diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ff8d5cce09c2..67c6f6df80f0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -206,6 +206,33 @@ jobs:
            bash -cxe "SHOW_TIMINGS=1 tools/ci/actions/runner.sh test_prefix $dir"; \
           done
 
+  cppcheck:
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'run-cppcheck')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Packages
+        run: |
+          sudo apt-get update -y && sudo apt-get install -y bear clang cppcheck
+      - name: configure tree
+        run: |
+          CONFIG_ARG='CC=clang' MAKE_ARG=-j bash -xe tools/ci/actions/runner.sh configure
+      - name: Build with compilation database
+        # https://clang.llvm.org/docs/JSONCompilationDatabase.html
+        # https://github.com/rizsotto/Bear
+        run: |
+          MAKE_ARG=-j bash -xe tools/ci/actions/runner.sh build-compilation-database
+      - name: cppcheck
+        run: |
+          mkdir _build
+          cppcheck --project=compile_commands.json --cppcheck-build-dir=_build \
+            -j$(nproc) --clang --check-level=exhaustive --enable=all \
+            -iyacc \
+            --library=posix.cfg
+
   i386:
     runs-on: ubuntu-latest
     container:
diff --git a/.gitignore b/.gitignore
index 5cec38960f9f..91fee334efe0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,6 +40,7 @@ _build
 META
 # Ignore foo.depend, but not .depend
 ?*.depend
+compile_commands.json
 
 # local to root directory
 
diff --git a/tools/ci/actions/runner.sh b/tools/ci/actions/runner.sh
index b78b53f8a319..248d0634f47e 100755
--- a/tools/ci/actions/runner.sh
+++ b/tools/ci/actions/runner.sh
@@ -80,6 +80,14 @@ Build () {
   fi
 }
 
+BuildCompilationDatabase () {
+  local failed
+  bear -- $MAKE_WARN || failed=$?
+  if ((failed)); then
+    exit $failed
+  fi
+}
+
 Test () {
   if [ "$1" = "sequential" ]; then
     echo Running the testsuite sequentially
@@ -204,6 +212,7 @@ BasicCompiler () {
 case $1 in
 configure) Configure;;
 build) Build;;
+build-compilation-database) BuildCompilationDatabase;;
 test) Test parallel;;
 test_sequential) Test sequential;;
 test_prefix) TestPrefix $2;;