static-analysis

Static Analysis

Use Cases

• Static analysis of code is needed before committing to find potential defects.
• Industries such as automotive and medical require MISRA-C 2012 compliance checks.
• Need to use cppcheck, clang-tidy, or GCC -fanalyzer for code quality review.
• Need to view a summary of static analysis results grouped by severity level.

Required Inputs

• Source code directory path.
• At least one available static analysis tool (cppcheck, clang-tidy, or GCC 12+).
• Optional compile_commands.json path (improves clang-tidy accuracy).
• Optional severity level filtering and MISRA check toggle.

Automatic Detection

• --detect mode detects the availability and versions of cppcheck, clang-tidy, and arm-none-eabi-gcc.
• GCC -fanalyzer requires GCC 12+, and the script checks the version number.
• Automatically searches the workspace for compile_commands.json。

Execution Steps

1. First read references/usage.mdto confirm which analysis tool to use this time.
2. If unsure whether the tool is available, first run scripts/static_analyzer.py 's --detect mode.
3. Use --cppcheck --source <dir> to run cppcheck analysis.
4. Use --clang-tidy --source <dir> to run clang-tidy analysis.
5. Use --gcc-analyzer --source <files> to run GCC analyzer analysis.
6. When MISRA compliance is needed, add the --misra parameter to enable the cppcheck MISRA addon.
7. Read references/misra-quick-ref.md to learn about common MISRA violations.

Failure Triage

• When all analysis tools are unavailable, return environment-missing。
• When the specified source code directory does not exist, return artifact-missing。
• When compile_commands.json is specified but invalid, return project-config-error。
• When the analysis tool exits abnormally, return target-response-abnormal。

Platform Notes

• cppcheck and clang-tidy are available on all three major platforms and are installed via package managers.
• GCC -fanalyzer requires GCC 12+, and embedded cross-compilers may have lower versions.
• The bundled script uses the Python standard library and subprocess, and is cross-platform compatible.

Output Conventions

• Output findings grouped by severity level (error, warning, style, information).
• Each finding includes the file path, line number, rule ID, and description.
• --summary mode outputs only statistics.
• MISRA mode additionally outputs the violated rule numbers.

Handoff Relationships

• When serious defects are found and a rebuild is needed after fixing, hand off to the corresponding build-* skill。
• When the code's memory impact needs to be understood, hand off to memory-analysis。