static analysis

In static analysis, a tool examines the structure of software without starting the application. It checks the code against rules about types, data flows, security, and coding conventions. LintingGlossary · In brieflintingLinting automatically checks source code for potential errors and violations of agreed coding rules, without running the application. The tool that performs these checks is called a linter.Read more and type checking are familiar forms of static analysis.

Which problems can static analysis find?

The issues a tool flags depend on the programming language and the configured rules. A simple check might find unused variables, unreachable code, or a value of the wrong type. More advanced tools trace data through the codebaseGlossary · In briefcodebaseA codebase is the collection of source code used to build and maintain a software product or component.Read more and flag patterns that could indicate a security problem.

A warning does not automatically mean the code is wrong. The analysis does not always have the full context and may flag a risk that does not occur in practice. Other problems may fall outside the configured rules. Developers therefore need to assess the findings and adapt the rules to the project.

Checking before execution

Static analysis can run in the editor and is often part of continuous integrationGlossary · In briefcontinuous integrationContinuous integration is a practice in which developers regularly merge small code changes and check them automatically, making integration problems visible early.Read more. A developer gets feedback while writing code or before a change is merged. This makes the check quick and repeatable.

An automated test runs code and checks specific behaviour with chosen inputs. Static analysis examines structure and data flows without that execution. The techniques complement each other: unit testsGlossary · In briefunit testA unit test is an automated test of a small, defined software component, usually isolated from external systems.Read more check specific behaviour, while static analysis brings other potential errors to light early. A code reviewGlossary · In briefcode reviewA code review is an assessment of a code change by another developer. They check its behaviour, readability, and maintainability, among other things, before the change is merged.Read more is still needed for decisions that a tool cannot assess from the code alone.