Static Analysis Testing

What it is

Static analysis examines source code without executing it. It is the cheapest test you can run: it is fast, deterministic, and catches whole categories of defects — type errors, unused code, unreachable branches, unsafe patterns — before a single test runs.

It sits at the base of the pyramid: every issue caught here is an issue you never need a unit or E2E test to find.

When to use it / when to avoid it

Use it always. Static analysis belongs in the editor, in a pre-commit hook and in CI. It is the first gate in every pipeline.

Tune, do not remove, when

Rules produce false positives → downgrade to warnings, or scope them
Legacy code cannot pass → ratchet (fail only on new violations), do not disable globally

Static analysis cannot check runtime behaviour, data-dependent logic, or integration contracts — those still need dynamic tests.

Frameworks & tools

Tool	Kind	Ecosystem
TypeScript (`tsc --noEmit`)	Type checker	JS/TS
mypy / pyright	Type checker	Python
ESLint	Linter	JS/TS
Biome	Linter + formatter	JS/TS
Ruff	Linter + formatter	Python
golangci-lint / `go vet`	Linter	Go
Error Prone / Checkstyle	Linter	Java
Roslyn analyzers	Linter	.NET
Clippy	Linter	Rust
SonarQube / SonarCloud	Quality platform	Multi-language
CodeQL	Semantic SAST	Multi-language
Semgrep	Pattern-based SAST	Multi-language
Bandit (Python), gosec (Go)	Security linters	per-language

Quick setup

1
npm install -D typescript eslint        # or: npm install -D @biomejs/biome
2
npx tsc --noEmit
3
npx eslint .

1
pip install mypy ruff
2
mypy src/
3
ruff check .

1
go vet ./...
2
golangci-lint run

1
<!-- Maven: run Checkstyle + Error Prone in the build -->
2
mvn -q checkstyle:check

1
dotnet build /p:TreatWarningsAsErrors=true
2
dotnet format --verify-no-changes

Example

1
// `tsc` flags this before any test runs:
2
function greet(name: string): string {
3
  return `Hello, ${name}`;
4
}
5
greet(42); // error TS2345: number is not assignable to string

1
def greet(name: str) -> str:
2
    return f"Hello, {name}"
3

4
greet(42)  # mypy: Argument 1 has incompatible type "int"

1
var n int = "x" // compile error: cannot use "x" as int

1
String s = 42; // compile error: incompatible types

1
int n = "x"; // error CS0029: cannot implicitly convert string to int

Anti-patterns & best practices

Run it in the editor and CI. Feedback must be immediate and mandatory.
Fail the build on errors. “We’ll fix it later” means never.
Ratchet, do not silence. # type: ignore, // @ts-ignore and // nolint should be rare and justified — never to make a red pipeline green.
Layer type checking and linting. They catch different classes of defects.
Add semantic SAST (CodeQL/Semgrep) for security-relevant code.