Fix clang-tidy errors

BUILD

@@ -1833,12 +1833,12 @@ grpc_cc_library(
     name = "grpc_mock_cel",
     hdrs = [
         "src/core/lib/security/authorization/mock_cel/activation.h",
-        "src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h",
-        "src/core/lib/security/authorization/mock_cel/cel_expression.h",
+        #"src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h",
+        #"src/core/lib/security/authorization/mock_cel/cel_expression.h",
         "src/core/lib/security/authorization/mock_cel/cel_value.h",
-        "src/core/lib/security/authorization/mock_cel/evaluator_core.h",
-        "src/core/lib/security/authorization/mock_cel/flat_expr_builder.h",
-        "src/core/lib/security/authorization/mock_cel/statusor.h",
+        #"src/core/lib/security/authorization/mock_cel/evaluator_core.h",
+        #"src/core/lib/security/authorization/mock_cel/flat_expr_builder.h",
+        #"src/core/lib/security/authorization/mock_cel/statusor.h",
     ],
     language = "c++",
     deps = [

BUILD.gn

@@ -820,12 +820,7 @@ config("grpc_config") {
         "src/core/lib/security/authorization/evaluate_args.cc",
         "src/core/lib/security/authorization/evaluate_args.h",
         "src/core/lib/security/authorization/mock_cel/activation.h",
-        "src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h",
-        "src/core/lib/security/authorization/mock_cel/cel_expression.h",
         "src/core/lib/security/authorization/mock_cel/cel_value.h",
-        "src/core/lib/security/authorization/mock_cel/evaluator_core.h",
-        "src/core/lib/security/authorization/mock_cel/flat_expr_builder.h",
-        "src/core/lib/security/authorization/mock_cel/statusor.h",
         "src/core/lib/security/certificate_provider.h",
         "src/core/lib/security/context/security_context.cc",
         "src/core/lib/security/context/security_context.h",

build_autogenerated.yaml

@@ -670,12 +670,7 @@ libs:
   - src/core/lib/security/authorization/authorization_engine.h
   - src/core/lib/security/authorization/evaluate_args.h
   - src/core/lib/security/authorization/mock_cel/activation.h
-  - src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h
-  - src/core/lib/security/authorization/mock_cel/cel_expression.h
   - src/core/lib/security/authorization/mock_cel/cel_value.h
-  - src/core/lib/security/authorization/mock_cel/evaluator_core.h
-  - src/core/lib/security/authorization/mock_cel/flat_expr_builder.h
-  - src/core/lib/security/authorization/mock_cel/statusor.h
   - src/core/lib/security/certificate_provider.h
   - src/core/lib/security/context/security_context.h
   - src/core/lib/security/credentials/alts/alts_credentials.h

gRPC-C++.podspec

@@ -517,12 +517,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/authorization/authorization_engine.h',
                       'src/core/lib/security/authorization/evaluate_args.h',
                       'src/core/lib/security/authorization/mock_cel/activation.h',
-                      'src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h',
-                      'src/core/lib/security/authorization/mock_cel/cel_expression.h',
                       'src/core/lib/security/authorization/mock_cel/cel_value.h',
-                      'src/core/lib/security/authorization/mock_cel/evaluator_core.h',
-                      'src/core/lib/security/authorization/mock_cel/flat_expr_builder.h',
-                      'src/core/lib/security/authorization/mock_cel/statusor.h',
                       'src/core/lib/security/certificate_provider.h',
                       'src/core/lib/security/context/security_context.h',
                       'src/core/lib/security/credentials/alts/alts_credentials.h',
@@ -1037,12 +1032,7 @@ Pod::Spec.new do |s|
                               'src/core/lib/security/authorization/authorization_engine.h',
                               'src/core/lib/security/authorization/evaluate_args.h',
                               'src/core/lib/security/authorization/mock_cel/activation.h',
-                              'src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h',
-                              'src/core/lib/security/authorization/mock_cel/cel_expression.h',
                               'src/core/lib/security/authorization/mock_cel/cel_value.h',
-                              'src/core/lib/security/authorization/mock_cel/evaluator_core.h',
-                              'src/core/lib/security/authorization/mock_cel/flat_expr_builder.h',
-                              'src/core/lib/security/authorization/mock_cel/statusor.h',
                               'src/core/lib/security/certificate_provider.h',
                               'src/core/lib/security/context/security_context.h',
                               'src/core/lib/security/credentials/alts/alts_credentials.h',

gRPC-Core.podspec

@@ -875,12 +875,7 @@ Pod::Spec.new do |s|
                       'src/core/lib/security/authorization/evaluate_args.cc',
                       'src/core/lib/security/authorization/evaluate_args.h',
                       'src/core/lib/security/authorization/mock_cel/activation.h',
-                      'src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h',
-                      'src/core/lib/security/authorization/mock_cel/cel_expression.h',
                       'src/core/lib/security/authorization/mock_cel/cel_value.h',
-                      'src/core/lib/security/authorization/mock_cel/evaluator_core.h',
-                      'src/core/lib/security/authorization/mock_cel/flat_expr_builder.h',
-                      'src/core/lib/security/authorization/mock_cel/statusor.h',
                       'src/core/lib/security/certificate_provider.h',
                       'src/core/lib/security/context/security_context.cc',
                       'src/core/lib/security/context/security_context.h',
@@ -1480,12 +1475,7 @@ Pod::Spec.new do |s|
                               'src/core/lib/security/authorization/authorization_engine.h',
                               'src/core/lib/security/authorization/evaluate_args.h',
                               'src/core/lib/security/authorization/mock_cel/activation.h',
-                              'src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h',
-                              'src/core/lib/security/authorization/mock_cel/cel_expression.h',
                               'src/core/lib/security/authorization/mock_cel/cel_value.h',
-                              'src/core/lib/security/authorization/mock_cel/evaluator_core.h',
-                              'src/core/lib/security/authorization/mock_cel/flat_expr_builder.h',
-                              'src/core/lib/security/authorization/mock_cel/statusor.h',
                               'src/core/lib/security/certificate_provider.h',
                               'src/core/lib/security/context/security_context.h',
                               'src/core/lib/security/credentials/alts/alts_credentials.h',

