[clang-tidy] fix HeaderFilterRegex and exclude third_party headers (#13782)

HeaderFilterRegex in .clang-tidy previously used a PCRE negative
lookbehind assertion ((?<!third_party.*repo)), which is not supported
by LLVM's POSIX ERE regex engine (llvm::Regex) and prevented header
files from matching.

This commit:
- Simplifies HeaderFilterRegex to '(examples|include|src)'.
- Adds ExcludeHeaderFilterRegex: '(^|/)third_party/' to exclude
  vendored third_party headers from clang-tidy checks and fixes.
- Fixes existing clang-tidy warnings in OpenThread header files
  surfaced by enabling header filtering.

Fixes #8920

.clang-tidy

@@ -20,4 +20,5 @@ Checks: >
   readability-simplify-boolean-expr,
   readability-static-accessed-through-instance
 WarningsAsErrors: '*'
-HeaderFilterRegex: '(examples|include|src).*(?<!third_party.*repo)'
+HeaderFilterRegex: '(examples|include|src)'
+ExcludeHeaderFilterRegex: '(^|/)third_party/'

src/core/border_router/br_tracker.hpp

@@ -112,7 +112,7 @@ private:
     {
         struct RlocFilter
         {
-            RlocFilter(const NetworkData::Rlocs &aRlocs)
+            explicit RlocFilter(const NetworkData::Rlocs &aRlocs)
                 : mExcludeRlocs(aRlocs)
             {
             }

src/core/coap/coap.hpp

@@ -921,7 +921,7 @@ private:
             using Handler = ResponseHandler;
 
             Matcher(void) { mMode = kAny; }
-            Matcher(const Ip6::Address &aSourceAddress) { mMode = kAddress, mAddress = &aSourceAddress; }
+            explicit Matcher(const Ip6::Address &aSourceAddress) { mMode = kAddress, mAddress = &aSourceAddress; }
             Matcher(Handler aHandler, void *aContext) { mMode = kHandler, mHandler = aHandler, mContext = aContext; }
 
             bool Matches(const Request &aRequest) const;

src/core/coap/coap_message.hpp

@@ -399,7 +399,7 @@ public:
      * @retval  TRUE   Expect to respond with CoAP reset message on error.
      * @retval  FALSE  No CoAP reset message should be sent on error.
      */
-    bool RequireResetOnError(void) { return IsConfirmable() || IsNonConfirmable(); }
+    bool RequireResetOnError(void) const { return IsConfirmable() || IsNonConfirmable(); }
 
 private:
     Type     mType;

src/core/common/msg_backed_array.hpp

@@ -100,7 +100,7 @@ public:
      *
      * @param[in] aInstance  The OpenThread instance.
      */
-    MessageBackedArray(Instance &aInstance)
+    explicit MessageBackedArray(Instance &aInstance)
         : InstanceLocator(aInstance)
         , mMessage(nullptr)
     {

src/core/common/settings.hpp

@@ -675,10 +675,10 @@ public:
 
         typedef MeshCoP::BorderAgent::Id ValueType; ///< The associated value type.
 
+        BorderAgentId(void) = delete;
+
     private:
         static void Log(Action aAction, const MeshCoP::BorderAgent::Id &aId);
-
-        BorderAgentId(void) = delete;
     };
 #endif
 

src/core/diags/factory_diags.hpp

@@ -194,7 +194,6 @@ private:
             , mIsFilterEnabled(false)
             , mReceiveCount(0)
             , mNumFrames(0)
-            , mFilterAddress()
         {
         }
 

src/core/instance/instance.hpp

@@ -459,7 +459,7 @@ public:
      *
      * @returns TRUE if the "DNS name compression" mode is enabled, FALSE otherwise.
      */
-    bool IsDnsNameCompressionEnabled(void) { return mDnsNameCompressionEnabled; }
+    bool IsDnsNameCompressionEnabled(void) const { return mDnsNameCompressionEnabled; }
 #endif
 
     /**
@@ -544,10 +544,10 @@ private:
         // set to `nullptr` to avoid any potential use of a dangling pointer.
 
