Static Code Analysis Tools

Static Code Analysis Tools examine source code without executing it, automatically detecting bugs, security vulnerabilities, and code smells.

In a Nutshell

Static Code Analysis (SCA) analyzes code without running it. Tools like ESLint (JS), Pylint (Python), and SonarQube (multi-language) automatically find bugs, security issues, and code smells. They integrate into CI/CD pipelines as quality gates.

Technical Overview

Static Code Analysis is the automated examination of source code without execution. Tools check syntax, semantics, coding standards, security vulnerabilities, and code quality metrics. Analysis happens through pattern matching, data flow analysis, and abstract interpretation. SCA tools typically integrate into CI/CD pipelines and can serve as quality gates, preventing poor code from being merged.

Why Static Code Analysis?

• Automation: Finds errors faster than manual code reviews
• Consistency: Enforces uniform coding standards across teams
• Security: Catches vulnerabilities before production
• Learning: New developers learn through immediate tool feedback
• Metrics: Measurable code quality over time

Tools Overview

Tool	Language	Type	Highlights
ESLint	JavaScript/TS	Linter	Highly configurable with plugin system
Prettier	JavaScript/TS	Formatter	Opinionated code formatting
Pylint	Python	Linter	PEP-8 compliant, comprehensive
Black	Python	Formatter	Uncompromising, PEP-8 aligned
SonarQube	Multi	Platform	Code quality dashboard
SpotBugs	Java	Linter	Finds Java-specific bugs
Checkstyle	Java	Linter	Enforces coding standards
RuboCop	Ruby	Linter	Ruby style guide enforcement

ESLint (JavaScript/TypeScript)

Installation

npm install --save-dev eslint
npx eslint --init

Configuration

// .eslintrc.js
module.exports = {
  env: {
    browser: true,
    es2021: true,
    node: true,
  },
  extends: [
    'eslint:recommended',
    'plugin:@typescript-eslint/recommended',
    'plugin:prettier/recommended',
  ],
  parser: '@typescript-eslint/parser',
  plugins: ['@typescript-eslint'],
  rules: {
    'no-unused-vars': 'error',
    'no-console': 'warn',
    '@typescript-eslint/no-explicit-any': 'warn',
  },
};

Example Violations

// ESLint error: no-unused-vars
const unused = 42;

// ESLint error: no-console
console.log('Debug output');

// ESLint error: prefer-const
var x = 5;

Pylint (Python)

Installation

pip install pylint

Configuration

# .pylintrc
[MASTER]
disable=C0111,C0103

[FORMAT]
max-line-length=100

[BASIC]
good-names=i,j,k,ex,Run,_

Running Pylint

pylint mymodule.py

SonarQube (Multi-Language)

Installation (Docker)

docker run -d --name sonarqube -p 9000:9000 sonarqube

Configuration

# SonarQube Scanner
sonar-scanner \
  -Dsonar.projectKey=my-project \
  -Dsonar.sources=src \
  -Dsonar.host.url=http://localhost:9000

Quality Gate Standards

• Coverage: > 80%
• Duplications: < 3%
• Security Rating: A
• Reliability Rating: A

CI/CD Integration

GitHub Actions

name: Code Quality

on: [push, pull_request]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
        with:
          node-version: '18'
      - run: npm ci
      - run: npm run lint
      - run: npm run test:coverage

GitLab CI

code_quality:
  image: sonarsource/sonar-scanner-cli
  script:
    - sonar-scanner
  only:
    - merge_requests
    - main

Best Practices

• Early Integration: Start using SCA early in your development process
• Custom Rules: Tailor rules to your project instead of relying on defaults
• Auto-Fix: Leverage automatic fixes for simple issues
• Quality Gates: Block builds when critical issues are detected
• Regular Updates: Keep tools and rulesets current

Exam-Relevant Key Points

• Static Code Analysis examines code without execution
• Common tools: ESLint (JS), Pylint (Python), SonarQube (multi-language)
• Linters check code; formatters fix style automatically
• CI/CD integration enforces quality gates
• Automates code quality checks

FAQ

Next in the Software Quality Learning Path

The next article in the Software Quality Learning Path covers Software Quality and Maintainability — how to achieve maintainable code through good architecture, documentation, and testing.

Sources

1. https://eslint.org/
2. https://pylint.pycqa.org/
3. https://www.sonarqube.org/

Recommended Books on Software Quality

If you’d like to dive deeper into Static Code Analysis, tools, and software quality, we recommend these books: