methods / static-analysis

Static analysis

Reads the code without running it: linters, type checkers, security and workflow scanners.

When: On every change. Cheapest signal, runs in seconds, and most findings point at an exact line.

87% of scanned repositories run at least one

22 tools detected

Linting

called for by: any change; ui components and pages

Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.

Tool	Languages	Repos	Command seen	Fix	Docs
`eslint`	javascript, typescript	107	`eslint .`	autofix	docs
`ruff-check`	python	64	`ruff check .`	autofix	docs
`clippy`	rust	45	`cargo clippy --all-targets -- -D warnings`		docs
`golangci-lint`	go	26	`golangci-lint run`		docs
`biome`	javascript, typescript, config	24	`biome format --write .`	autofix	docs
`flake8`	python	17	`flake8 --select=S`		docs
`pylint`	python	17	`pylint $(printf tests/components/%s ${TESTS_GLOB})`		docs
`shellcheck`	shell	10	`shellcheck --version`		docs
`go-vet`	go	9	`go vet ./...`		docs
`staticcheck`	go	1	`staticcheck -checks=U1000 ./... 2>&1`		docs

called for by: any change; public apis, signatures, error paths, nullability

Catches: Wrong types, unhandled null or None, call signatures broken across modules.

Tool	Languages	Repos	Command seen	Docs
`tsc`	typescript	117	`tsc --noEmit`	docs
`mypy`	python	35	`mypy`	docs
`cargo-check`	rust	21	`cargo check`	docs
`pyright`	python	16	`pyright`	docs

called for by: authentication, input handling, secrets, permissions

Catches: Injection, unsafe APIs and tainted data reaching a sink.

Tool	Languages	Repos	Command seen	Docs
`codeql`	any	63	`uses github/codeql-action/analyze`	docs
`semgrep`	any	15	`semgrep ci`	docs
`bandit`	python	6	`bandit`	docs

called for by: authentication, input handling, secrets, permissions

Catches: Credentials and tokens committed to the repository.

Tool	Languages	Repos	Command seen	Fix	Docs
`gitleaks`	any	7	`gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-base...`		docs

called for by: ci workflows and configuration files

Catches: Broken GitHub Actions syntax, script injection, over-broad token permissions.

Tool	Languages	Repos	Command seen	Fix	Docs
`zizmor`	yaml	33	`zizmor --format sarif . > results.sarif`		docs
`actionlint`	yaml	12	`actionlint`		docs

called for by: documentation and comments

Catches: Broken cross-references, links and markup in documentation.

Tool	Languages	Repos	Command seen	Fix	Docs
`mkdocs`	python, docs	11	`mkdocs build`		docs
`sphinx`	python, docs	9	`sphinx-build -E -W -b dirhtml docs docs/_build/dirhtml`		docs