2 ms·
I've worked in spaces where static analysis tools were run automatically on every new PR. Trust me, it's not as good as it sounds. Static analyzers are fully in
by ryukoposting 3y ago
I've worked in spaces where static analysis tools were run automatically on every new PR. Trust me, it's not as good as it sounds. Static analyzers are fully incapable of detecting the more nuanced mistakes, so a human touch will still be necessary. Nearly all of the "bugs" found by the static analyzer won't actually be bugs, but you'll have to "fix" them anyway because the reviewer (again, you'll still need one) will demand that all the warnings be cleared before approving your code.
Build a culture that prefers succinct, non-nitpicky code reviews. Static analysis tools only give reviewers more crap to nitpick.
- NavinF 3y ago> Nearly all of the "bugs" found by the static analyzer won't actually be bugs Which static analyzer is this? Every tool I've used only finds bugs the are provable so the false positive rate is essential zero
- kevin_thibedeau 3y agoPlenty of C/C++ static analysis tools have pedantic rules that flag correct code. Effective use of them means going through which rules you want to disable to minimize the unproductive make-work of satisfying the machine.