grpc.gemspec

@@ -793,12 +793,7 @@ Gem::Specification.new do |s|
   s.files += %w( src/core/lib/security/authorization/evaluate_args.cc )
   s.files += %w( src/core/lib/security/authorization/evaluate_args.h )
   s.files += %w( src/core/lib/security/authorization/mock_cel/activation.h )
-  s.files += %w( src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h )
-  s.files += %w( src/core/lib/security/authorization/mock_cel/cel_expression.h )
   s.files += %w( src/core/lib/security/authorization/mock_cel/cel_value.h )
-  s.files += %w( src/core/lib/security/authorization/mock_cel/evaluator_core.h )
-  s.files += %w( src/core/lib/security/authorization/mock_cel/flat_expr_builder.h )
-  s.files += %w( src/core/lib/security/authorization/mock_cel/statusor.h )
   s.files += %w( src/core/lib/security/certificate_provider.h )
   s.files += %w( src/core/lib/security/context/security_context.cc )
   s.files += %w( src/core/lib/security/context/security_context.h )

package.xml

@@ -773,12 +773,7 @@
     <file baseinstalldir="/" name="src/core/lib/security/authorization/evaluate_args.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/authorization/evaluate_args.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/activation.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/cel_expression.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/cel_value.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/evaluator_core.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/flat_expr_builder.h" role="src" />
-    <file baseinstalldir="/" name="src/core/lib/security/authorization/mock_cel/statusor.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/certificate_provider.h" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/context/security_context.cc" role="src" />
     <file baseinstalldir="/" name="src/core/lib/security/context/security_context.h" role="src" />

src/core/ext/filters/client_channel/config_selector.h

@@ -24,8 +24,7 @@
 
 #include "absl/strings/string_view.h"
 
-#include <grpc/impl/codegen/grpc_types.h>
-#include <grpc/impl/codegen/slice.h>
+#include <grpc/grpc.h>
 
 #include "src/core/ext/filters/client_channel/service_config.h"
 #include "src/core/ext/filters/client_channel/service_config_parser.h"

src/core/ext/filters/client_channel/lb_policy/subchannel_list.h

@@ -364,7 +364,7 @@ SubchannelList<SubchannelListType, SubchannelDataType>::SubchannelList(
   }
   subchannels_.reserve(addresses.size());
   // Create a subchannel for each address.
-  for (ServerAddress& address : addresses) {
+  for (ServerAddress address : addresses) {
     RefCountedPtr<SubchannelInterface> subchannel =
         helper->CreateSubchannel(address, args);
     if (subchannel == nullptr) {

src/core/ext/filters/client_channel/subchannel_interface.h

@@ -25,6 +25,7 @@
 #include <grpc/impl/codegen/grpc_types.h>
 
 #include "src/core/lib/gprpp/ref_counted.h"
+#include "src/core/lib/iomgr/pollset_set.h"
 
 namespace grpc_core {
 

src/core/ext/filters/http/client/http_client_filter.cc

@@ -43,7 +43,7 @@
 #include "src/core/lib/transport/transport_impl.h"
 
 #define EXPECTED_CONTENT_TYPE "application/grpc"
-#define EXPECTED_CONTENT_TYPE_LENGTH sizeof(EXPECTED_CONTENT_TYPE) - 1
+#define EXPECTED_CONTENT_TYPE_LENGTH (sizeof(EXPECTED_CONTENT_TYPE) - 1)
 
 /* default maximum size of payload eligible for GET request */
 static constexpr size_t kMaxPayloadSizeForGet = 2048;

src/core/ext/filters/http/server/http_server_filter.cc

@@ -33,7 +33,7 @@
 #include "src/core/lib/transport/static_metadata.h"
 
 #define EXPECTED_CONTENT_TYPE "application/grpc"
-#define EXPECTED_CONTENT_TYPE_LENGTH sizeof(EXPECTED_CONTENT_TYPE) - 1
+#define EXPECTED_CONTENT_TYPE_LENGTH (sizeof(EXPECTED_CONTENT_TYPE) - 1)
 
 static void hs_recv_initial_metadata_ready(void* user_data, grpc_error* err);
 static void hs_recv_trailing_metadata_ready(void* user_data, grpc_error* err);

src/core/ext/transport/chttp2/transport/bin_decoder.cc

@@ -66,16 +66,16 @@ static bool input_is_valid(const uint8_t* input_ptr, size_t length) {
   return true;
 }
 
-#define COMPOSE_OUTPUT_BYTE_0(input_ptr)        \
-  (uint8_t)((decode_table[input_ptr[0]] << 2) | \
-            (decode_table[input_ptr[1]] >> 4))
+#define COMPOSE_OUTPUT_BYTE_0(input_ptr)          \
+  (uint8_t)((decode_table[(input_ptr)[0]] << 2) | \
+            (decode_table[(input_ptr)[1]] >> 4))
 
-#define COMPOSE_OUTPUT_BYTE_1(input_ptr)        \
-  (uint8_t)((decode_table[input_ptr[1]] << 4) | \
-            (decode_table[input_ptr[2]] >> 2))
+#define COMPOSE_OUTPUT_BYTE_1(input_ptr)          \
+  (uint8_t)((decode_table[(input_ptr)[1]] << 4) | \
+            (decode_table[(input_ptr)[2]] >> 2))
 
 #define COMPOSE_OUTPUT_BYTE_2(input_ptr) \
-  (uint8_t)((decode_table[input_ptr[2]] << 6) | decode_table[input_ptr[3]])
+  (uint8_t)((decode_table[(input_ptr)[2]] << 6) | decode_table[(input_ptr)[3]])
 
