docs: add guide on running clang-tidy on pull requests with GitHub Actions

[shenxianpeng]

Why

People search for "clang-tidy github actions" and "clang-tidy pull request comments", and for those queries platisd/clang-tidy-pr-comments and ZedThree/clang-tidy-review rank ahead of cpp-linter-action. The site has no page that answers that question from start to finish; the two existing posts assume the reader already has a lint workflow. This is the first of a few how-to posts written around what people actually search for.

What's in this PR

One new post in the Guides category: Run clang-tidy on pull requests with GitHub Actions (docs/blog/posts/2026-09-20-clang-tidy-pull-requests-github-actions.md), published at /blog/2026/09/20/clang-tidy-github-actions-pull-requests/ (explicit slug, plus a meta description).

It follows the places where people get stuck:

1. A small starter .clang-tidy (bugprone-*, performance-*, clang-analyzer-*, explicit HeaderFilterRegex).
2. Generating compile_commands.json with CMake, Meson, Make + Bear, or extra-args when there is no build system.
3. The full workflow, with a table explaining each input.
4. files-changed-only / lines-changed-only and what each value reports.
5. Where feedback appears (annotations, step summary, thread comment, review) and which token permission each needs, plus the review caveats.
6. Failing the check with the clang-tidy-checks-failed output, and rolling that out gradually.
7. Fork pull requests: what still works with a read-only token, and why not to switch to pull_request_target.
8. A troubleshooting table.

Two details worth a look from someone who knows the action well:

• The post says the default tidy-checks value is appended to the Checks in .clang-tidy, and recommends tidy-checks: ''. That is taken from the input description in action.yml.
• The post says clang-tidy 22 reports findings from all non-system headers by default, while 21 and earlier hide header findings unless HeaderFilterRegex matches. That is from the LLVM 22 release notes, and is the reason the starter config sets HeaderFilterRegex explicitly.

I left out the note about thread comments being disabled on private repositories, because I could not find the matching behaviour in the cpp-linter source.

Checks

• Inputs, outputs, permissions and review caveats were checked against action.yml at v2.22.0, docs/permissions.md and docs/pr-review-caveats.md; the hook arguments against the cpp-linter-hooks README.
• The starter .clang-tidy was run with clang-tidy 22.1.0 on a small demo project: --verify-config reports no errors, a finding in include/ is reported and the same finding in third_party/ is filtered out.
• mkdocs build --strict passes locally, and the repository's pre-commit hooks pass on the new file.
• The workflow in the post has not been run on GitHub as written. It has the same structure as the one in the migration post; the differences are that the push trigger and format-review are gone, clang-format is off (style: ''), step-summary is on, and the fail step uses clang-tidy-checks-failed.

[netlify]

✅ Deploy Preview for cpp-linter-github-io ready!

Name	Link
🔨 Latest commit	2d9df07
🔍 Latest deploy log	https://app.netlify.com/projects/cpp-linter-github-io/deploys/6aaefdd8aab4cf0008a3353c
😎 Deploy Preview	https://deploy-preview-62--cpp-linter-github-io.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.