skills.rest
awfixers-stuff
awfixers-stuffOFFICIAL
Explore all skills by this author →
Website𝕏@awfixerGitHub

static-analysis

Run clang-tidy, cppcheck, or scan-build on C and C++ codebases using compile_commands.json.

Updated Aug 23, 2026
Search Tags:#c++#static-analysis#cppcheck#ci#clang-tidy#scan-build#compile_commands
One-click install
npx skills add https://github.com/awfixers-stuff/opencode-config --skill static-analysis-awfixers-stuff
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: static-analysis
Source: https://github.com/awfixers-stuff/opencode-config/tree/main/skills/static-analysis
Command: npx skills add https://github.com/awfixers-stuff/opencode-config --skill static-analysis-awfixers-stuff

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Many C and C++ codebases accumulate warnings, false positives, and missed defects because teams lack a consistent, tool-driven workflow for static analysis. This Skill provides practical guidance to choose the right analyzers, generate the necessary compilation database, configure checks, and suppress or triage noise so teams can find real bugs and harden code quality.

Core Features & Use Cases

  • Tool selection and workflows: Advice for when to use clang-tidy, cppcheck, or scan-build depending on goals such as bug finding, modernization, performance, or security.
  • Compilation database generation: Steps to create compile_commands.json for Make and CMake projects so clang-tidy and cppcheck can analyze code accurately.
  • Configuration and suppression: Example .clang-tidy options, suppression patterns (NOLINT, NOLINTNEXTLINE, attribute suppressions), and HeaderFilterRegex strategies to reduce third-party noise.
  • Path-sensitive analysis and CI: How to run scan-build for deeper path analysis and produce HTML or XML reports, plus GitHub Actions snippets to integrate static checks into CI pipelines.
  • Real-world example: Convert a noisy nightly build into actionable results by generating compile_commands.json, running run-clang-tidy with targeted checks, suppressing known false positives, and failing CI only on meaningful warnings.

Quick Start

Run clang-tidy across the project using a generated compile_commands.json, enable bugprone-, clang-analyzer-, and performance-* checks, suppress known false positives, and emit a CI-ready report.

Frequently Asked Questions about static-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate compile_commands.json for CMake or Make projects to run static analysis?▼

To generate compile_commands.json for static analysis, CMake projects should use the CMAKE_EXPORT_COMPILE_COMMANDS flag, while Make projects require tools like Bear to intercept compiler calls. This database allows clang-tidy and cppcheck to analyze code accurately.

What's the best way to suppress false positives in clang-tidy?▼

The best way to suppress false positives in clang-tidy is by using NOLINT or NOLINTNEXTLINE annotations in your code. You can also configure the HeaderFilterRegex option in your .clang-tidy file to exclude third-party headers from triggering warnings.

When should I use cppcheck vs clang-tidy vs scan-build for C++ code?▼

Use cppcheck for general bug finding, clang-tidy for modernization and performance checks, and scan-build when you need deeper path-sensitive analysis to detect complex undefined behavior and security issues in C/C++ code.

How do I integrate static analysis into GitHub Actions CI for a C++ project?▼

You integrate static analysis into GitHub Actions CI by running tools like clang-tidy or cppcheck against a generated compile_commands.json, then emitting machine-readable XML or HTML reports to fail the pipeline only on meaningful warnings.

Which clang-tidy checks should I enable to harden C++ code and find bugs?▼

To harden C++ code and find bugs, you should enable the bugprone-*, clang-analyzer-*, and performance-* check categories in your .clang-tidy configuration. These checks target undefined behavior, security issues, and performance regressions effectively.

Can I run scan-build on a Make project without CMake to detect security issues?▼

Yes, you can run scan-build on a Make project by wrapping your make command with scan-build. This performs path-sensitive analysis to detect security issues and undefined behavior, outputting HTML or XML reports for local triage.

Related Skills

Explore More Software Engineering Skills→
pontschopontscho
1

p:clang-tidy

Run clang-tidy static analysis on C/C++ source files using a compilation database.

Community
Intermediate
mohitmishra786mohitmishra786
159

static-analysis

Automate static code analysis for C/C++ projects with clang-tidy, cppcheck, and scan-build.

Community
Intermediate
RedtropigRedtropig
14

cpp-static-analysis

Run clang-tidy, cppcheck, and include-what-you-use on C/C++ code.

Community
Advanced
martimramosmartimramos
1

forge-lang-c

Standardize C project builds with Makefile, CMake, and gcc/clang toolchains.

Community
Basic