 // By RFC 4648, if the length of the encoded string without padding is 4n+r,
 // the length of decoded string is: 1) 3n if r = 0, 2) 3n + 1 if r = 2, 3, or

src/core/ext/transport/chttp2/transport/parsing.cc

@@ -98,6 +98,7 @@ grpc_error* grpc_chttp2_perform_read(grpc_chttp2_transport* t,
                   .c_str());
         }
         ++cur;
+        // NOLINTNEXTLINE(bugprone-misplaced-widening-cast)
         t->deframe_state = static_cast<grpc_chttp2_deframe_transport_state>(
             1 + static_cast<int>(t->deframe_state));
       }

src/core/ext/xds/certificate_provider_store.h

@@ -23,6 +23,8 @@
 
 #include <map>
 
+#include "absl/strings/string_view.h"
+
 #include "src/core/lib/gprpp/ref_counted_ptr.h"
 #include "src/core/lib/gprpp/sync.h"
 #include "src/core/lib/security/certificate_provider.h"

src/core/ext/xds/xds_bootstrap.h

@@ -26,7 +26,7 @@
 
 #include "absl/container/inlined_vector.h"
 
-#include <grpc/impl/codegen/slice.h>
+#include <grpc/slice.h>
 
 #include "src/core/lib/gprpp/map.h"
 #include "src/core/lib/gprpp/memory.h"

src/core/lib/channel/channelz.h

@@ -55,7 +55,7 @@
  * events per channel trace node. If
  * GRPC_ARG_MAX_CHANNEL_TRACE_EVENT_MEMORY_PER_NODE is set, it will override
  * this default value. */
-#define GRPC_MAX_CHANNEL_TRACE_EVENT_MEMORY_PER_NODE_DEFAULT 1024 * 4
+#define GRPC_MAX_CHANNEL_TRACE_EVENT_MEMORY_PER_NODE_DEFAULT (1024 * 4)
 
 namespace grpc_core {
 

src/core/lib/compression/compression_internal.h

@@ -21,7 +21,8 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <grpc/impl/codegen/compression_types.h>
+#include <grpc/compression.h>
+#include <grpc/slice.h>
 
 #include "src/core/lib/gpr/useful.h"
 

src/core/lib/debug/stats_data.cc

@@ -280,6 +280,7 @@ const char* grpc_stats_histogram_doc[GRPC_STATS_HISTOGRAM_COUNT] = {
     "Number of streams whose payload was written per TCP write",
     "Number of streams terminated per TCP write",
     "Number of flow control updates written per TCP write",
+    // NOLINTNEXTLINE(bugprone-suspicious-missing-comma)
     "How many completion queues were checked looking for a CQ that had "
     "requested the incoming call",
 };

src/core/lib/gpr/murmur_hash.cc

@@ -22,7 +22,7 @@
 
 #include <string.h>
 
-#define ROTL32(x, r) ((x) << (r)) | ((x) >> (32 - (r)))
+#define ROTL32(x, r) (((x) << (r)) | ((x) >> (32 - (r))))
 
 #define FMIX32(h)    \
   (h) ^= (h) >> 16;  \

src/core/lib/gpr/time_precise.cc

@@ -148,8 +148,9 @@ gpr_cycle_counter gpr_get_cycle_counter() {
 
 gpr_timespec gpr_cycle_counter_to_time(gpr_cycle_counter cycles) {
   gpr_timespec ts;
-  ts.tv_sec = cycles / GPR_US_PER_SEC;
-  ts.tv_nsec = (cycles - ts.tv_sec * GPR_US_PER_SEC) * GPR_NS_PER_US;
+  ts.tv_sec = static_cast<int64_t>(cycles / GPR_US_PER_SEC);
+  ts.tv_nsec = static_cast<int64_t>((cycles - ts.tv_sec * GPR_US_PER_SEC) *
+                                    GPR_NS_PER_US);
   ts.clock_type = GPR_CLOCK_PRECISE;
   return ts;
 }

src/core/lib/gpr/tls_msvc.h

@@ -24,6 +24,8 @@
 
    #include tls.h to use this - and see that file for documentation */
 
+#include <cstdint>
+
 struct gpr_msvc_thread_local {
   intptr_t value;
 };

src/core/lib/gpr/useful.h

@@ -33,8 +33,8 @@
 #define GPR_SWAP(type, a, b) \
   do {                       \
     type x = a;              \
-    a = b;                   \
-    b = x;                   \
+    (a) = b;                 \
+    (b) = x;                 \
   } while (0)
 
 /** Set the \a n-th bit of \a i (a mutable pointer). */
@@ -59,7 +59,8 @@
 
 #define GPR_ICMP(a, b) ((a) < (b) ? -1 : ((a) > (b) ? 1 : 0))
 
-#define GPR_HASH_POINTER(x, range) \
-  ((((size_t)x) >> 4) ^ (((size_t)x) >> 9) ^ (((size_t)x) >> 14)) % (range)
+#define GPR_HASH_POINTER(x, range)                                         \
+  (((((size_t)(x)) >> 4) ^ (((size_t)(x)) >> 9) ^ (((size_t)(x)) >> 14)) % \
+   (range))
 
