This is the official Dart documentation generator (`dartdoc`), exposed as `dart doc` in the Dart SDK. It parses Dart source code using the `analyzer` package, builds an in-memory model of packages, libraries, classes, enums, extensions, mixins, typedefs, and their members, then generates static HTML documentation. The architecture is a CLI tool with a clear separation of concerns: source analysis (model layer), template rendering (Mustachio engine), and output generation (HTML backend). Key entry points are `bin/dartdoc.dart` and `lib/src/dartdoc.dart` (the `Dartdoc` class orchestrating generation). The system relies on a custom template engine called Mustachio, which pre-compiles Mustache templates into optimized Dart render functions via an AOT compiler, avoiding runtime reflection. The generated HTML includes a client-side JavaScript frontend (`docs.dart.js`) providing search, dark/light theme toggle, copy-to-clipboard, and sidebar navigation. Configuration is handled through `dartdoc_options.yaml` files and command-line arguments, with a hierarchical option system that supports per-package overrides. The codebase demonstrates strong engineering practices: extensive test coverage (unit, integration, and golden HTML tests), a structured warning/error system, canonicalization logic for re-exported elements, and support for advanced Dart features like records, macros, sealed classes, and null safety. Several components are cleanly isolated and reusable, including the Mustachio template engine, a generic async task queue, a terminal progress bar, and a configurable source link generator.
Syft is a production-grade CLI tool and Go library for generating Software Bills of Materials (SBOMs) from container images, filesystems, directories, and OCI artifacts. It detects and catalogs packages across 40+ ecosystems (Alpine, Debian, RPM, Python, Java, Go, Ruby, Rust, JavaScript, .NET, etc.) by parsing lockfiles, package databases, binary metadata, and source manifests. The tool outputs SBOMs in multiple formats including CycloneDX (JSON/XML), SPDX (JSON/tag-value), Syft JSON, and GitHub Dependency Snapshots, with version-aware encoding and decoding. Architecturally, Syft uses a modular cataloger system where each ecosystem implements a `generic.Cataloger` with parser functions registered by file globs or MIME types. A task-based pipeline orchestrates file indexing, package cataloging, dependency resolution, and relationship linking. The system supports both library integration via `syft.CreateSBOM()` and a CLI with cobra commands (`scan`, `attest`, `convert`, `cataloger`). A bubbletea-based TUI provides real-time progress feedback during image pulls and cataloging. External dependencies include `stereoscope` for container image access, `cosign` for attestation signing, and `go-partybus` for event-driven UI. Key entry points include `cmd/syft/main.go` (CLI), `syft/create_sbom.go` (library API), `syft/get_source.go` (source resolution), and the format encoders/decoders in `syft/format/`. The codebase demonstrates strong engineering practices: extensive test coverage (unit, integration, snapshot), CI/CD with GitHub Actions, auto-generated JSON schemas, and drift-check scripts for capabilities and schema. Notable reusable components include the generic cataloger framework, the dependency resolver, and the file resolver abstraction.
Vulture is a fast static analysis tool for finding unused code in Python programs. It uses the AST module to scan Python files, recording definitions and usages of functions, classes, variables, imports, and attributes, then reports those that are defined but never used. It also detects unreachable code after return, break, continue, raise, and unsatisfiable if/while conditions. The tool is implemented as a library (Vulture class) and a CLI entry point. It supports configuration via pyproject.toml, whitelists to suppress false positives, and noqa comment support. The architecture is modular with separate modules for reachability analysis, noqa parsing, line number utilities, and configuration handling. The codebase is well-tested, with near 100% coverage, and is actively maintained.
The php-ast repository is a PHP extension that exposes the internal Abstract Syntax Tree (AST) used by PHP 7 and 8. It provides functions to parse PHP code into an inspectable AST structure that mirrors PHP's internal compiler representation, enabling static analysis, code transformation, refactoring tools, and other metaprogramming tasks. Unlike pure-PHP AST parsers, this extension leverages PHP's own parser for maximum performance and accuracy. The extension implements a sophisticated versioning system to maintain compatibility across PHP releases. Rather than breaking when PHP introduces new language features, it defines AST versions (currently 50 through 120) and can represent newer constructs using older node types when necessary for backward compatibility. This allows developers to write analysis tools that work across multiple PHP versions without constantly updating for each new release. Key architectural components include the C-based extension core that interfaces with Zend's parser, a comprehensive metadata system describing node kinds and their associated flags, and utility functions for AST inspection. The extension handles the full PHP grammar including recent additions like attributes, match expressions, nullsafe operators, constructor property promotion, and enum support. In production use, this extension serves as the foundation for many PHP static analysis tools, enabling them to operate with near-native performance by avoiding the overhead of pure-PHP parsing while providing a stable, versioned interface to PHP's AST structure.
