Update clang-tidy checks and CIs

.clang-tidy

@@ -2,32 +2,58 @@ Checks: >
     '-*,
      bugprone-*,
        -bugprone-branch-clone,
+       -bugprone-casting-through-void,
        -bugprone-easily-swappable-parameters,
        -bugprone-exception-escape,
        -bugprone-implicit-widening-of-multiplication-result,
+       -bugprone-multi-level-implicit-pointer-conversion,
+       -bugprone-pointer-arithmetic-on-polymorphic-object,
      clang-analyzer-*,
        -clang-analyzer-optin.mpi.MPI-Checker,
      clang-diagnostic-*,
+       -clang-diagnostic-deprecated-declarations,
      cppcoreguidelines-*,
+       -cppcoreguidelines-avoid-const-or-ref-data-members,
        -cppcoreguidelines-avoid-c-arrays,
        -cppcoreguidelines-avoid-goto,
+       -cppcoreguidelines-avoid-do-while,
        -cppcoreguidelines-avoid-magic-numbers,
        -cppcoreguidelines-avoid-non-const-global-variables,
        -cppcoreguidelines-init-variables,
        -cppcoreguidelines-interfaces-global-init,
+       -cppcoreguidelines-macro-to-enum,
        -cppcoreguidelines-macro-usage,
        -cppcoreguidelines-no-malloc,
        -cppcoreguidelines-non-private-member-variables-in-classes,
        -cppcoreguidelines-owning-memory,
        -cppcoreguidelines-pro-*,
+       -cppcoreguidelines-use-enum-class,
+     google-build-explicit-make-pair,
+     google-build-namespaces,
+     misc-*,
+       -misc-const-correctness,
+       -misc-include-cleaner,
+       -misc-non-private-member-variables-in-classes,
+       -misc-no-recursion,
+       -misc-use-anonymous-namespace,
+       -misc-use-internal-linkage,
      modernize-*,
        -modernize-avoid-c-arrays,
+       -modernize-loop-convert,
        -modernize-macro-to-enum,
        -modernize-return-braced-init-list,
+       -modernize-use-constraints,
+       -modernize-use-ranges,
        -modernize-use-trailing-return-type,
        -modernize-use-using,
      performance-*,
+       -performance-enum-size,
+     portability-*,
+       -portability-avoid-pragma-once,
+       -portability-template-virtual-member-function,
      readability-*,
+       -readability-avoid-nested-conditional-operator,
+       -readability-avoid-unconditional-preprocessor-if,
        -readability-braces-around-statements,
        -readability-container-data-pointer,
        -readability-else-after-return,
@@ -37,10 +63,29 @@ Checks: >
        -readability-implicit-bool-conversion,
        -readability-isolate-declaration,
        -readability-magic-numbers,
+       -readability-make-member-function-const,
+       -readability-math-missing-parentheses,
        -readability-named-parameter,
+       -readability-qualified-auto,
+       -readability-redundant-casting,
+       -readability-redundant-member-init,
+       -readability-static-accessed-through-instance,
        -readability-simplify-boolean-expr,
+       -readability-use-concise-preprocessor-directives,
+       -readability-use-std-min-max,
      mpi-*
     '
 
 # Files not ending with nolint.H will be filtered in.
 HeaderFilterRegex: '([^n].....|[^o]....|[^l]...|[^i]..|[^n].|[^t])\.H$'
+
+# Only available in clang-tidy >= 17
+HeaderFileExtensions: ['', "H", 'h', 'hh', 'hpp', 'hxx']
+
+# modernize-use-constraints is not a required check:
+# C++20 concepts/constraints have too many compiler-specific issues
+# (MSVC, NVHPC, CUDA-on-Windows, etc.) to be used in AMReX.
+
+# modernize-use-ranges is not a required check:
+# (1) Clang <= 15 has bugs with std::ranges.
+# (2) std::ranges::sort requires std::sortable, which is stricter than operator<.