 #endif /* GRPC_CORE_LIB_GPR_USEFUL_H */

src/core/lib/gprpp/fork.cc

@@ -54,7 +54,7 @@ namespace internal {
 // When blocked, the exec_ctx_count is 0-indexed.  Note that ExecCtx
 // creation can only be blocked if there is exactly 1 outstanding ExecCtx,
 // meaning that BLOCKED and UNBLOCKED counts partition the integers
-#define UNBLOCKED(n) (n + 2)
+#define UNBLOCKED(n) ((n) + 2)
 #define BLOCKED(n) (n)
 
 class ExecCtxState {

src/core/lib/gprpp/manual_constructor.h

@@ -145,7 +145,7 @@ class PolymorphicManualConstructor {
   }
   template <class DerivedType>
   void Init(DerivedType&& x) {
-    FinishInit(new (&space_) DerivedType(std::move(x)));
+    FinishInit(new (&space_) DerivedType(std::forward<DerivedType>(x)));
   }
 
   void Destroy() { get()->~BaseType(); }

src/core/lib/gprpp/ref_counted_ptr.h

@@ -44,24 +44,24 @@ class RefCountedPtr {
   }
 
   // Move ctors.
-  RefCountedPtr(RefCountedPtr&& other) {
+  RefCountedPtr(RefCountedPtr&& other) noexcept {
     value_ = other.value_;
     other.value_ = nullptr;
   }
   template <typename Y>
-  RefCountedPtr(RefCountedPtr<Y>&& other) {
+  RefCountedPtr(RefCountedPtr<Y>&& other) noexcept {
     value_ = static_cast<T*>(other.value_);
     other.value_ = nullptr;
   }
 
   // Move assignment.
-  RefCountedPtr& operator=(RefCountedPtr&& other) {
+  RefCountedPtr& operator=(RefCountedPtr&& other) noexcept {
     reset(other.value_);
     other.value_ = nullptr;
     return *this;
   }
   template <typename Y>
-  RefCountedPtr& operator=(RefCountedPtr<Y>&& other) {
+  RefCountedPtr& operator=(RefCountedPtr<Y>&& other) noexcept {
     reset(other.value_);
     other.value_ = nullptr;
     return *this;
@@ -192,24 +192,24 @@ class WeakRefCountedPtr {
   }
 
   // Move ctors.
-  WeakRefCountedPtr(WeakRefCountedPtr&& other) {
+  WeakRefCountedPtr(WeakRefCountedPtr&& other) noexcept {
     value_ = other.value_;
     other.value_ = nullptr;
   }
   template <typename Y>
-  WeakRefCountedPtr(WeakRefCountedPtr<Y>&& other) {
+  WeakRefCountedPtr(WeakRefCountedPtr<Y>&& other) noexcept {
     value_ = static_cast<T*>(other.value_);
     other.value_ = nullptr;
   }
 
   // Move assignment.
-  WeakRefCountedPtr& operator=(WeakRefCountedPtr&& other) {
+  WeakRefCountedPtr& operator=(WeakRefCountedPtr&& other) noexcept {
     reset(other.value_);
     other.value_ = nullptr;
     return *this;
   }
   template <typename Y>
-  WeakRefCountedPtr& operator=(WeakRefCountedPtr<Y>&& other) {
+  WeakRefCountedPtr& operator=(WeakRefCountedPtr<Y>&& other) noexcept {
     reset(other.value_);
     other.value_ = nullptr;
     return *this;

src/core/lib/gprpp/thd.h

@@ -91,7 +91,7 @@ class Thread {
 
   /// Move constructor for thread. After this is called, the other thread
   /// no longer represents a living thread object
-  Thread(Thread&& other)
+  Thread(Thread&& other) noexcept
       : state_(other.state_), impl_(other.impl_), options_(other.options_) {
     other.state_ = MOVED;
     other.impl_ = nullptr;
@@ -101,7 +101,7 @@ class Thread {
   /// Move assignment operator for thread. After this is called, the other
   /// thread no longer represents a living thread object. Not allowed if this
   /// thread actually exists
-  Thread& operator=(Thread&& other) {
+  Thread& operator=(Thread&& other) noexcept {
     if (this != &other) {
       // TODO(vjpai): if we can be sure that all Thread's are actually
       // constructed, then we should assert GPR_ASSERT(impl_ == nullptr) here.

src/core/lib/iomgr/error.cc

@@ -292,7 +292,7 @@ static void internal_add_error(grpc_error** err, grpc_error* new_err) {
   memcpy((*err)->arena + slot, &new_last, sizeof(grpc_linked_error));
 }
 
-#define SLOTS_PER_INT (sizeof(intptr_t) / sizeof(intptr_t))
+#define SLOTS_PER_INT (1)  // == (sizeof(intptr_t) / sizeof(intptr_t))
 #define SLOTS_PER_STR (sizeof(grpc_slice) / sizeof(intptr_t))
 #define SLOTS_PER_TIME (sizeof(gpr_timespec) / sizeof(intptr_t))
 #define SLOTS_PER_LINKED_ERROR (sizeof(grpc_linked_error) / sizeof(intptr_t))
@@ -424,6 +424,7 @@ static grpc_error* copy_error_and_unref(grpc_error* in) {
     }
 #endif
     // bulk memcpy of the rest of the struct.
+    // NOLINTNEXTLINE(bugprone-sizeof-expression)
     size_t skip = sizeof(&out->atomics);
     memcpy((void*)((uintptr_t)out + skip), (void*)((uintptr_t)in + skip),
            sizeof(*in) + (in->arena_size * sizeof(intptr_t)) - skip);

src/core/lib/iomgr/tcp_posix.cc

@@ -1689,7 +1689,7 @@ static const grpc_endpoint_vtable vtable = {tcp_read,
                                             tcp_get_fd,
                                             tcp_can_track_err};
 
