build: sync scan-build target with CI

Changes:

* Use --status-bugs in the scan-build target to exit with an error if
  bugs are found
* Call the make target in the CI job

2 files changed, 4 insertions, 4 deletions

diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index c308e3620..b4ff6fd9c 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -67,11 +67,11 @@ jobs:
       run: ./ci/printenv.sh
     - name: configure
       run: >
-        CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor
-        --enable-selinux
+        ./configure CC=clang-14 SCAN_BUILD=scan-build-14
+        --enable-fatal-warnings --enable-apparmor --enable-selinux
         || (cat config.log; exit 1)
     - name: scan-build
-      run: scan-build-14 --status-bugs make
+      run: make scan-build
 
   cppcheck:
     runs-on: ubuntu-22.04
diff --git a/Makefile b/Makefile
index d6d4f098c..dcd84b7ab 100644
--- a/Makefile
+++ b/Makefile
@@ -374,7 +374,7 @@ cppcheck-old: clean
 
 .PHONY: scan-build
 scan-build: clean
-        $(SCAN_BUILD) $(MAKE)
+        $(SCAN_BUILD) --status-bugs $(MAKE)
 
 # TODO: Old codespell versions (such as v2.1.0 in CI) have issues with
 # contrib/syscalls.sh