diff --git a/.ci/tidy_script.sh b/.ci/tidy_script.sh
index 0e5aef24c67f5..8806c77e9ea5a 100755
--- a/.ci/tidy_script.sh
+++ b/.ci/tidy_script.sh
@@ -1,34 +1,20 @@
 #!/usr/bin/env bash
 
-set -ex
+set -e
 
-CLANG_TIDY_CHECKS='-*'
-if [[ $TOOL == clang-tidy-analyzer ]]; then
-  CLANG_TIDY_CHECKS+=',clang-analyzer-*,-clang-analyzer-alpha*,bugprone*'
-elif [[ $TOOL == clang-tidy-modernize ]]; then
-  CLANG_TIDY_CHECKS+=',modernize*'
-fi
+echo "Running $(realpath $0) from $PWD"
 
-echo "Running clang-tidy only against the changes in branch $TRAVIS_BRANCH."
+WORKSPACE="${GITHUB_WORKSPACE:-${PWD}}"
+echo "Setting WORKSPACE to $WORKSPACE"
 
-cd ../root/
+SRC_DIR="${WORKSPACE}/ROOT-CI/src"
+BUILD_DIR="${WORKSPACE}/ROOT-CI/build"
 
-# Workaround for travis issue: travis-ci/travis-ci#6069
-git remote set-branches --add origin master
-git fetch
+mkdir -v -p "${SRC_DIR}" "${BUILD_DIR}"
 
-# clang-tidy-diff.py not installed on travis
-wget https://raw.githubusercontent.com/llvm-mirror/clang-tools-extra/release_50/clang-tidy/tool/clang-tidy-diff.py
+cmake -B "${BUILD_DIR}" -S ${SRC_DIR} \
+  -DCMAKE_CXX_COMPILER=clang++ -DCMAKE_C_COMPILER=clang -DCMAKE_EXPORT_COMPILE_COMMANDS=on \
+  -Dminimal=on -Dasserts=on
 
-RESULT_OUTPUT="$(git diff -U0 origin/master | python clang-tidy-diff.py -p1 -clang-tidy-binary $(which clang-tidy) \
-                 -checks=$CLANG_TIDY_CHECKS)"
-if [[ $? -eq 0 ]]; then
-  echo "$TOOL passed."
-  exit 0
-else
-  echo "To reproduce it locally please run"
-  echo -e "\tgit checkout $TRAVIS_BRANCH"
-  echo -e "Command: git diff -U0 $TRAVIS_BRANCH..origin/master | clang-tidy-diff.py -p1 -clang-tidy-binary \$(which clang-tidy) -checks=$CLANG_TIDY_CHECKS"
-  echo "$RESULT_OUTPUT"
-  exit 1
-fi
+clang-tidy --version
+exit 0
diff --git a/.github/workflows/code_analysis.yml b/.github/workflows/code_analysis.yml
index b76fa9880398b..44f8c5403885e 100644
--- a/.github/workflows/code_analysis.yml
+++ b/.github/workflows/code_analysis.yml
@@ -23,7 +23,7 @@ jobs:
 
     runs-on: ubuntu-latest
     env:
-      TRAVIS_BRANCH: ${{ github.base_ref }} 
+      TRAVIS_BRANCH: ${{ github.base_ref }}
       TRAVIS_PULL_REQUEST_REPO: ${{ github.event.pull_request.head.repo.html_url }}
       TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
       BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
@@ -48,6 +48,55 @@ jobs:
         PATH=/usr/lib/llvm-20/bin:${PATH}
         .ci/format_script.sh
 
+  clang-tidy:
+    # For any event that is not a PR, the CI will always run. In PRs, the CI
+    # can be skipped if the tag [skip-ci] is written in the title.
+    if: |
+       (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||
+       (github.event_name == 'pull_request' && !(
+         contains(github.event.pull_request.title, '[skip-ci]') ||
+         contains(github.event.pull_request.labels.*.name, 'skip ci') ||
+         contains(github.event.pull_request.labels.*.name, 'skip code analysis')
+       ))
+
+    runs-on:
+       - self-hosted
+       - linux
+       - x64
+
+    container:
+      image: registry.cern.ch/root-ci/alma10:buildready
+      options: '--security-opt label=disable --rm'
+      env:
+        OS_APPLICATION_CREDENTIAL_ID: '7f5b64a265244623a3a933308569bdba'
+        OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+        OS_AUTH_TYPE: 'v3applicationcredential'
+        OS_AUTH_URL: 'https://keystone.cern.ch/v3'
+        OS_IDENTITY_API_VERSION: 3
+        OS_INTERFACE: 'public'
+        OS_REGION_NAME: 'cern'
+        PYTHONUNBUFFERED: true
+
+    env:
+       TRAVIS_BRANCH: ${{ github.base_ref }}
+       TRAVIS_PULL_REQUEST_REPO: ${{ github.event.pull_request.head.repo.html_url }}
+       TRAVIS_PULL_REQUEST_BRANCH: ${{ github.head_ref }}
+       BASE_COMMIT: ${{ github.event.pull_request.base.sha }}
+
+    steps:
+       - uses: actions/checkout@v6
+         with:
+            fetch-depth: 1
+            ref: ${{ github.event.pull_request.head.sha }}
+            path: ROOT-CI/src
+       - name: Fetch base sha
+         run: cd ROOT-CI/src && git fetch --depth=1 origin +${{github.event.pull_request.base.sha}}:origin/base_sha
+       - name: Determine merge base
+         run: echo "MERGE_BASE=$(cd ROOT-CI/src && git merge-base ${{ github.event.pull_request.base.sha }} HEAD)" >> $GITHUB_ENV
+       - name: run clang-tidy script
+         run: |
+            ROOT-CI/src/.ci/tidy_script.sh
+
   ruff:
     if: |
         (github.repository_owner == 'root-project' && github.event_name != 'pull_request') ||