-#define MAX_CHUNK_SIZE 32 * 1024 * 1024
+#define MAX_CHUNK_SIZE (32 * 1024 * 1024)
 
 grpc_endpoint* grpc_tcp_create(grpc_fd* em_fd,
                                const grpc_channel_args* channel_args,

src/core/lib/json/json.h

@@ -68,8 +68,8 @@ class Json {
   }
 
   // Moveable.
-  Json(Json&& other) { MoveFrom(std::move(other)); }
-  Json& operator=(Json&& other) {
+  Json(Json&& other) noexcept { MoveFrom(std::move(other)); }
+  Json& operator=(Json&& other) noexcept {
     MoveFrom(std::move(other));
     return *this;
   }

src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h

@@ -19,6 +19,8 @@
 
 #include <memory>
 
+#include "absl/memory/memory.h"
+
 #include "src/core/lib/security/authorization/mock_cel/flat_expr_builder.h"
 
 namespace grpc_core {

src/core/lib/security/authorization/mock_cel/cel_value.h

@@ -32,7 +32,11 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <memory>
+
+#include "absl/memory/memory.h"
 #include "absl/strings/string_view.h"
+#include "absl/types/span.h"
 
 namespace grpc_core {
 namespace mock_cel {

src/core/lib/security/credentials/credentials.cc

@@ -74,7 +74,7 @@ grpc_arg grpc_channel_credentials_to_arg(
 
 grpc_channel_credentials* grpc_channel_credentials_from_arg(
     const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS)) return nullptr;
+  if (strcmp(arg->key, GRPC_ARG_CHANNEL_CREDENTIALS) != 0) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_ARG_CHANNEL_CREDENTIALS);

src/core/lib/security/credentials/jwt/json_token.cc

@@ -64,7 +64,7 @@ static grpc_jwt_encode_and_sign_override g_jwt_encode_and_sign_override =
 
 int grpc_auth_json_key_is_valid(const grpc_auth_json_key* json_key) {
   return (json_key != nullptr) &&
-         strcmp(json_key->type, GRPC_AUTH_JSON_TYPE_INVALID);
+         strcmp(json_key->type, GRPC_AUTH_JSON_TYPE_INVALID) != 0;
 }
 
 grpc_auth_json_key grpc_auth_json_key_create_from_json(const Json& json) {
@@ -84,7 +84,7 @@ grpc_auth_json_key grpc_auth_json_key_create_from_json(const Json& json) {
   prop_value = grpc_json_get_string_property(json, "type", &error);
   GRPC_LOG_IF_ERROR("JSON key parsing", error);
   if (prop_value == nullptr ||
-      strcmp(prop_value, GRPC_AUTH_JSON_TYPE_SERVICE_ACCOUNT)) {
+      strcmp(prop_value, GRPC_AUTH_JSON_TYPE_SERVICE_ACCOUNT) != 0) {
     goto end;
   }
   result.type = GRPC_AUTH_JSON_TYPE_SERVICE_ACCOUNT;

src/core/lib/security/credentials/jwt/jwt_credentials.h

@@ -50,9 +50,10 @@ class grpc_service_account_jwt_access_credentials
   const grpc_auth_json_key& key() const { return key_; }
 
   std::string debug_string() override {
-    return absl::StrFormat("JWTAccessCredentials{ExpirationTime:%s}",
-                           absl::FormatTime(absl::FromUnixMicros(
-                               gpr_timespec_to_micros(jwt_lifetime_))));
+    return absl::StrFormat(
+        "JWTAccessCredentials{ExpirationTime:%s}",
+        absl::FormatTime(absl::FromUnixMicros(
+            static_cast<int64_t>(gpr_timespec_to_micros(jwt_lifetime_)))));
   };
 
  private:

src/core/lib/security/credentials/jwt/jwt_verifier.cc

@@ -149,7 +149,8 @@ static jose_header* jose_header_from_json(Json json) {
      https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
    */
   alg_value = it->second.string_value().c_str();
-  if (it->second.type() != Json::Type::STRING || strncmp(alg_value, "RS", 2) ||
+  if (it->second.type() != Json::Type::STRING ||
+      strncmp(alg_value, "RS", 2) != 0 ||
       evp_md_from_alg(alg_value) == nullptr) {
     gpr_log(GPR_ERROR, "Invalid alg field");
     goto error;

src/core/lib/security/credentials/oauth2/oauth2_credentials.cc

@@ -53,7 +53,7 @@ using grpc_core::Json;
 int grpc_auth_refresh_token_is_valid(
     const grpc_auth_refresh_token* refresh_token) {
   return (refresh_token != nullptr) &&
-         strcmp(refresh_token->type, GRPC_AUTH_JSON_TYPE_INVALID);
+         strcmp(refresh_token->type, GRPC_AUTH_JSON_TYPE_INVALID) != 0;
 }
 
 grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
@@ -73,7 +73,7 @@ grpc_auth_refresh_token grpc_auth_refresh_token_create_from_json(
   prop_value = grpc_json_get_string_property(json, "type", &error);
   GRPC_LOG_IF_ERROR("Parsing refresh token", error);
   if (prop_value == nullptr ||
-      strcmp(prop_value, GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER)) {
+      strcmp(prop_value, GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER) != 0) {
     goto end;
   }
   result.type = GRPC_AUTH_JSON_TYPE_AUTHORIZED_USER;

src/core/lib/security/credentials/tls/grpc_tls_certificate_distributor.h

@@ -21,6 +21,8 @@
 
 #include <grpc/grpc_security.h>
 
+#include <utility>
+
 #include "absl/container/inlined_vector.h"
 #include "absl/types/optional.h"
 #include "src/core/lib/gprpp/ref_counted.h"
@@ -127,7 +129,7 @@ struct grpc_tls_certificate_distributor
   void SetWatchStatusCallback(
       std::function<void(std::string, bool, bool)> callback) {
     grpc_core::MutexLock lock(&mu_);
-    watch_status_callback_ = callback;
+    watch_status_callback_ = std::move(callback);
   };
 
   // Registers a watcher. The caller may keep a raw pointer to the watcher,

src/core/lib/security/credentials/tls/grpc_tls_credentials_options.h

@@ -66,7 +66,7 @@ struct grpc_tls_key_materials_config
     pem_root_certs_ = std::move(pem_root_ptr);
   }
   void add_pem_key_cert_pair(grpc_core::PemKeyCertPair pem_key_cert_pair) {
-    pem_key_cert_pair_list_.push_back(pem_key_cert_pair);
+    pem_key_cert_pair_list_.push_back(std::move(pem_key_cert_pair));
   }
   // The ownerships of |pem_root_certs| and |pem_key_cert_pairs| remain with the
   // caller.