This repository contains Roslyn diagnostic analyzers and code fix providers for the xUnit.net test framework (v2 and v3, including Native AOT). It enforces best practices, detects common anti-patterns (e.g., misuse of Assert methods, serialization issues with theory data, incorrect async handling, and structural problems in test classes), and provides automated code fixes. The codebase is organized around version-aware context classes (XunitContext) that resolve xUnit types and version-specific behavior, allowing a single analyzer to target multiple xUnit versions. It includes a rich test suite using a custom CSharpVerifier base class, building on Microsoft.CodeAnalysis.Testing. The infrastructure is well-abstracted with reusable base classes for analyzers, suppressors, and fix providers, and the project is packaged as a NuGet package automatically referenced by xUnit projects.
This repository is a pnpm monorepo for @stylistic/eslint-plugin, a community-maintained ESLint plugin that provides formatting and stylistic rules for JavaScript, TypeScript, JSX, and related syntaxes. It ports formatting rules that were deprecated or removed from ESLint core and typescript-eslint, giving users a drop-in path to continue enforcing style conventions. The main deliverable is an npm library consumed through ESLint flat config; there is no server, database, or runtime application. The plugin exposes roughly a hundred rules, each with typed options, autofix support, parser-specific test coverage, and generated metadata and type declarations.
Sqlvet is a static analysis CLI tool for Go projects that scans raw SQL queries embedded in Go source code to detect potential runtime errors at build time. It uses Go's SSA (Static Single Assignment) representation and call graph analysis to trace SQL query strings through function calls, handling common patterns like string concatenation, functions returning query strings, and pass-through functions like sqlx.Rebind. Extracted queries are parsed with a PostgreSQL grammar (via pg_query_go) to validate syntax, table/column names against a schema, and detect unsafe dynamic SQL that could lead to injection. The tool supports custom SQL function matchers via TOML configuration, allowing users to extend analysis to their own wrapper libraries. The architecture is a single Go binary with modular packages for configuration, schema parsing, query extraction, and SQL validation, with comprehensive test coverage including integration tests using real Go packages.
CoBRA is a C++ library and CLI tool for simplifying mixed Boolean-arithmetic (MBA) expressions, commonly used in software obfuscation. It ingests expressions combining arithmetic (+, -, *) with bitwise (&, |, ^, ~) and shift operators and outputs a simplified equivalent form. The core engine uses a worklist orchestrator that coordinates 36+ passes, including signature-based transforms (CoB butterfly, ANF recovery), semilinear normalization with bit partitioning, decomposition (product, polynomial, template cores), ghost residual solving, and pattern matching. An optional Z3 verifier proves full-width equivalence. The tool can be used as a standalone CLI (`cobra-cli`), as an LLVM pass for automatic deobfuscation during compilation, or as a library (`cobra::Simplify()`). The codebase is well-structured with extensive test coverage (1195+ tests) and benchmark datasets from multiple research projects. While the core is tightly coupled internally, several generic utilities (Result type, profiling stubs, math helpers) are reusable independently.
This repository is an ESLint plugin for the Vitest testing framework, providing over 60 lint rules to enforce best practices, catch common errors, and maintain code style in test files. It is a library consumed by ESLint, not a standalone application. The plugin exports a flat config (recommended, all) and an environment configuration for Vitest globals. The codebase is well-structured with a consistent rule creation pattern using a factory utility (`createEslintRule`), centralized Vitest function call parsing (`parseVitestFnCall`), and a reusable padding rule factory (`createPaddingRule`). It relies on `@typescript-eslint/utils` for AST analysis and is designed for ESLint v9+ with flat config. The project is actively maintained with CI/CD, automated releases, and comprehensive test coverage for each rule.
CodeGraph is a Python command-line tool that performs static analysis on Python source code to generate dependency graphs. It parses Python files to extract functions, classes, and import statements, then builds a graph showing how these entities depend on each other. The tool outputs an interactive HTML visualization (using D3.js by default) or can export the data to CSV or print it to the console. The architecture is modular, consisting of a parser (using Python's tokenize module), a core module that builds the dependency graph, utility functions for file discovery, and a visualizer that supports both D3.js (interactive) and matplotlib (legacy) backends. The tool does not execute the code being analyzed, making it safe and fast for large codebases. Key strengths include a robust parser that handles various import styles and class inheritance, and a flexible visualization system that provides features like search, collapsing/expanding nodes, and detailed tooltips. The project is actively maintained with comprehensive tests and supports multiple Python versions.
