cpp-static-analysis

Run static analysis on C/C++ code using clang-tidy for incremental checks on changed files, cppcheck for correctness and leaks, and IWYU for include hygiene. You need a compile_commands.json at the project root and tools installed to surface warnings before committing.

The best way to check include hygiene in a C++ project is using IWYU (include-what-you-use), which identifies unused or missing includes. This static analysis requires a compile_commands.json present at the project root to run reliably.

Yes, clang-tidy performs incremental checks on changed files using a compile_commands.json project. It requires a safe baseline .clang-tidy configuration at the project root to run reliably across large codebases after edits to source files.

Cppcheck provides fast, standalone checks for correctness, leaks, and off-by-one issues in C/C++ code. However, the overall static analysis workflow requires a compile_commands.json at the project root for reliable full-project scans and incremental analysis.

Before running C/C++ static analysis, you need a compile_commands.json at the project root, installed tools (clang-tidy, cppcheck, and include-what-you-use), and a baseline .clang-tidy configuration file to ensure the analysis runs reliably.

Static analysis catches a large class of bugs in C/C++ code at zero runtime cost, identifying defects before they cause failures and regressions. It surfaces warnings during active development and pre-release, complementing runtime testing across large codebases.