diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c50cd8ca..c1f5c524 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -37,7 +37,7 @@ jobs:
 
         # need these so docker copy won't fail
         cp Pipfile Pipfile.lock flake8_openpilot.sh pylint_openpilot.sh .pylintrc \
-           .coveragerc-app $TEST_DIR
+           cppcheck_openpilot.sh .coveragerc-app $TEST_DIR
         cd $TEST_DIR
         mkdir pyextra laika laika_repo tools release
     - name: Build Docker image
@@ -49,7 +49,7 @@ jobs:
     name: docker push
     runs-on: ubuntu-16.04
     if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && github.repository == 'commaai/openpilot'
-    needs: linter # hack to ensure slow tests run first since this and linter are fast
+    needs: static_analysis # hack to ensure slow tests run first since this and static_analysis are fast
     steps:
       - uses: actions/checkout@v2
         with:
@@ -62,8 +62,8 @@ jobs:
           docker tag tmppilot docker.io/commaai/openpilot:latest
           docker push docker.io/commaai/openpilot:latest
 
-  linter:
-    name: linter
+  static_analysis:
+    name: static analysis
     runs-on: ubuntu-16.04
     steps:
       - uses: actions/checkout@v2
@@ -75,6 +75,18 @@ jobs:
         run: $RUN "cd /tmp/openpilot/ && ./flake8_openpilot.sh"
       - name: pylint
         run: $RUN "cd /tmp/openpilot/ && ./pylint_openpilot.sh"
+      - name: cppcheck
+        run: $PERSIST "cd /tmp/openpilot/ && ./cppcheck_openpilot.sh 2> cppcheck_report.txt"
+      - name: Print cppcheck report
+        if: always()
+        run: |
+          docker cp tmppilot:/tmp/openpilot/cppcheck_report.txt cppcheck_report.txt
+          cat cppcheck_report.txt
+      - uses: actions/upload-artifact@v2
+        if: always()
+        with:
+          name: cppcheck_report.txt
+          path: cppcheck_report.txt
 
   unit_tests:
     name: unit tests
@@ -123,13 +135,11 @@ jobs:
         run: |
           docker commit tmppilot tmppilotci
           $CI_RUN "cd /tmp/openpilot && bash <(curl -s https://codecov.io/bash) -Z -F process_replay"
-      - name: Copy diff
+      - name: Print diff
         if: always()
         run: |
           docker cp tmppilot:/tmp/openpilot/selfdrive/test/process_replay/diff.txt diff.txt
-      - name: Print diff
-        if: always()
-        run: cat diff.txt
+          cat diff.txt
       - uses: actions/upload-artifact@v2
         if: always()
         with:
diff --git a/.gitignore b/.gitignore
index c6efe5cf..8f21086a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,6 +57,7 @@ panda_jungle
 
 .coverage*
 coverage.xml
+cppcheck_report.txt
 htmlcov
 pandaextra
 
diff --git a/Dockerfile.openpilot b/Dockerfile.openpilot
index e5b1f249..205e5f19 100644
--- a/Dockerfile.openpilot
+++ b/Dockerfile.openpilot
@@ -46,7 +46,6 @@ ENV LANG en_US.UTF-8
 ENV LANGUAGE en_US:en
 ENV LC_ALL en_US.UTF-8
 
-# Install python dependencies
 RUN curl -L https://github.com/pyenv/pyenv-installer/raw/master/bin/pyenv-installer | bash
 ENV PATH="/root/.pyenv/bin:/root/.pyenv/shims:${PATH}"
 
@@ -77,6 +76,7 @@ RUN pyenv install 3.8.2 && \
 RUN mkdir -p /tmp/openpilot
 
 COPY SConstruct \
+     cppcheck_openpilot.sh \
      flake8_openpilot.sh \
      pylint_openpilot.sh \
      .pylintrc \
diff --git a/cppcheck_openpilot.sh b/cppcheck_openpilot.sh
new file mode 100755
index 00000000..6f652080
--- /dev/null
+++ b/cppcheck_openpilot.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+cppcheck --force -j$(nproc) selfdrive/ common/ opendbc/ cereal/ installer/ 2> cppcheck_report.txt
+