pub static CPPCHECK: ToolSpecExpand description
C and C++ deterministic checker.
The config markers are project build files rather than a cppcheck config,
following the gofmt/go.mod and clippy/Cargo.toml precedent: cppcheck
has no conventional config file of its own, and the presence of a build
system is what says “this project’s C is checked here”.
SARIF goes to stderr: cppcheck leaves stdout nearly empty (progress chatter only), so reading stdout reports every C file clean.
--error-exitcode=2 is load-bearing in the other direction: without it
cppcheck exits 0 with findings, so the runner’s exit-status guard never
fires for it at all. With it, a finding run exits 2 (which parses fine
and stays Ok), and a cppcheck build that broke the SARIF stream -
moved it, renamed the format - exits 2 saying nothing parseable, which
is Unavailable instead of a permanent silent clean pass.