static-analysis

# Single file
clang-tidy src/foo.c -- -std=c11 -I include/
 
# Whole project via compile_commands.json
run-clang-tidy -p build/ -j$(nproc)
 
# With specific checks enabled
clang-tidy -checks='bugprone-*,modernize-*,performance-*' src/foo.cpp
 
# Apply auto-fixes
clang-tidy -checks='modernize-use-nullptr' -fix src/foo.cpp

Goal?
├── Find real bugs            → bugprone-*, clang-analyzer-*
├── Modernise C++ code        → modernize-*
├── Follow core guidelines    → cppcoreguidelines-*
├── Catch performance issues  → performance-*
├── Security hardening        → cert-*, hicpp-*
└── Readability / style       → readability-*, llvm-*

# .clang-tidy — place at project root
Checks: >
  bugprone-*,
  modernize-*,
  performance-*,
  -modernize-use-trailing-return-type,
  -bugprone-easily-swappable-parameters
WarningsAsErrors: 'bugprone-*,clang-analyzer-*'
HeaderFilterRegex: '^(src|include)/.*'
CheckOptions:
  - key: modernize-loop-convert.MinConfidence
    value: reasonable
  - key: readability-identifier-naming.VariableCase
    value: camelCase

// Suppress a single line
int result = riskyOp(); // NOLINT(bugprone-signed-char-misuse)
 
// Suppress a block
// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers)
constexpr int BUFFER_SIZE = 4096;
 
// Suppress whole function
[[clang::suppress("bugprone-*")]]
void legacy_code() { /* ... */ }

# Exclude third-party directories
HeaderFilterRegex: '^(src|include)/.*'
# Disable specific checks
Checks: '-bugprone-easily-swappable-parameters'

# Basic run
cppcheck --enable=all --std=c11 src/
 
# With compile_commands.json
cppcheck --project=build/compile_commands.json
 
# Include specific checks and suppress noise
cppcheck --enable=warning,performance,portability \
         --suppress=missingIncludeSystem \
         --suppress=unmatchedSuppression \
         --error-exitcode=1 \
         src/
 
# Generate XML report for CI
cppcheck --xml --xml-version=2 src/ 2> cppcheck-report.xml

# Intercept a Make build
scan-build make
 
# Intercept CMake build
scan-build cmake --build build/
 
# Show HTML report
scan-view /tmp/scan-build-*/
 
# With specific checkers
scan-build -enable-checker security.insecureAPI.gets \
           -enable-checker alpha.unix.cstring.BufferOverlap \
           make

# GitHub Actions
- name: Static analysis
  run: |
    cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
    run-clang-tidy -p build -j$(nproc) -warnings-as-errors '*'
 
- name: cppcheck
  run: |
    cppcheck --enable=warning,performance \
             --suppress=missingIncludeSystem \
             --error-exitcode=1 \
             src/