 #if OPENTHREAD_CONFIG_MULTIPLE_INSTANCE_ENABLE && OPENTHREAD_CONFIG_LOG_INSTANCE_AWARE_API_ENABLE
-        ActiveInstanceTracker(Instance &aInstance) { gActiveInstance = &aInstance; }
+        explicit ActiveInstanceTracker(Instance &aInstance) { gActiveInstance = &aInstance; }
         ~ActiveInstanceTracker(void) { gActiveInstance = nullptr; }
 #else
-        ActiveInstanceTracker(Instance &) {}
+        explicit ActiveInstanceTracker(Instance &) {}
 #endif
     };
 

src/core/mac/mac_header_ie.hpp

@@ -405,16 +405,20 @@ public:
      */
     const uint8_t *GetMetricsData(void) const { return GetBytes() + sizeof(LinkMetricsProbingIe); }
 
+    /**
+     * Returns a pointer to the Link Metrics Data bytes.
+     *
+     * @returns A pointer to the Link Metrics Data bytes.
+     */
+    uint8_t *GetMetricsData(void) { return GetBytes() + sizeof(LinkMetricsProbingIe); }
+
     /**
      * Writes Link Metrics Data content from a given buffer.
      *
      * @param[in] aData  A pointer to a buffer containing the data to write. The caller must ensure that at least
      *                   `GetMetricsDataLen()` bytes are available in @p aData.
      */
-    void WriteMetricsDataFrom(const uint8_t *aData)
-    {
-        memcpy(AsNonConst(GetMetricsData()), aData, GetMetricsDataLen());
-    }
+    void WriteMetricsDataFrom(const uint8_t *aData) { memcpy(GetMetricsData(), aData, GetMetricsDataLen()); }
 
 private:
     static constexpr uint8_t kSubType = 0x00;

src/core/mac/mac_ltvs.hpp

@@ -354,7 +354,6 @@ public:
      */
     static void OptimizeListOrder(AppendInfo *aLtvList, uint16_t aNumLtvs);
 
-private:
     Ltv(void) = delete;
 };
 

src/core/meshcop/border_agent_txt_data.hpp

@@ -98,7 +98,7 @@ public:
      *
      * @param[in] aInstance  A reference to the OpenThread instance.
      */
-    TxtData(Instance &aInstance);
+    explicit TxtData(Instance &aInstance);
 
 #if OPENTHREAD_CONFIG_BORDER_AGENT_TXT_DATA_PARSER_ENABLE
 

src/core/meshcop/dataset.hpp

@@ -797,26 +797,26 @@ template <> inline const uint32_t &Dataset::Info::Get<Dataset::kChannelMask>(voi
 //- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 // Active and Pending Timestamp
 
-template <> inline void Dataset::Info::Get<Dataset::kActiveTimestamp>(Timestamp &aTimestamp) const
+template <> inline void Dataset::Info::Get<Dataset::kActiveTimestamp>(Timestamp &aComponent) const
 {
-    aTimestamp.SetFrom(mActiveTimestamp);
+    aComponent.SetFrom(mActiveTimestamp);
 }
 
-template <> inline void Dataset::Info::Get<Dataset::kPendingTimestamp>(Timestamp &aTimestamp) const
+template <> inline void Dataset::Info::Get<Dataset::kPendingTimestamp>(Timestamp &aComponent) const
 {
-    aTimestamp.SetFrom(mPendingTimestamp);
+    aComponent.SetFrom(mPendingTimestamp);
 }
 
-template <> inline void Dataset::Info::Set<Dataset::kActiveTimestamp>(const Timestamp &aTimestamp)
+template <> inline void Dataset::Info::Set<Dataset::kActiveTimestamp>(const Timestamp &aComponent)
 {
     GetComponents().MarkAsPresent<kActiveTimestamp>();
-    aTimestamp.ConvertTo(mActiveTimestamp);
+    aComponent.ConvertTo(mActiveTimestamp);
 }
 
-template <> inline void Dataset::Info::Set<Dataset::kPendingTimestamp>(const Timestamp &aTimestamp)
+template <> inline void Dataset::Info::Set<Dataset::kPendingTimestamp>(const Timestamp &aComponent)
 {
     GetComponents().MarkAsPresent<kPendingTimestamp>();
-    aTimestamp.ConvertTo(mPendingTimestamp);
+    aComponent.ConvertTo(mPendingTimestamp);
 }
 