ImHex is a cross-platform hex editor and binary analysis tool designed for reverse engineers, programmers, and digital forensics. It provides a rich GUI built on Dear ImGui and GLFW, with a modular plugin architecture that allows extending functionality through dynamically loaded plugins. The core library (libimhex) implements a provider abstraction for various data sources (files, disks, process memory, GDB, SSH, UDP, etc.), an event-driven communication system, a content registry for registering views, tools, settings, and data inspectors, and a pattern language engine for declarative binary parsing. The application includes built-in plugins for hex editing, data inspection, disassembly (Capstone), diffing, YARA rule matching, hashing, decompression, visualizations (3D, plots, images), scripting (C and .NET), and a Model Context Protocol (MCP) server for AI-assisted analysis. It supports undo/redo, bookmarks, patches, projects, themes, layouts, achievements, tutorials, and a command palette. The codebase is well-structured with clear separation between core library, plugins, and platform-specific code, though some components are tightly coupled to ImGui internals and the custom pattern language.
phpDocumentor/TypeResolver is a PHP library that parses PHPDoc type expressions (PSR-5) and resolves them into an object-oriented type system. It provides two main resolvers: TypeResolver, which converts a type string like 'string|int[]' into a tree of Type value objects (e.g., Compound, Array_, String_), and FqsenResolver, which resolves relative Fully Qualified Structural Element Names (FQSENs) to absolute ones using namespace context. The library leverages phpstan/phpdoc-parser for tokenizing and parsing the type syntax, then maps the AST to its own immutable type hierarchy. A ContextFactory extracts namespace and use-import information from PHP source code via token_get_all, enabling accurate resolution of relative class names. The type system covers primitives, compound types (unions, intersections), generics, callable signatures, array shapes, conditional types, integer ranges, and many pseudo-types (class-string, numeric, etc.). The library is a foundational component for phpDocumentor and other static analysis tools.
Spoon is a comprehensive, open-source Java library for source code analysis, transformation, and generation. Developed at INRIA, it provides a complete AST metamodel covering all modern Java constructs (up to Java 25), along with powerful APIs for pattern matching, template-based code generation, static dataflow analysis (with Z3 integration), control flow graph construction, Javadoc parsing, and decompilation. The architecture is modular with submodules for specific tasks (e.g., spoon-dataflow, spoon-smpl for semantic patches, spoon-visualisation). Spoon is used both as a research platform for program analysis and as a practical tool for building custom code transformations, linters, and refactoring tools. The codebase demonstrates high engineering quality with clean separation of interfaces and implementations, extensive use of visitor and factory patterns, and a sophisticated query API.
Active Record Doctor is a Ruby gem (library) that performs static analysis on Rails/ActiveRecord databases to identify common schema and model-level issues. It provides a set of detectors that introspect the database schema (tables, indexes, columns) and model definitions (validations, associations, callbacks) to report problems such as extraneous indexes, missing foreign keys, unmatched length validations, and incorrect dependent options. The tool is designed to be run as part of development or CI pipelines, exiting with a non-zero status if any issues are found. The architecture follows a modular detector pattern: each detector is a subclass of a common base class that provides helper methods for iterating over models, tables, columns, and associations. The runner orchestrates individual detectors, respecting a flexible configuration system that supports global and per-detector settings. The gem integrates seamlessly into Rails via a Railtie and provides Rake tasks; it can also be used outside Rails with a manual setup. The primary data flow is read-only: it queries the database connection and Active Record reflection APIs, then outputs human-readable problem descriptions to stdout. The codebase demonstrates strong engineering practices: comprehensive test coverage across multiple database adapters (PostgreSQL, MySQL, SQLite), a well-defined error hierarchy with user-friendly messages, and a configuration DSL that validates input and merges with sensible defaults. The gem is actively maintained, supports recent Rails versions (7.0–8.0), and has a dedicated community (1900+ stars, 31 open issues, 68 forks).
DexKit is a high-performance C++ library for runtime parsing and querying of Android DEX bytecode, primarily used by Xposed module developers to locate obfuscated classes, methods, and fields. It provides a rich DSL in Kotlin/Java for constructing structural queries based on annotations, opcodes, string usage, field/method references, and more. The core engine parses DEX files from APK archives, builds in-memory indexes, and uses algorithms like Aho-Corasick for substring matching and the Hungarian algorithm for unordered set matching. Communication between the native C++ layer and JVM is handled via FlatBuffers serialization. The library also includes an optional caching layer (`DexKitCacheBridge`) for persisting query results across app restarts. It is distributed as an Android AAR via Maven Central and includes a demo app and unit tests.
Excellent Migrations is an Elixir library that analyzes Ecto migration files to detect potentially dangerous database operations that could cause downtime or data loss. It provides a Credo check, Mix tasks, and direct API usage to identify issues such as adding columns with default values, removing columns, running raw SQL, and more. The tool allows marking operations as safe via special comments or configuration to avoid false positives. The architecture is centered around AST parsing of migration files, with separate modules for detecting dangers, parsing safety comments, and filtering results. Key components like the AST parser and comment parser are well-crafted and reusable in other contexts.
