long story short:
scan-build cmake -S. -Bb -GNinja scan-build -V -o csa-out cmake --build b
there's also this: CodeChecker.