If you require the user's repos uses GH's actions/checkout prior to the cpp-lint action, then all files are already there in a folder designated by the environment variable $GITHUB_WORKSPACE.

The JSON that the bash script is getting the list of download URLs can instead be used to get the relative path of files. This way, you'd only have to prefix the filenames with $GITHUB_WORKSPACE when passing them to clang-* tools.