 } // namespace MeshCoP

src/core/meshcop/secure_transport.hpp

@@ -922,7 +922,7 @@ public:
          *
          * @param[in] aTransport  The DTLS transport to use for this session.
          */
-        Session(Transport &aTransport)
+        explicit Session(Transport &aTransport)
             : SecureSession(aTransport)
         {
         }

src/core/net/dhcp6_types.hpp

@@ -383,7 +383,6 @@ public:
         kHardwareTypeEui64    = 27, ///< EUI64 HW Type.
     };
 
-private:
     Duid(void) = delete;
 };
 
@@ -433,8 +432,10 @@ private:
  */
 class IdOption
 {
-protected:
+public:
     IdOption(void) = delete;
+
+protected:
     static Error Read(Option::Code aCode, const Message &aMessage, OffsetRange &aDuidOffsetRange);
     static Error ReadEui64(Option::Code aCode, const Message &aMessage, Mac::ExtAddress &aExtAddress);
     static Error MatchesEui64(Option::Code aCode, const Message &aMessage, const Mac::ExtAddress &aExtAddress);

src/core/net/ip6.hpp

@@ -317,7 +317,7 @@ public:
      *
      * @returns TRUE if the filter is enabled, FALSE otherwise.
      */
-    bool IsTmfOriginFilterEnabled(void) { return mTmfOriginFilterEnabled; }
+    bool IsTmfOriginFilterEnabled(void) const { return mTmfOriginFilterEnabled; }
 
 #endif
 

src/core/net/mdns.hpp

@@ -1827,7 +1827,7 @@ private:
 
     struct CacheContext : private NonCopyable
     {
-        CacheContext(Instance &aInstance);
+        explicit CacheContext(Instance &aInstance);
         TimeMilli GetNow(void) const { return mNextFireTime.GetNow(); }
 
         NextFireTime mNextFireTime;

src/core/net/nd6.hpp

@@ -624,7 +624,7 @@ private:
      *
      * @param[in] aPrefixLengthCode   The prefix length code.
      */
-    void SetPrefixLengthCode(const uint8_t aPrefixLengthCode);
+    void SetPrefixLengthCode(uint8_t aPrefixLengthCode);
 
     uint16_t mPrefixAttr; // The prefix attributes (Scaled Lifetime and Prefix Length Code).
     uint8_t  mPrefixMsb[12];

src/core/thread/mle.hpp

@@ -1824,7 +1824,7 @@ private:
         // before sending the first message.
 
     public:
-        PrevRoleRestorer(Instance &aInstance);
+        explicit PrevRoleRestorer(Instance &aInstance);
 
         Error Start(void);
         void  Stop(void);

src/core/thread/mle_tlvs.hpp

@@ -644,7 +644,7 @@ public:
      *
      * @param[in] aChannel       The channel.
      */
-    ChannelTlvValue(uint16_t aChannel)
+    explicit ChannelTlvValue(uint16_t aChannel)
         : ChannelTlvValue(0, aChannel)
     {
     }
@@ -719,7 +719,7 @@ public:
      *
      * @param[in] aChannel       The channel.
      */
-    CslChannelTlvValue(uint16_t aChannel)
+    explicit CslChannelTlvValue(uint16_t aChannel)
         : ChannelTlvValue(aChannel)
     {
     }

src/lib/spinel/radio_spinel.hpp

@@ -1164,7 +1164,7 @@ private:
      */
     bool IsSafeToHandleNow(spinel_prop_key_t aKey) const
     {
-        return !(aKey == SPINEL_PROP_STREAM_RAW || aKey == SPINEL_PROP_MAC_ENERGY_SCAN_RESULT);
+        return aKey != SPINEL_PROP_STREAM_RAW && aKey != SPINEL_PROP_MAC_ENERGY_SCAN_RESULT;
     }
 
     void HandleNotification(const uint8_t *aFrame, uint16_t aLength, bool &aShouldSaveFrame);

src/lib/spinel/spinel_driver.hpp

@@ -210,7 +210,7 @@ public:
      *
      * @returns the spinel interface id.
      */
-    spinel_iid_t GetIid(void) { return mIid; }
+    spinel_iid_t GetIid(void) const { return mIid; }
 
 #if OPENTHREAD_SPINEL_CONFIG_COPROCESSOR_RESET_FAILURE_CALLBACK_ENABLE
     /**