ci: promote clang-tidy diff gate to blocking, fold into ok (#73)

Author: CameronBrooks11

.github/workflows/ci.yml

@@ -18,6 +18,7 @@ jobs:
       pull-requests: read
     outputs:
       code: ${{ steps.filter.outputs.code }}
+      cpp: ${{ steps.cppfilter.outputs.cpp }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
@@ -28,6 +29,22 @@ jobs:
             code:
               - '**'
               - '!**/*.md'
+      # Separate OR-filter (default quantifier) for the C++ sources the clang-tidy
+      # gate lints, so it skips (and the ok gate stays green) on non-C++ PRs.
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+        id: cppfilter
+        with:
+          filters: |
+            cpp:
+              - '**/*.c'
+              - '**/*.cc'
+              - '**/*.cpp'
+              - '**/*.cxx'
+              - '**/*.h'
+              - '**/*.hh'
+              - '**/*.hpp'
+              - '**/*.hxx'
+              - '.clang-tidy'
 
   python-lint:
     name: Python Linting (ruff)
@@ -320,10 +337,27 @@ jobs:
       - name: Check formatting
         run: git ls-files '*.c' '*.cc' '*.cpp' '*.cxx' '*.h' '*.hh' '*.hpp' '*.hxx' | xargs clang-format --dry-run --Werror
 
+  clang-tidy:
+    name: Clang-Tidy (changed lines)
+    needs: [changes]
+    if: needs.changes.outputs.cpp == 'true'
+    permissions:
+      contents: read
+    uses: anolishq/.github/.github/workflows/clang-tidy-diff.yml@9869a5f4bee7da9c7c1dc9bae033cd0137c4801d # clang-tidy-diff
+    with:
+      # x64-linux (not the gate's x64-linux-static default) so we reuse the warm
+      # vcpkg cache the server-enabled CI lane writes — its closure (grpc+protobuf
+      # +json+yaml+gtest) is exactly ci-linux-tidy's. With the static default the
+      # configure step rebuilt grpc from source cold and hit the 30-min timeout.
+      triplet: x64-linux
+      configure-preset: ci-linux-tidy
+      apt-packages: graphviz
+      blocking: true
+
   ok:
     name: ok
     if: always()
-    needs: [changes, python-lint, python-typecheck, linux-matrix, strict-dimensional-validation, windows-core, windows-diagram, diagram-render-smoke, version-sync, cpp-format]
+    needs: [changes, python-lint, python-typecheck, linux-matrix, strict-dimensional-validation, windows-core, windows-diagram, diagram-render-smoke, version-sync, cpp-format, clang-tidy]
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps: