# Share a clang-tidy Report — HTML via CodeChecker, at a URL

Canonical: https://commareports.com/share-clang-tidy-report
Published: 2026-09-14

> clang-tidy prints to a terminal. CodeChecker turns a run into a browsable HTML report — publish it to Comma so reviewers triage findings at a link instead of in a CI log.

# Share a clang-tidy report

clang-tidy finds the defects that matter in modern C++ — use-after-move,
dangling references, the whole `bugprone-` family — and reports them the way a
compiler does: as text, in a terminal, in whatever order the files were
analysed.

On a real codebase that is several thousand lines of output, which means
nobody triages it, which means the checks get disabled one by one until the
tool runs and reports nothing. The output format is doing most of the damage.

## Get HTML out of it

clang-tidy has no HTML writer. CodeChecker does, and it consumes clang-tidy and
the Clang Static Analyzer together:

```bash
# 1. capture the exact compile commands
CodeChecker log -b "make -j$(nproc)" -o compile_commands.json

# 2. analyse
CodeChecker analyze compile_commands.json -o ./reports \
  --analyzers clang-tidy clangsa

# 3. render
CodeChecker parse -e html -o ./reports_html ./reports
```

```
reports_html/
├── index.html         # every finding, filterable by checker and severity
├── *.c.*.html         # source with the diagnostic path stepped through
└── static/
```

The stepped-through path is the part that cannot survive a terminal. A
use-after-move report is an argument across four locations, and reading it as
four line numbers is nothing like reading it as a highlighted trail through the
source.

If CMake is already building the project, `-DCMAKE_EXPORT_COMPILE_COMMANDS=ON`
gives you step 1 for free.

## Publish the folder

Drag `reports_html/` (or a zip of it) into
[Comma](https://commareports.com/):

- `index.html` becomes the **report body** — the filterable finding list.
- Per-file pages and `static/` upload alongside it, with relative references
  rewritten to the uploaded copies, so the drill-down into a diagnostic path
  works.
- Scripts run inside a sandboxed iframe (`allow-scripts`, no
  `allow-same-origin`), so the checker filters and severity toggles keep
  working.

## From CI

```bash
CodeChecker parse -e html -o ./reports_html ./reports || true

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html reports_html/index.html \
        --arg t "clang-tidy — $(git rev-parse --short HEAD)" \
        '{title: $t, html: $html}')"
```

`CodeChecker parse` exits non-zero when there are findings, so `|| true` keeps
the publish step alive on exactly the runs worth publishing. Supporting pages
go up through `POST /api/v1/reports/$REPORT_ID/assets` as base64 — see the
[API reference](/docs/api) and [publishing from CI](/docs/ci).

## Triage where the trail is

The reason clang-tidy adoption dies is that suppression decisions are invisible.
Someone judges a finding a false positive, adds a `NOLINT`, and the reasoning
lives in a commit message nobody reads. The next person sees an unexplained
`NOLINT` and either deletes it or copies the pattern.

A comment anchored to the rendered diagnostic — "the analyser can't see that
`release()` nulls the pointer" — is the reasoning, attached to the evidence.
See [commenting on HTML](/comment-on-html), and
revisions for watching the count across releases at one URL.

## Who can see it

Per report: private, your team, anyone signed in at your domain, or anyone with
the link. Analyser output contains source and points at memory-safety defects —
restrict it. See [sharing & access control](/docs/sharing).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, **250 MB and 500 files total**.
  A whole-project run can exceed 500 pages — analyse per component.
- **Scripts run, sandboxed** — no same-origin access.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish an analysis report →](https://commareports.com/)**

### Related

- [Share a Cppcheck report](/share-cppcheck-report) · [Share a SARIF report](/share-sarif-report)
- [Share CodeQL results](/share-codeql-results) · [Share a Semgrep report](/share-semgrep-report)
- [Share a gtest report](/share-gtest-report) · [Share a flame graph](/share-flamegraph)