Static Analysis

Purpose

Guide agents through selecting, running, and triaging static analysis tools for C/C++ — clang-tidy, cppcheck, and scan-build — including suppression strategies and CI integration.

Triggers

• "How do I run clang-tidy on my project?"

• "What clang-tidy checks should I enable?"

• "cppcheck is reporting false positives — how do I suppress them?"

• "How do I set up scan-build for deeper analysis?"

• "My build is noisy with static analysis warnings"

• "How do I generate compile_commands.json for clang-tidy?"

Workflow

1. Generate compile_commands.json

clang-tidy requires a compilation database:

# CMake (preferred)

cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON

ln -s build/compile_commands.json .

# Bear (for Make-based projects)

bear -- make

# compiledb (alternative for Make)

pip install compiledb

compiledb make

2. Run clang-tidy

# Single file

clang-tidy src/foo.c -- -std=c11 -I include/

# Whole project via compile_commands.json

run-clang-tidy -p build/ -j$(nproc)

# With specific checks enabled

clang-tidy -checks='bugprone-*,modernize-*,performance-*' src/foo.cpp

# Apply auto-fixes

clang-tidy -checks='modernize-use-nullptr' -fix src/foo.cpp

3. Check category decision tree

Goal?

├── Find real bugs            → bugprone-*, clang-analyzer-*

├── Modernise C++ code        → modernize-*

├── Follow core guidelines    → cppcoreguidelines-*

├── Catch performance issues  → performance-*

├── Security hardening        → cert-*, hicpp-*

└── Readability / style       → readability-*, llvm-*

Category

Key checks

What it catches

bugprone-*

use-after-move, integer-division, suspicious-memset-usage

Likely bugs

modernize-*

use-nullptr, use-override, use-auto

C++11/14/17 idioms

cppcoreguidelines-*

avoid-goto, pro-bounds-*, no-malloc

C++ Core Guidelines

performance-*

unnecessary-copy-initialization, avoid-endl

Performance regressions

clang-analyzer-*

core.*, unix.*, security.*

Path-sensitive bugs

cert-*

err34-c, str51-cpp

CERT coding standard

4. .clang-tidy configuration file

# .clang-tidy — place at project root

Checks: >

  bugprone-*,

  modernize-*,

  performance-*,

  -modernize-use-trailing-return-type,

  -bugprone-easily-swappable-parameters

WarningsAsErrors: 'bugprone-*,clang-analyzer-*'

HeaderFilterRegex: '^(src|include)/.*'

CheckOptions:

  - key: modernize-loop-convert.MinConfidence

    value: reasonable

  - key: readability-identifier-naming.VariableCase

    value: camelCase

5. Suppress false positives

// Suppress a single line

int result = riskyOp(); // NOLINT(bugprone-signed-char-misuse)

// Suppress a block

// NOLINTNEXTLINE(cppcoreguidelines-avoid-magic-numbers)

constexpr int BUFFER_SIZE = 4096;

// Suppress whole function

[[clang::suppress("bugprone-*")]]

void legacy_code() { /* ... */ }

Or in .clang-tidy:

# Exclude third-party directories

HeaderFilterRegex: '^(src|include)/.*'

# Disable specific checks

Checks: '-bugprone-easily-swappable-parameters'

6. Run cppcheck

# Basic run

cppcheck --enable=all --std=c11 src/

# With compile_commands.json

cppcheck --project=build/compile_commands.json

# Include specific checks and suppress noise

cppcheck --enable=warning,performance,portability \

         --suppress=missingIncludeSystem \

         --suppress=unmatchedSuppression \

         --error-exitcode=1 \

         src/

# Generate XML report for CI

cppcheck --xml --xml-version=2 src/ 2> cppcheck-report.xml

--enable= value

What it checks

warning

Undefined behaviour, bad practices

performance

Redundant operations, inefficient patterns

portability

Non-portable constructs

information

Configuration and usage notes

all

Everything above

7. Path-sensitive analysis with scan-build

# Intercept a Make build

scan-build make

# Intercept CMake build

scan-build cmake --build build/

# Show HTML report

scan-view /tmp/scan-build-*/

# With specific checkers

scan-build -enable-checker security.insecureAPI.gets \

           -enable-checker alpha.unix.cstring.BufferOverlap \

           make

scan-build finds deeper bugs than clang-tidy: use-after-free across functions, dead stores from logic errors, null dereferences on complex paths.

8. CI integration

# GitHub Actions

- name: Static analysis

  run: |

    cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON

    run-clang-tidy -p build -j$(nproc) -warnings-as-errors '*'

- name: cppcheck

  run: |

    cppcheck --enable=warning,performance \

             --suppress=missingIncludeSystem \

             --error-exitcode=1 \

             src/

For clang-tidy check details, see references/clang-tidy-checks.md.

Related skills

• Use skills/compilers/clang for Clang toolchain and diagnostic flags

• Use skills/compilers/gcc for GCC warnings as complementary analysis

• Use skills/runtimes/sanitizers for runtime bug detection alongside static analysis

• Use skills/build-systems/cmake for CMAKE_EXPORT_COMPILE_COMMANDS setup