If you had static analysis in from the start, that wouldn't be a problem. If you add static analysis to a messy project, define success thresholds based on the

If you had static analysis in from the start, that wouldn't be a problem. If you add static analysis to a messy project, define success thresholds based on the current violation count, and/or disable violation categories that you can live with. The rule then should be "don't make it worse, try to make it a bit better when you can", rather than "don't commit anything to main until the checker says it's perfect".