GPTLint is a linting tool that uses Large Language Models (LLMs) to enforce code quality rules. It employs a two-pass approach: a faster, cheaper LLM model identifies potential violations, and a more accurate, expensive model validates them to reduce false positives. The tool supports both built-in and custom rules defined in markdown files, caches results to avoid reprocessing unchanged files, and provides both a CLI and programmatic API. The architecture is modular, with separate components for configuration, rule parsing, linting, caching, and LLM abstraction.
pg-index-health is an embeddable Java library and schema linter for PostgreSQL that detects common database anti-patterns and promotes best practices. It provides over 40 diagnostic checks covering duplicated/intersected indexes, bloat, missing indexes, inappropriate column types, naming violations, unlogged tables, sequence overflow, and many more. The library is designed for integration into applications (via Spring Boot starter) or use in CI pipelines to enforce schema quality. It supports both single-host and high-availability PostgreSQL clusters, with checks that can run statically (against schema only) or require accumulated statistics. The architecture is a multi-module Gradle project: `pg-index-health-model` defines immutable domain objects (Table, Index, Column, ForeignKey, etc.) with validation and composable predicates; `pg-index-health-core` implements host-level checks using a template pattern (`AbstractCheckOnHost`) with SQL queries loaded from a separate submodule; `pg-index-health` wraps these into cluster-level checks (`AbstractCheckOnCluster`) that aggregate results across primary and standby nodes; `pg-index-health-jdbc-connection` provides connection factories with primary host detection and multi-host URL parsing; `pg-index-health-generator` produces corrective SQL migrations; `pg-index-health-logger` formats results; and `pg-index-health-testing` offers Testcontainers-based test fixtures. Optional Jackson 2/3 modules enable JSON serialization of results. Key entry points include `StandardChecksOnHost` and `StandardChecksOnCluster` which enumerate all available checks, and the Spring Boot auto-configuration (`DatabaseStructureHealthAutoConfiguration`) that registers check beans. Data flows involve querying PostgreSQL system catalogs (`pg_catalog`, `pg_stat_*`), mapping result sets to domain objects via `ResultSetExtractor` implementations, applying exclusion predicates (e.g., skip Flyway/Liquibase tables, small tables, named objects), and returning lists of deviations. External dependencies are minimal: PostgreSQL JDBC driver, Apache DBCP2 connection pool, and Testcontainers for testing. The library is published to Maven Central and includes a BOM for dependency management.
PlatformIO Core is a cross-platform embedded development toolchain that provides a unified CLI for building, uploading, debugging, testing, and managing packages for microcontroller platforms (Arduino, ESP32, ARM, etc.). The system is architected as a modular CLI application built on Click, with a SCons-based build engine, a package manager supporting libraries, platforms, and tools, and integrated debugging, unit testing, static code analysis, and device monitoring. Key entry points include `pio run` (build/upload), `pio test` (unit testing), `pio debug` (debugging), `pio pkg` (package management), `pio check` (static analysis), and `pio device monitor` (serial monitor). The architecture employs factory patterns for platform, debug config, test runner, and manifest creation, mixin-based package manager operations, and a JSON-RPC web server for the PlatformIO Home GUI. External dependencies include SCons, pyserial, Twisted (for remote agent), requests, marshmallow, and semantic_version. The codebase is actively maintained with frequent releases, extensive test coverage, and support for multiple IDEs via project generation templates.
eslint-plugin-project-structure is a TypeScript-based ESLint plugin that enforces scalable, consistent project architecture through three configurable rules: folder-structure enforcement, file-composition constraints (e.g., `**/*.consts.ts` may only contain variables, `**/*.types.ts` only interfaces/types), and independent-modules enforcement to prevent massive dependency trees. The plugin parses all import syntaxes — ESM, CJS, dynamic `import()`, `require()`, `jest.mock()`, `jest.requireActual()`, plus `ExportAllDeclaration`/`ExportNamedDeclaration` — and validates file paths against micromatch glob patterns. Configuration is provided via JSON files validated against a bundled JSON schema, enabling IDE autocompletion and early error detection. The codebase is a standard ESLint plugin library: rules receive AST nodes and report violations, with utility modules handling import classification, cross-platform path resolution (Windows/POSIX), and multi-pattern glob matching. It is distributed as compiled CommonJS (`dist/index.js`) with a self-referencing dev dependency for integration testing. The project ships with comprehensive tests covering edge cases like Windows paths, `@types/` scoped packages, and external-import detection, plus CI running type checks, format checks, lint, and tests via Yarn 3.6.3.