Recommend a linter for C++?

[kytrinyx]

See exercism/docs#54 for details.

[LegalizeAdulthood]

There are a couple issues here. First, there is the "styling" of code: spaces vs. tabs, placing of space characters, bracing styles, etc. Second, are static analysis tools.

• Styling tools and guides:
  • clang-format
  • CERT C Secure Coding Standard
  • CERT C++ Secure Coding Standard
• Static analysis tools:
  • Clang Static Analyzer
  • Visual Studio Static Analysis:
    • blog in depth
    • reference
  • cppcheck
  • Oink
  • PC-Lint
  • flawfinder
  • stack

[kytrinyx]

This is definitely about (consistent) style (spaces, braces, that sort of thing), not static analysis.

Static analysis is a delightful rabbit hole, though, and we're exploring the possibility of integrating some aspects of that into exercism (see exploration/discussion here: exercism/exercism#1607).

[LegalizeAdulthood]

OK, in the realm of styling, I know of tools that exist to reformat your C++ according to some style guide, but they don't give you feedback on how well you are doing at matching a particular style or even if your style is consistent throughout.

I think what comes closest to the ruby example shown in pull request #1607 for C++ is cppcheck with it's performance and style category of warnings. clang-modernize is a source-to-source transformation tool that can replace outdated constructs with C++11 constructs, but it simply modifies your source file in place, it does not provide feedback without the user running a before-and-after diff.

[kytrinyx]

I think warnings are more useful than transformations, except where there's a language-wide consensus (such as with Go - Go has both go fmt that does transformations for everything that is completely accepted, and go lint for style warnings). This is because I think it's interesting to have the discussions about why one choice might be better than another, rather than just enforcing a choice.

In this case I think that cppcheck sounds like a better choice.

[LegalizeAdulthood]

Yeah, cppcheck is better for providing this sort of feedback. For instance, cppcheck will issue an error when you use iterators over containers along with container modifying operations in such a way that the iterators are invalidated and you're going off into undefined behavior. It also will nitpick you on things like bit shifting signed quantities in ways that lead to undefined behavior, memory leaks, etc. Those all fall into the error category.

Things get more interesting when you turn on style and performance warnings. Then you get things like preferring ++iter instead of iter++ unless you need the previous value of iter. While cppcheck isn't the greatest, I think it is easy to use, easy to deploy and the messages are easy to interpret.

[kytrinyx]

cool, it sounds like a good choice.

[celavek]

How about clang-tidy?

[LegalizeAdulthood]

cppcheck is available on all platforms; there isn't an out-of-the-box ready experience for clang-tidy on Windows yet AFAIK.