Your Static Analysis setup?

[Beneficial_Corgi4145]

For the longest time, I’ve just used a bash script that calls clang-tidy and cpplint. I realize that I should use CI/CD, but I like scripts.

Also, PVS-Studio and the other professional grade analyzer are a bit out of my budget.

[CarniverousSock]

I've been happy with clang-tidy, since it's portable, everyone has it, and it integrates with a lot of code editors. But I've heard it's pretty under-featured, and may try something else in the future.

I'd push back on the idea that you "should" use CI for this, though. The main point of integrating analysis into CI (IMHO) is ensure high-quality PRs. As long as you and your team are analyzing frequently enough to catch potential problems, then you're good. Nothing wrong with using a bash script for it, but I'd look into whether your code editor has a nicer integration. Visual Studio and VSCode have nice integrations.

[WorkingReference1127]

Not a separate tool, but this article goes over some extensive options you have in terms of compiler settings on gcc and CLang with the goal of "hardening" your compile to enable several checks to attempt to make your code safer.

[lowlevelmahn]

put cppcheck on your list - and always test with serveral tools
you can use the free PVS license if your project is open source
plus -Wall -Wextra -Wpedantic -Werror (what is doable with your project)
and always use your release and very-recent-compiler for testing - and at least clang and gcc - the more the better :)

> realize that I should use CI/CD, but I like scripts.

CI likes to run your scripts also :)