Static Code Analysis [C++]

[FScholPer]

2025-10-30

Participants

@AlexanderLanin
@FScholPer
@sameer6989
Clemens Kutz
Paul Sheerwood

Agenda

• Next steps Static code analysis in S-CORE

Meeting Minutes

• Most of the companies use internally commercial tools
• Clear need of S-CORE tool in open source is there
• There are established formats to interchange the results like https://www.oasis-open.org/committees/tc_home.php?wg_abbrev=sarif
• Many of the current misra rules do have microcontroller environments in mind. But from current distributor and OEM perspective you cannot bring something into production without having misra compliance
• Long term goal would be to find new ways like TSF to address standard compliance
• Codeql already tested in https://github.com/eclipse-score/inc_daal/blob/main/.github/workflows/codeql.yml looks promising because of its coverage and dsl

Next steps:

• Clarify clang-tidy timeline and coverage
• Establish clang-tidy as bazel tool
• Compare codql and clang-tidy results
• Try out CodeQL locally and check if single file check is fast and with high usability for devs
• Check customization of rules is possible with CodeQL

[pahmann]

Just out of curiosity as I may have missed it: Is there (still) any intention to go with the open source service of Coverity?

[AlexanderLanin]

As of ~February our (not-so-strong) intention for C++ is to go for BMW-clang-tidy and GitHub CodeQL - due to the open nature of the actual checks. We did not discuss any alternatives today.

It's extremely difficult (and extremely important) to make a good decision on the code analysis tool. But analyzing all the options is simply beyond what we can invest at the moment. There is an old overview of possible tools: #244 (comment)