Static Analysis

Static Analysis

Purpose

Guide agents through selecting, running, and triaging static analysis tools for C/C++ — clang-tidy, cppcheck, and scan-build — including suppression strategies and CI integration.

Triggers

• "How do I run clang-tidy on my project?"
• "What clang-tidy checks should I enable?"
• "cppcheck is reporting false positives — how do I suppress them?"
• "How do I set up scan-build for deeper analysis?"
• "My build is noisy with static analysis warnings"
• "How do I generate compile_commands.json for clang-tidy?"

Workflow

1. Generate compile_commands.json

clang-tidy requires a compilation database:

# CMake (preferred)cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ONln -s build/compile_commands.json .
# Bear (for Make-based projects)bear -- make
# compiledb (alternative for Make)pip install compiledbcompiledb make

2. Run clang-tidy

# Single fileclang-tidy src/foo.c -- -std=c11 -I include/
# Whole project via compile_commands.jsonrun-clang-tidy -p build/ -j$(nproc)
# With specific checks enabledclang-tidy -checks='bugprone-*,modernize-*,performance-*' src/foo.cpp
# Apply auto-fixesclang-tidy -checks='modernize-use-nullptr' -fix src/foo.cpp

3. Check category decision tree

Goal?├── Find real bugs            → bugprone-*, clang-analyzer-*├── Modernise C++ code        → modernize-*├── Follow core guidelines    → cppcoreguidelines-*├── Catch performance issues  → performance-*├── Security hardening        → cert-*, hicpp-*└── Readability / style       → readability-*, llvm-*

4. .clang-tidy configuration file

# .clang-tidy — place at project rootChecks: >  bugprone-*,  modernize-*,  performance-*,  -modernize-use-trailing-return-type,  -bugprone-easily-swappable-parametersWarningsAsErrors: 'bugprone-*,clang-analyzer-*'HeaderFilterRegex: '^(src|include)/.*'CheckOptions:  - key: modernize-loop-convert.MinConfidence    value: reasonable  - key: readability-identifier-naming.VariableCase    value: camelCase

5. Suppress false positives

// Suppress a single lineint result = riskyOp(); // NOLINT(bugprone-signed-char-misuse)
// Suppress a block// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers)constexpr int BUFFER_SIZE = 4096;
// Suppress whole function[[clang::suppress("bugprone-*")]]void legacy_code() { /* ... */ }

Or in .clang-tidy:

# Exclude third-party directoriesHeaderFilterRegex: '^(src|include)/.*'# Disable specific checksChecks: '-bugprone-easily-swappable-parameters'

6. Run cppcheck

# Basic runcppcheck --enable=all --std=c11 src/
# With compile_commands.jsoncppcheck --project=build/compile_commands.json
# Include specific checks and suppress noisecppcheck --enable=warning,performance,portability \         --suppress=missingIncludeSystem \         --suppress=unmatchedSuppression \         --error-exitcode=1 \         src/
# Generate XML report for CIcppcheck --xml --xml-version=2 src/ 2> cppcheck-report.xml

7. Path-sensitive analysis with scan-build

# Intercept a Make buildscan-build make
# Intercept CMake buildscan-build cmake --build build/
# Show HTML reportscan-view /tmp/scan-build-*/
# With specific checkersscan-build -enable-checker security.insecureAPI.gets \           -enable-checker alpha.unix.cstring.BufferOverlap \           make

scan-build finds deeper bugs than clang-tidy: use-after-free across functions, dead stores from logic errors, null dereferences on complex paths.

8. CI integration

# GitHub Actions- name: Static analysis  run: |    cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON    run-clang-tidy -p build -j$(nproc) -warnings-as-errors '*'
- name: cppcheck  run: |    cppcheck --enable=warning,performance \             --suppress=missingIncludeSystem \             --error-exitcode=1 \             src/

For clang-tidy check details, see references/clang-tidy-checks.md [blocked].

Related skills

• Use skills/compilers/clang for Clang toolchain and diagnostic flags
• Use skills/compilers/gcc for GCC warnings as complementary analysis
• Use skills/runtimes/sanitizers for runtime bug detection alongside static analysis
• Use skills/build-systems/cmake for CMAKE_EXPORT_COMPILE_COMMANDS setup