Is your feature request related to a problem? Please describe.
C++ is an inherently complex language and has countless footguns. Currently there are no safeguards against this and bug lifetime is very long. This makes even tiny refactoring hard because even a tiny change can lead to run-time errors or memory corruption. A lot of errors are left undiscovered for a long time or are missed during review.

Some examples:

• fix(libutil/posix-source-accessor.cc): get rid of use-after-move bug #11837 - This is trivially caught by the cplusplus.Move.html check.
• fix(libstore-tests): remove use-after-free bug for StringSource #11813
• fix(nix/eval.cc): move call to fs::create_directory out of assert #11718 - bugprone/assert-side-effect.html

C++ compilers aren't very helpful most of the time, and even for diagnosable errors current compiler flags don't include enough warnings.

Describe the solution you'd like
Include clang-tidy runs and more compiler warnings in the build process and CI. Ideally clang-tidy would be run for every change.

Meson has native clang-tidy integration since 0.52 and has been extended in 1.3 to enable automatic fixes via the clang-tidy-fix target.
We can start by bumping the warning_level in Meson and enabling the bare minimum checks for easily diagnosable issues like clang-analyzer-* and some bugprone-* checks.

There are some potential downsides like:

• Increased load on the CI builders.
• More stringent review process.
• Opinionated lints and checks being a source of debate for developers and maintainers. We need to make sure to only enable the checks that have the potential to uncover bugs.
• False positives that need to be explicitly disabled.

Describe alternatives you've considered

• Running clang-tidy out-of-tree.
• Praying to the C++ gods that UB doesn't spawn nasal demons.

Additional context

• Enable C++ Sanitizers for Nix #10969 (comment)

Priorities

Add 👍 to issues you find important.