How to find all the include folders for a target for a static analyzer?

The INCLUDE_DIRECTORIES property at configure time is just the set added explicitly via target_include_directories (and maybe include_directories, though that may just be stored on the directory and not gathered until generate time). At generate time, the set of linked libraries is finally known and usage requirements from the targets that are linked may be looked up and expanded (with, e.g., platform detection genexes expanded too). It’s not something you can query at configure time, so your add_custom_command is one way to do it properly.

You might be able to use CMAKE_EXPORT_COMPILE_COMMANDS to generate compile_commands.json and have cppcheck use that instead.