src/core/lib/security/security_connector/fake/fake_security_connector.cc

@@ -223,7 +223,7 @@ static void fake_check_peer(
   }
   prop_name = peer.properties[0].name;
   if (prop_name == nullptr ||
-      strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY)) {
+      strcmp(prop_name, TSI_CERTIFICATE_TYPE_PEER_PROPERTY) != 0) {
     error = GRPC_ERROR_CREATE_FROM_COPIED_STRING(
         absl::StrCat("Unexpected property in fake peer: ",
                      prop_name == nullptr ? "<EMPTY>" : prop_name)
@@ -231,7 +231,7 @@ static void fake_check_peer(
     goto end;
   }
   if (strncmp(peer.properties[0].value.data, TSI_FAKE_CERTIFICATE_TYPE,
-              peer.properties[0].value.length)) {
+              peer.properties[0].value.length) != 0) {
     error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
         "Invalid value for cert type property.");
     goto end;

src/core/lib/security/security_connector/load_system_roots.h

@@ -19,6 +19,10 @@
 #ifndef GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_H
 #define GRPC_CORE_LIB_SECURITY_SECURITY_CONNECTOR_LOAD_SYSTEM_ROOTS_H
 
+#include <grpc/support/port_platform.h>
+
+#include <grpc/slice.h>
+
 namespace grpc_core {
 
 // Returns a slice containing roots from the OS trust store

src/core/lib/security/security_connector/load_system_roots_linux.h

@@ -21,6 +21,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <grpc/slice.h>
+
 #ifdef GPR_LINUX
 
 namespace grpc_core {

src/core/lib/security/security_connector/security_connector.cc

@@ -109,7 +109,7 @@ grpc_arg grpc_security_connector_to_arg(grpc_security_connector* sc) {
 }
 
 grpc_security_connector* grpc_security_connector_from_arg(const grpc_arg* arg) {
-  if (strcmp(arg->key, GRPC_ARG_SECURITY_CONNECTOR)) return nullptr;
+  if (strcmp(arg->key, GRPC_ARG_SECURITY_CONNECTOR) != 0) return nullptr;
   if (arg->type != GRPC_ARG_POINTER) {
     gpr_log(GPR_ERROR, "Invalid type %d for arg %s", arg->type,
             GRPC_ARG_SECURITY_CONNECTOR);

src/core/lib/security/security_connector/ssl_utils.h

@@ -154,11 +154,11 @@ class PemKeyCertPair {
   }
 
   // Movable.
-  PemKeyCertPair(PemKeyCertPair&& other) {
+  PemKeyCertPair(PemKeyCertPair&& other) noexcept {
     private_key_ = std::move(other.private_key_);
     cert_chain_ = std::move(other.cert_chain_);
   }
-  PemKeyCertPair& operator=(PemKeyCertPair&& other) {
+  PemKeyCertPair& operator=(PemKeyCertPair&& other) noexcept {
     private_key_ = std::move(other.private_key_);
     cert_chain_ = std::move(other.cert_chain_);
     return *this;

src/core/lib/surface/completion_queue.cc

@@ -422,9 +422,9 @@ static const cq_vtable g_cq_vtable[] = {
      cq_end_op_for_callback, nullptr, nullptr},
 };
 
-#define DATA_FROM_CQ(cq) ((void*)(cq + 1))
+#define DATA_FROM_CQ(cq) ((void*)((cq) + 1))
 #define POLLSET_FROM_CQ(cq) \
-  ((grpc_pollset*)(cq->vtable->data_size + (char*)DATA_FROM_CQ(cq)))
+  ((grpc_pollset*)((cq)->vtable->data_size + (char*)DATA_FROM_CQ(cq)))
 
 grpc_core::TraceFlag grpc_cq_pluck_trace(false, "queue_pluck");
 

src/core/lib/surface/validate_metadata.h

@@ -21,7 +21,10 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <cstring>
+
 #include <grpc/slice.h>
+
 #include "src/core/lib/iomgr/error.h"
 
 grpc_error* grpc_validate_header_key_is_legal(const grpc_slice& slice);

src/core/lib/transport/authority_override.h

@@ -19,6 +19,8 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <grpc/grpc.h>
+
 namespace grpc_core {
 
 /// Returns a channel argument containing \a authority.

src/core/lib/transport/bdp_estimator.cc

@@ -34,7 +34,7 @@ BdpEstimator::BdpEstimator(const char* name)
       accumulator_(0),
       estimate_(65536),
       ping_start_time_(gpr_time_0(GPR_CLOCK_MONOTONIC)),
-      inter_ping_delay_(100.0),  // start at 100ms
+      inter_ping_delay_(100),  // start at 100ms
       stable_estimate_count_(0),
       bw_est_(0),
       name_(name) {}

src/core/lib/transport/metadata.h

@@ -106,10 +106,10 @@ struct grpc_mdelem {
   ((grpc_mdelem_data_storage)((md).payload & (uintptr_t)3))
 #ifdef __cplusplus
 #define GRPC_MAKE_MDELEM(data, storage) \
-  (grpc_mdelem{((uintptr_t)(data)) | ((uintptr_t)storage)})
+  (grpc_mdelem{((uintptr_t)(data)) | ((uintptr_t)(storage))})
 #else
 #define GRPC_MAKE_MDELEM(data, storage) \
-  ((grpc_mdelem){((uintptr_t)(data)) | ((uintptr_t)storage)})
+  ((grpc_mdelem){((uintptr_t)(data)) | ((uintptr_t)(storage))})
 #endif
 #define GRPC_MDELEM_IS_INTERNED(md)          \
   ((grpc_mdelem_data_storage)((md).payload & \

src/core/lib/transport/transport.cc

@@ -61,8 +61,8 @@ void slice_stream_destroy(void* arg) {
   grpc_stream_destroy(static_cast<grpc_stream_refcount*>(arg));
 }
 
