We have a large "legacy" C++ code base on which no static analysis is run at the moment.
However, I do expect a huge number of found warnings and probably also false positives (in that the error does not actually cause an observable bug in the application).
We simply do not have the resources available to address these all on rollout of any analysis tool, especially as we would very much only like to touch "code that works (well enough)" if we really have to.
So what I am looking for are experiences and user stories of adding C++ static analysis to legacy code bases:
We had this product, consisting of xxx lines of code over zzz C++ projects and we started using static analysis tool yyy in development. Rooting out the legacy code warnings took aaa effort, (temporarily) ignoring them was hard/easy/impossible. Ignoring warnings selectively for the code base really worked well/didn't work at all. Etc.
Something like this. Thanks!