.github/dependabot.yml

@@ -0,0 +1,9 @@
+# Dependabot configuration
+# ref: https://docs.github.com/en/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/configuration-options-for-dependency-updates
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    target-branch: "development"

.github/workflows/cleanup-cache-postpr.yml

@@ -16,11 +16,9 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Clean up ccache
         run: |
-          gh extension install actions/gh-actions-cache
-
           REPO=${{ github.repository }}
 
           # For debugging cat ${GITHUB_EVENT_PATH} to see the payload.
@@ -33,11 +31,12 @@ jobs:
           # Setting this to not fail the workflow while deleting cache keys.
           set +e
 
-          keys=$(gh actions-cache list -L 100 -R $REPO -B $BRANCH | cut -f 1)
-          # $keys might contain spaces. Thus we set IFS to \n.
-          IFS=$'\n'
-          for k in $keys
+          # Note that `gh cache delete` has no ref filter, so we delete by
+          # cache id, not by key.
+          ids=$(gh cache list -L 100 -R $REPO --ref $BRANCH --json id --jq '.[].id')
+          for i in $ids
           do
-            gh actions-cache delete "$k" -R $REPO -B $BRANCH --confirm
+            # `|| true` so that a failed deletion does not fail the step: the
+            # step's exit status is that of the last command run.
+            gh cache delete "$i" -R $REPO || true
           done
-          unset IFS

.github/workflows/cleanup-cache.yml

@@ -16,11 +16,9 @@ jobs:
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Clean up ccache
         run: |
-          gh extension install actions/gh-actions-cache
-
           REPO=${{ github.repository }}
 
           # push or pull_request or schedule or ...
@@ -50,18 +48,19 @@ jobs:
           # something like ccache-LinuxClang-
           keyprefix="ccache-${WORKFLOW_NAME}-"
 
-          cached_jobs=$(gh actions-cache list -L 100 -R $REPO -B $BRANCH --key "$keyprefix" | awk -F '-git-' '{print $1}' | sort | uniq)
+          cached_jobs=$(gh cache list -L 100 -R $REPO --ref $BRANCH --key "$keyprefix" --json key --jq '.[].key' | awk -F '-git-' '{print $1}' | sort | uniq)
 
           # cached_jobs is something like "ccache-LinuxClang-configure-1d ccache-LinuxClang-configure-2d".
           # It might also contain spaces. Thus we set IFS to \n.
           IFS=$'\n'
           for j in $cached_jobs
           do
-            # Delete all entries except the last used one
-            old_keys=$(gh actions-cache list -L 100 -R $REPO -B $BRANCH --key "${j}-git-" --sort last-used | cut -f 1 | tail -n +2)
-            for k in $old_keys
+            # Delete all entries except the last used one. Note that `gh cache
+            # delete` has no ref filter, so we delete by cache id, not by key.
+            old_ids=$(gh cache list -L 100 -R $REPO --ref $BRANCH --key "${j}-git-" --sort last_accessed_at --order desc --json id --jq '.[].id' | tail -n +2)
+            for i in $old_ids
             do
-              gh actions-cache delete "$k" -R $REPO -B $BRANCH --confirm
+              gh cache delete "$i" -R $REPO || true
             done
           done
           unset IFS

.github/workflows/codespell.yml

@@ -1,6 +1,10 @@
 name: codespell
 
-on: [push, pull_request]
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
 
 concurrency:
   group: ${{ github.ref }}-${{ github.head_ref }}-codespell
@@ -11,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install codespell
         run: |

.github/workflows/cuda.yml

@@ -3,6 +3,8 @@ name: CUDA
 
 on:
   push:
+    branches-ignore:
+      - 'dependabot/**'
   pull_request:
   schedule:
     - cron: "23 8 * * *"
@@ -18,16 +20,16 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout IAMR
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         path: IAMR
     - name: Checkout AMReX-Hydro
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         repository: AMReX-Fluids/AMReX-Hydro
         path: AMReX-Hydro
     - name: Checkout AMReX
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         repository: AMReX-Codes/amrex
         path: amrex
@@ -67,16 +69,16 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout IAMR
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         path: IAMR
     - name: Checkout AMReX-Hydro
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         repository: AMReX-Fluids/AMReX-Hydro
         path: AMReX-Hydro
     - name: Checkout AMReX
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7
       with:
         repository: AMReX-Codes/amrex
         path: amrex

.github/workflows/docs.yml

@@ -1,5 +1,9 @@
 name: Build and Deploy
-on: [push, pull_request]
+on:
+  push:
+    branches-ignore:
+      - 'dependabot/**'
+  pull_request:
 
 concurrency:
   group: ${{ github.head_ref }}-docs
@@ -10,7 +14,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Dependencies
         run: |