-#define STREAM_REF_FROM_SLICE_REF(p)       \
-  ((grpc_stream_refcount*)(((uint8_t*)p) - \
+#define STREAM_REF_FROM_SLICE_REF(p)         \
+  ((grpc_stream_refcount*)(((uint8_t*)(p)) - \
                            offsetof(grpc_stream_refcount, slice_refcount)))
 
 grpc_slice grpc_slice_from_stream_owned_buffer(grpc_stream_refcount* refcount,

src/core/lib/transport/transport.h

@@ -224,7 +224,7 @@ struct grpc_transport_stream_op_batch_payload {
   ~grpc_transport_stream_op_batch_payload() {
     // We don't really own `send_message`, so release ownership and let the
     // owner clean the data.
-    send_message.send_message.release();
+    (void)send_message.send_message.release();
   }
 
   struct {

src/core/tsi/fake_transport_security.cc

@@ -577,6 +577,7 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
   }
   if (!impl->outgoing_frame.needs_draining) {
     tsi_fake_handshake_message next_message_to_send =
+        // NOLINTNEXTLINE(bugprone-misplaced-widening-cast)
         static_cast<tsi_fake_handshake_message>(impl->next_message_to_send + 2);
     const char* msg_string =
         tsi_fake_handshake_message_to_string(impl->next_message_to_send);

src/cpp/ext/filters/census/grpc_plugin.h

@@ -26,10 +26,6 @@
 #include "opencensus/stats/stats.h"
 #include "opencensus/tags/tag_key.h"
 
-namespace grpc_impl {
-class ServerContext;
-}
-
 namespace grpc {
 
 // The tag keys set when recording RPC stats.

src/cpp/server/load_reporter/constants.h

@@ -21,6 +21,8 @@
 
 #include <grpc/impl/codegen/port_platform.h>
 
+#include <stddef.h>
+
 namespace grpc {
 namespace load_reporter {
 

src/cpp/server/load_reporter/load_reporter_async_service_impl.cc

@@ -358,6 +358,7 @@ void LoadReporterAsyncServiceImpl::ReportLoadHandler::Shutdown(
 }
 
 void LoadReporterAsyncServiceImpl::ReportLoadHandler::OnFinishDone(
+    // NOLINTNEXTLINE(performance-unnecessary-value-param)
     std::shared_ptr<ReportLoadHandler> self, bool ok) {
   if (ok) {
     gpr_log(GPR_INFO,

test/core/end2end/tests/cancel_test_helpers.h

@@ -19,6 +19,8 @@
 #ifndef GRPC_TEST_CORE_END2END_TESTS_CANCEL_TEST_HELPERS_H
 #define GRPC_TEST_CORE_END2END_TESTS_CANCEL_TEST_HELPERS_H
 
+#include <grpc/grpc.h>
+
 typedef struct {
   const char* name;
   grpc_call_error (*initiate_cancel)(grpc_call* call, void* reserved);

test/core/gprpp/ref_counted_ptr_test.cc

@@ -58,14 +58,16 @@ TEST(RefCountedPtr, ExplicitConstructor) { RefCountedPtr<Foo> foo(new Foo()); }
 TEST(RefCountedPtr, MoveConstructor) {
   RefCountedPtr<Foo> foo(new Foo());
   RefCountedPtr<Foo> foo2(std::move(foo));
-  EXPECT_EQ(nullptr, foo.get());  // NOLINT
+  // NOLINTNEXTLINE(bugprone-use-after-move)
+  EXPECT_EQ(nullptr, foo.get());
   EXPECT_NE(nullptr, foo2.get());
 }
 
 TEST(RefCountedPtr, MoveAssignment) {
   RefCountedPtr<Foo> foo(new Foo());
   RefCountedPtr<Foo> foo2 = std::move(foo);
-  EXPECT_EQ(nullptr, foo.get());  // NOLINT
+  // NOLINTNEXTLINE(bugprone-use-after-move)
+  EXPECT_EQ(nullptr, foo.get());
   EXPECT_NE(nullptr, foo2.get());
 }
 
@@ -100,6 +102,7 @@ TEST(RefCountedPtr, EnclosedScope) {
   RefCountedPtr<Foo> foo(new Foo());
   {
     RefCountedPtr<Foo> foo2(std::move(foo));
+    // NOLINTNEXTLINE(bugprone-use-after-move)
     EXPECT_EQ(nullptr, foo.get());
     EXPECT_NE(nullptr, foo2.get());
   }
@@ -337,6 +340,7 @@ TEST(WeakRefCountedPtr, EnclosedScope) {
   WeakRefCountedPtr<Bar> bar = bar_strong->WeakRef();
   {
     WeakRefCountedPtr<Bar> bar2(std::move(bar));
+    // NOLINTNEXTLINE(bugprone-use-after-move)
     EXPECT_EQ(nullptr, bar.get());
     EXPECT_NE(nullptr, bar2.get());
   }

test/core/tsi/alts/handshaker/alts_handshaker_client_test.cc

@@ -33,7 +33,7 @@
 #define ALTS_HANDSHAKER_CLIENT_TEST_TARGET_NAME "bigtable.google.api.com"
 #define ALTS_HANDSHAKER_CLIENT_TEST_TARGET_SERVICE_ACCOUNT1 "A@google.com"
 #define ALTS_HANDSHAKER_CLIENT_TEST_TARGET_SERVICE_ACCOUNT2 "B@google.com"
-#define ALTS_HANDSHAKER_CLIENT_TEST_MAX_FRAME_SIZE 64 * 1024
+#define ALTS_HANDSHAKER_CLIENT_TEST_MAX_FRAME_SIZE (64 * 1024)
 
 const size_t kHandshakerClientOpNum = 4;
 const size_t kMaxRpcVersionMajor = 3;

