New feature Highlights

Show clang-tidy reports in headers

Clang-tidy reports are shown from headers (non system) now, this change can increase the number of new results!
Use the following analyzer configuration to turn back the old behavior by setting the HeaderFilterRegex value to an empty string:
CodeChecker analyze compile_command.json --analyzer-config clang-tidy:HeaderFilterRegex=\"\"

Python 3 only

Because of Python 2 sunset at the beginning of 2020 CodeChecker was ported to Python 3 the minimal required version is 3.6. Because of the Python version change and a lot of 3pp dependencies were updated it is required to remove the old and create a new virtual environment to build the package!

Store results from multiple static and dynamic analyzer tools

Starting with this version CodeChecker can store the results of multiple static and dynamic analyzers for different programming languages:

• Facebook Infer (C/C++, Java)
• Clang Sanitizers (C/C++)
• Spotbugs (Java)
• Pylint (Python)
• Eslint (Javascript)
• ...

The complete list of the supported analyzers can be found here.
To be able to store the reports of an analyzer a report converter tool is available which can convert the reports of the supported analyzers to a format which can be stored by the CodeChecker store command.

New build and CI system features and improvements

GitLab integration

Inside a GitLab Runner CodeChecker can executed to provide a code quality report for each GitLab review request. The codeclimate json output format was added to the Codechecker parse and
CodeChecker cmd diff commands to generate a json file which can be parsed
by GitLab as a quality report. See the GitLab integration guide for more details how to configure the GitLab runners and CodeChecker.

Gerrit

Integration was simplified, no extra output parsing and converter scripts are needed. The CodeChecker cmd diff -o gerrit ... command can generate an output format which can be sent to gerrit as a review result.

Bazel build system support

Compilation commands executed by the Bazel build system can now be logged with the Codechecker logger to run the static analyzers on the source files. Check out the Bazel build system integration guide for more details.

Compilation errors as reports

Compilation errors occurred during the analysis are now captured as reports by the clang-diagnostic-error checker. These types of reports can be disabled as a normal checker like this:
CodeChecker analyze --disable clang-diagnostic-error ...

Analyzer and checker configuration from the command line

The Clang and Clang-tidy static analyzers and the checkers can be configured from the command line with the newly introduced --analyzer-config and --checker-config options.

Analyzer configuration

Use these commands to list the available analyzer config options (use the --details flag for the default values and more description):

• CodeChecker analyzers --analyzer-config clangsa
• CodeChecker analyzers --analyzer-config clang-tidy

A Clang Static Analyzer configuration option can be enabled during analysis like this:
CodeChecker analyze compile_command.json -o reports --analyzer-config clangsa:suppress-c++-stdlib=false -c

Checker configuration

Use the CodeChecker checkers --checker-config command to list the checker options, or the CodeChecker checkers --checker-config --details command to get the checker options with the default values.

A checker option can be set like this:
CodeChecker analyze compile_command.json -o reports -e cplusplus.Move --checker-config clangsa:cplusplus.Move:WarnOn="All"

Select only a few files to be analyzed from the compile command database

There is no need for a complex skip file or to create smaller compile command database files to execute the analysis only on a few files. With the --file option the important files can be selected the analysis for the other files will be skipped.
CodeChecker analyze compile_command.json --file "*main.cpp" "*lib.cpp"

Incremenetal Analysis Extension: Analyze c/cpp files that are dependencies of a changed header

Header files can not be analyzed without a c/cpp file. If a skip file contains a header file (with a "+" tag) like this:

+*lib.h
-*

Which means the header file should be analyzed. CodeChecker tries to find all the c/cpp files including that header file and execute the analysis on those c/cpp files too so the header file will be analyzed.
The only limitation is that the full compilation database is required to collect this information.

CodeChecker CLI configuration files

The CodeChecker commands can be saved in a config file which can be put into a version control system or distributed between multiple developers much easier. In the previous release v6.11.0 the support for the analyzer configuration file was added. In this release it was extended to the web server related commands (store, server) so they can be stored into a configuration file too.
It is not required to type out the options in the command line all the time to store the analysis reports.
With an example store_cfg.json config file like this:

{
  "store":
    [
      "--name=run_name",
      "--tag=my_tag",
      "--url=http://codechecker.my/MyProduct"
    ]
}

The CodeChecker store command can be this short: CodeChecker store reports --config store_cfg.json

Other new features worth mentioning

• The review comments in the source code are shown by the CodeChecker parse command
• A free text description can be store to every run which can contain any compilation or analysis related description.
  CodeChecker store --description "analysis related extra information" ...

Removed command line options

These CodeChecker check and CodeChecker analyze options were already deprecated and were removed in this release:

• -f/--force
• --add-compiler-defaults

Other improvements and changes

There are a lot of improvements and bug fixes in this release.
The full list of changes can be found here.

License change

This is the last release with the NCSA license the new license after the release will be: "Apache 2.0 with LLVM Exception", SPDX License Identifier: "Apache-2.0 WITH LLVM-exception"

Contributors

Big thanks to everyone who helped us creating this release: @itzurabhi, @Tilya, @themightyoarfish @rpavlik @sylvestre