Overview

Static Analysis is the process of examining code without actually executing it. Linting is a specific type of static analysis that focuses on finding programmatic and stylistic errors.

Core Concepts

• Linting:
  • Stylistic Checks: Ensuring consistent indentation, naming conventions, and quote usage (e.g., Prettier, ESLint).
  • Error Detection: Identifying obviously wrong code, such as referencing an undefined variable or unreachable code.
• Static Analysis (Deeper):
  • Type Checking: Verifying that types are used consistently (e.g., TypeScript’s tsc).
  • Complexity Analysis: Measuring “Cyclomatic Complexity” to identify functions that are too complex and need refactoring.
  • Security Analysis: Searching for known vulnerable patterns (e.g., hardcoded API keys, SQL injection patterns).
• The Linter’s Role:
  • Prevention: Catching errors before they ever reach the runtime.
  • Standardization: Ensuring that a large team of developers writes code that looks like it was written by one person.

Code Examples

// Conceptual ESLint configuration
{
    "rules": {
        "no-console": "warn",
        "eqeqeq": "error",
        "semi": ["error", "always"]
    }
}

Use Cases

• Code Reviews: Automating the “nitpicks” (formatting, style) so reviewers can focus on logic and architecture.
• CI/CD Integration: Failing the build if the code doesn’t meet the quality standards.
• Onboarding: Helping new developers learn the project’s coding standards through immediate IDE feedback.

Gotchas

• Linter Fatigue: Having too many strict rules can frustrate developers and lead them to use // eslint-disable-next-line everywhere.
• False Positives: Static analysis tools sometimes flag code as problematic when it is actually correct and intentional.

Related Notes

• Testing Pyramid
• CI/CD Pipelines