Static Code Analysis

Many options available these days:

• clang-tidy: is a clang-based C++ “linter” tool. Its purpose is to provide an extensible framework for diagnosing and fixing typical programming errors, like style violations, interface misuse, or bugs that can be deduced via static analysis. clang-tidy is modular and provides a convenient interface for writing new checks.
• iwyu (include what you use) : This parses C++ source files and determines the exact include files required to compile that file, no more no less.
• lwyu (link what you use): This is a built in CMake feature that uses options of ld and ldd to print out if executables link more libraries than they actually require.
• cpplint: a C++ style checker following Google’s C++ style guide.
• cppcheck: a static analysis tool for C/C++ code. Cppcheck primarily detects the types of bugs that the compilers normally do not detect. The goal is to detect only real errors in the code (i.e. have zero false positives).

They are all pretty well integrated with CMake:

• <LANG>_CLANG_TIDY can be set with cache variable CMAKE_<LANG>_CLANG_TIDY
• <LANG>_CPPCHECK can be set with cache variable CMAKE_<LANG>_CPPCHECK
• <LANG>_CPPLINT can be set with cache variable CMAKE_<LANG>_CPPLINT
• <LANG>_INCLUDE_WHAT_YOU_USE can be set with cache variable CMAKE_<LANG>_INCLUDE_WHAT_YOU_USE
• LINK_WHAT_YOU_USE can be set with cache variable CMAKE_LINK_WHAT_YOU_USE

Clang Tidy

• Agree on a .clang-tidy configuration
• Add a CMake option to enable clang-tidy on demand
• Apply clang-tidy suggestions to the codebase when sensible

Include-what-you-use

• Add a CMake option to enable iwyu on demand
• Apply iwyu suggestions to the codebase when sensible