Regarding this, OSRC for ROS 2 and we internally use https://www.gimpel.com/html/pclp-release.htm.
We also wrote an ament plugin for it: ament_lint/ament_pclint at master · ament/ament_lint · GitHub.
It does cost money but we can really warmly recommend it. It finds really lots of defects and it is easy to work with (as part of your compilation process) unlike some other tools like e.g. Coverity.