptr<GraphHierarchy> hierarchy;
+    GraphBox *root = nullptr;
+    try {
+        hierarchy = std::shared_ptr<GraphHierarchy>(new GraphHierarchy{}, release_graph_hierarchy);
+        root = &hierarchy->graphs.emplace_back(graph, hierarchy.get());
+    }
+    catch (...) {
+        GILReleaseGuard gil;
+        pw_cuGraphDestroy(graph);
+        throw;
+    }
 
-    GraphHandle h_graph(hierarchy, &root.resource);
+    GraphHandle h_graph(hierarchy, &root->resource);
     graph_registry.register_handle(graph, h_graph);
     return h_graph;
 }
@@ -389,7 +402,7 @@ graph_prepare_child_graph_update(
     return CUDA_SUCCESS;
 }
 
-void
+static void
 publish_child_graph_update(PreparedChildGraphUpdateState &state, GraphHandle *out_child)
 {
     GraphBox *parent = get_box(state.h_parent);

cuda_core/cuda/core/_cpp/rt/graph_exec.cpp

@@ -92,7 +92,7 @@ struct ExecAttachmentStaging {
         if (!h_source || !accumulator) {
             return CUDA_SUCCESS;
         }
-        const CUuserObject object = accumulator->object;
+        CUuserObject object = accumulator->object;
         const GraphHandle source = std::move(h_source);
         accumulator = nullptr;
         GILReleaseGuard gil;
@@ -154,7 +154,7 @@ struct PreparedExecAttachmentState {
     }
 };
 
-void
+static void
 rollback_prepared_exec_attachment(PreparedExecAttachmentState *state) noexcept
 {
     if (!state) {