[llvm] [workflows] Add post-commit job that periodically runs the clang static analyzer (PR #94106)

[Aiden Grossman via llvm-commits]

https://github.com/boomanaiden154 commented:

Thanks for doing this.

I guess we'll see from the PR run how long this takes and what the results are like. From what I've heard, the clang static analyzer produces false positives that can be hard to fix. I'm not sure how that anecdote generalizes to the LLVM code base though.

Also, is there a reason for using clang static analyzer over something more basic like clang tidy? I think they both would fit the OpenSSF definition of static analysis (although haven't looked into it). I guess CSA does do more in depth analysis and will probably find more things.

Even if it's noisy, just having it run once a day post commit so that people who are interested can look at the results seems like a decent idea.

https://github.com/llvm/llvm-project/pull/94106