test/core/tsi/alts/handshaker/alts_tsi_handshaker_test.cc

@@ -52,7 +52,7 @@
 #define ALTS_TSI_HANDSHAKER_TEST_APPLICATION_PROTOCOL \
   "test application protocol"
 #define ALTS_TSI_HANDSHAKER_TEST_RECORD_PROTOCOL "test record protocol"
-#define ALTS_TSI_HANDSHAKER_TEST_MAX_FRAME_SIZE 256 * 1024
+#define ALTS_TSI_HANDSHAKER_TEST_MAX_FRAME_SIZE (256 * 1024)
 #define ALTS_TSI_HANDSHAKER_TEST_PEER_ATTRIBUTES_KEY "peer"
 #define ALTS_TSI_HANDSHAKER_TEST_PEER_ATTRIBUTES_VALUE "attributes"
 

test/core/util/test_lb_policies.cc

@@ -103,7 +103,7 @@ class TestPickArgsLb : public ForwardingLoadBalancingPolicy {
       : ForwardingLoadBalancingPolicy(
             absl::make_unique<Helper>(RefCountedPtr<TestPickArgsLb>(this), cb),
             std::move(args),
-            /*delegate_lb_policy_name=*/"pick_first",
+            /*delegate_policy_name=*/"pick_first",
             /*initial_refcount=*/2) {}
 
   ~TestPickArgsLb() override = default;
@@ -208,7 +208,7 @@ class InterceptRecvTrailingMetadataLoadBalancingPolicy
                     this),
                 std::move(cb)),
             std::move(args),
-            /*delegate_lb_policy_name=*/"pick_first",
+            /*delegate_policy_name=*/"pick_first",
             /*initial_refcount=*/2) {}
 
   ~InterceptRecvTrailingMetadataLoadBalancingPolicy() override = default;
@@ -347,7 +347,7 @@ class AddressTestLoadBalancingPolicy : public ForwardingLoadBalancingPolicy {
                 RefCountedPtr<AddressTestLoadBalancingPolicy>(this),
                 std::move(cb)),
             std::move(args),
-            /*delegate_lb_policy_name=*/"pick_first",
+            /*delegate_policy_name=*/"pick_first",
             /*initial_refcount=*/2) {}
 
   ~AddressTestLoadBalancingPolicy() override = default;

test/cpp/naming/address_sorting_test.cc

@@ -826,7 +826,7 @@ int main(int argc, char** argv) {
       GPR_GLOBAL_CONFIG_GET(grpc_dns_resolver);
   if (strlen(resolver.get()) == 0) {
     GPR_GLOBAL_CONFIG_SET(grpc_dns_resolver, "ares");
-  } else if (strcmp("ares", resolver.get())) {
+  } else if (strcmp("ares", resolver.get()) != 0) {
     gpr_log(GPR_INFO, "GRPC_DNS_RESOLVER != ares: %s.", resolver.get());
   }
   grpc::testing::TestEnvironment env(argc, argv);

test/cpp/naming/cancel_ares_query_test.cc

@@ -56,7 +56,7 @@
 #define BAD_SOCKET_RETURN_VAL INVALID_SOCKET
 #else
 #include "src/core/lib/iomgr/sockaddr_posix.h"
-#define BAD_SOCKET_RETURN_VAL -1
+#define BAD_SOCKET_RETURN_VAL (-1)
 #endif
 
 namespace {

test/cpp/naming/dns_test_util.cc

@@ -30,7 +30,7 @@
 #define BAD_SOCKET_RETURN_VAL INVALID_SOCKET
 #else
 #include "src/core/lib/iomgr/sockaddr_posix.h"
-#define BAD_SOCKET_RETURN_VAL -1
+#define BAD_SOCKET_RETURN_VAL (-1)
 #endif
 
 namespace grpc {

test/cpp/naming/resolver_component_test.cc

@@ -75,7 +75,7 @@
 #define BAD_SOCKET_RETURN_VAL INVALID_SOCKET
 #else
 #include "src/core/lib/iomgr/sockaddr_posix.h"
-#define BAD_SOCKET_RETURN_VAL -1
+#define BAD_SOCKET_RETURN_VAL (-1)
 #endif
 
 using grpc::SubProcess;

test/cpp/qps/client.h

@@ -23,6 +23,7 @@
 
 #include <condition_variable>
 #include <mutex>
+#include <thread>
 #include <unordered_map>
 #include <vector>
 

tools/doxygen/Doxyfile.c++.internal

@@ -1726,12 +1726,7 @@ src/core/lib/security/authorization/authorization_engine.h \
 src/core/lib/security/authorization/evaluate_args.cc \
 src/core/lib/security/authorization/evaluate_args.h \
 src/core/lib/security/authorization/mock_cel/activation.h \
-src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h \
-src/core/lib/security/authorization/mock_cel/cel_expression.h \
 src/core/lib/security/authorization/mock_cel/cel_value.h \
-src/core/lib/security/authorization/mock_cel/evaluator_core.h \
-src/core/lib/security/authorization/mock_cel/flat_expr_builder.h \
-src/core/lib/security/authorization/mock_cel/statusor.h \
 src/core/lib/security/certificate_provider.h \
 src/core/lib/security/context/security_context.cc \
 src/core/lib/security/context/security_context.h \

tools/doxygen/Doxyfile.core.internal

@@ -1569,12 +1569,7 @@ src/core/lib/security/authorization/authorization_engine.h \
 src/core/lib/security/authorization/evaluate_args.cc \
 src/core/lib/security/authorization/evaluate_args.h \
 src/core/lib/security/authorization/mock_cel/activation.h \
-src/core/lib/security/authorization/mock_cel/cel_expr_builder_factory.h \
-src/core/lib/security/authorization/mock_cel/cel_expression.h \
 src/core/lib/security/authorization/mock_cel/cel_value.h \
-src/core/lib/security/authorization/mock_cel/evaluator_core.h \
-src/core/lib/security/authorization/mock_cel/flat_expr_builder.h \
-src/core/lib/security/authorization/mock_cel/statusor.h \
 src/core/lib/security/certificate_provider.h \
 src/core/lib/security/context/security_context.cc \
 src/core/lib/security/context/security_context.h \