feat: add Debian clang-tidy official evidence

[SSobol77]

Summary

Add verified official-source distro evidence for the existing Debian clang-tidy mapping.

This PR promotes exactly one additional existing mapping:

• artifact: deb
• source policy artifact: deb
• distro family: debian
• tool: clang-tidy
• package name: clang-tidy
• executable name: clang-tidy

After this PR, exactly three generated evidence records are verified-official-source:

• deb/yamllint
• deb/shellcheck
• deb/clang-tidy

No other mapping is promoted.

What changed

• Extended OFFICIAL_DISTRO_EVIDENCE_BY_POLICY with one new override:

  • ("deb", "clang-tidy")

• Generated evidence for deb/clang-tidy now uses:

  • evidence_source_type = official-distro-metadata
  • evidence_status = verified-official-source
  • official_source_kind = distro-package-index
  • verification_scope = package-name-and-executable
  • official_source_url = https://packages.debian.org/clang-tidy
  • evidence_record_id = official-distro-metadata:deb:clang-tidy
  • external_verification_required_for_new_mappings = false
  • release_blocking = false

Official Debian evidence basis

The evidence note references:

• Debian package metadata:
  • https://packages.debian.org/clang-tidy
• Debian versioned filelist metadata:
  • https://packages.debian.org/sid/i386/clang-tidy-19/filelist
• Debian manpage metadata:
  • https://manpages.debian.org/trixie/clang-tidy/clang-tidy.1.en.html

These sources are used only as evidence for the existing package/executable mapping. No versions are added as contract fields.

Promotion boundary

Existing official evidence is preserved:

• deb/yamllint
• deb/shellcheck

Docker helper mappings are intentionally not promoted:

• docker-deb-helper/yamllint remains repository-local-policy/current-policy-baseline
• docker-deb-helper/shellcheck remains repository-local-policy/current-policy-baseline
• docker-deb-helper/clang-tidy remains repository-local-policy/current-policy-baseline

All RPM/openSUSE/Arch/Slackware mappings remain unchanged.

Scope controls

This PR does not:

• add package names
• change OS_PACKAGE_NAMES
• change executable names
• add package versions as contract fields
• add checksums
• run package managers
• download anything
• vendor binaries or archives
• add generated artifacts
• weaken the Full-required baseline
• reclassify required tools as optional
• touch UI/provider/parser/TextMate/theme code

Verifier behavior

The existing promotion gate remains enforced.

Added/updated tests verify rejection of tampered deb/clang-tidy official evidence, including:

• official source URL drift
• official source kind drift
• verification scope drift
• verified package-name drift
• verified executable-name drift
• source type downgrade to repository-local-policy
• missing verification note
• evidence record ID downgrade to repository-local-policy:deb:clang-tidy

Validation

Passed locally / by agent report:

uv run ruff check src tests scripts
uv run ruff format --check src tests scripts
uv run python scripts/check_runtime_imports.py
uv run pytest -q tests/packaging/test_f4_linter_linux_provisioning.py
uv run pytest -q tests/packaging
uv run pytest -q tests/extensions/linters
uv run pytest -q tests/docs

Observed results:

tests/packaging/test_f4_linter_linux_provisioning.py: 92 passed
tests/packaging: 465 passed
tests/extensions/linters: 226 passed
tests/docs: 18 passed

Safety:

No new package names.
No OS_PACKAGE_NAMES changes.
No executable-name changes.
No package versions as contract fields.
No checksums.
No package-manager calls.
No downloads.
No generated artifacts.
No vendored binaries.
No UI/provider/parser/TextMate/theme changes.

Next work

A follow-up PR can promote the next single existing Debian mapping only after adding similarly explicit official-source evidence and verifier coverage.

Summary by CodeRabbit

• New Features

  • Added official distro evidence support for an additional Debian-backed linter tool, improving package/source verification coverage.
  • Expanded promotion and verification handling so more Debian tool mappings are recognized consistently.

• Bug Fixes

  • Improved validation of distro evidence details to better detect tampered or incomplete records.
  • Updated summary counts and status reporting to reflect the added verified evidence entry.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: bbd441e5-7b86-491f-bb4b-ae80febd723e

📥 Commits

Reviewing files that changed from the base of the PR and between add17e0 and 364b2f8.

📒 Files selected for processing (2)

• scripts/f4_linter_linux_provisioning.py
• tests/packaging/test_f4_linter_linux_provisioning.py

---

📝 Walkthrough

Walkthrough

Adds official Debian evidence metadata for clang-tidy and updates packaging tests for mapping, promotion, generated manifests, Docker helpers, summary counts, and verifier rejection behavior.

Changes

Debian clang-tidy evidence

Layer / File(s)	Summary
Official evidence contract scripts/f4_linter_linux_provisioning.py, tests/packaging/test_f4_linter_linux_provisioning.py	Adds Debian clang-tidy official evidence metadata and reusable assertions for approved mappings and evidence fields.
Promotion and generated evidence tests/packaging/test_f4_linter_linux_provisioning.py	Updates promotion counts and expectations, Docker helper assertions, generated manifest validation, and evidence summary checks for the additional verified-official-source record.
Verifier rejection coverage tests/packaging/test_f4_linter_linux_provisioning.py	Adds rejection cases for tampered or incomplete clang-tidy evidence and applies baseline rejection scenarios to cppcheck.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is clear, concise, and accurately summarizes the main change: adding official Debian clang-tidy evidence.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/f4-linux-deb-clang-tidy-official-evidence

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud