This repository contains the Ruff Python linter and formatter, along with the Ty Python type checker, both written in Rust. It is a monolith of several dozen crates assembled into a workspace, delivering a CLI tool, a Language Server Protocol (LSP) server, and a web playground. In production, Ruff analyzes Python source files against hundreds of lint rules from flake8, pylint, pyupgrade, and other plugins, formats code to be compatible with Black, and provides IDE features via LSP. Ty adds type checking and advanced IDE features like goto-definition and workspace symbols. The architecture is modular: a parser produces an AST, semantic analysis operates on that AST, lint rules are checked via pluggable visitors, formatting is done through an IR-based printer, and diagnostics are rendered in multiple formats (JSON, JUnit, SARIF, etc.). The LSP server reuses many of these components through a Salsa-based incremental database for caching. The repository is a model of how to structure a high-performance developer tool in Rust, with extensive test fixtures, fuzzing, and benchmarks. While primarily an application, it includes some data-like assets (test fixture corpora, ecosystem check scripts) but nothing that would classify it as a data research project.
Checkstyle is a production-grade Java static analysis library and CLI tool that enforces configurable coding standards. In operation, it reads Java source files (and related resources like property files, package-info, and HTML docs), parses them with an ANTLR-based Java and Javadoc grammar, builds a concrete syntax tree, and traverses it through a Checker/TreeWalker pipeline. Individual checks are modular and validate naming, whitespace, imports, Javadoc, coding practices, design, metrics, and more. Violations flow through configurable filters - including comment-based suppression, @SuppressWarnings, and XPath-based suppression - and are emitted by pluggable loggers for plain text, XML, or SARIF output. The project also ships a CLI for AST printing, XPath query generation, and suppression file generation, plus an Ant task integration.
ESLint is a mature, widely-used static analysis tool for JavaScript and TypeScript. It operates as both a CLI tool and a programmatic library, parsing source code into an AST and applying a configurable set of lint rules to detect and fix code quality, style, and correctness issues. The architecture is modular: a core linter (`lib/linter/linter.js`) orchestrates parsing (via espree or custom parsers), rule execution, and fix application; a configuration system (`lib/config/`) resolves flat config files; and a CLI engine (`lib/cli.js`) handles command-line invocation, file globbing, and result formatting. Key entry points include `bin/eslint.js` (CLI), `lib/api.js` (public API exposing `ESLint`, `Linter`, `RuleTester`, `SourceCode`), and `lib/universal.js` (browser-compatible Linter). Data flows: source files are read, parsed into ASTs, traversed by rule visitors, and lint messages are collected, filtered, and formatted. External dependencies include espree (parser), eslint-scope (scope analysis), eslint-visitor-keys, and various community utilities. The codebase is self-hosting, using its own rules and config for development, and includes extensive test suites, fuzzing tools, and ecosystem regression testing.
Bandit is a well-established Python security linter that performs static analysis by parsing source code into ASTs and running a configurable set of plugins against AST nodes. It is primarily a CLI tool, but also exposes a plugin architecture for custom checks and formatters via setuptools entry points. Key entry points include the main CLI (bandit.cli.main), baseline comparison utility (bandit.cli.baseline), and config generator (bandit.cli.config_generator). The core engine (bandit/core/manager.py, node_visitor.py, context.py) orchestrates file discovery, AST traversal, test execution, and result aggregation. It supports multiple output formats (JSON, SARIF, CSV, HTML, XML, YAML, text, screen) and integrates with CI/CD pipelines, pre-commit hooks, and Git via .bandit files. The project is actively maintained, supports Python 3.10+, and has extensive test coverage, though some legacy config conversion code and removed test IDs (e.g., B309, B320) indicate minor drift. Bandit is a reference implementation for a plugin-based security linter with a clean separation between core, plugins, and formatters.
reviewdog is a Go CLI that bridges linter output to code review platforms. It consumes diagnostic output from any linter or compiler via stdin in multiple formats — Vim errorformat, SARIF 2.1.0, Checkstyle XML, the project's own RDJSON/RDJSONL protobuf-defined format, or raw unified diff — parses it, filters findings against a code diff so only issues on changed lines get posted, and reports them to GitHub (check runs, PR reviews, annotations), GitLab MRs, Bitbucket, Gerrit, or Gitea, or writes them locally in text, RDJSON, or SARIF form. The core architecture is a set of loosely coupled Go packages: parser/ for format decoders, diff/ for unified diff parsing, filter/ for diff-aware result filtering, service/ for per-platform comment and diff API clients, cienv/ for CI context detection, and project/ for executing multi-runner .reviewdog.yml configs. The CLI entry point is cmd/reviewdog/main.go, with orchestration in reviewdog.go around the CommentService and DiffService interfaces; command flow is: subprocess or stdin -> parser -> ResultMap -> diff filter -> reporter service -> host-platform API.
gosec is a production-grade static analysis security scanner for Go source code. It analyzes Go programs by traversing the AST and SSA representations to detect a wide range of security vulnerabilities, including SQL injection, command injection, path traversal, cross-site scripting (XSS), hardcoded credentials, weak cryptography, TLS misconfigurations, and more. The tool is distributed as a CLI binary, a Docker image, a GitHub Action, and a reusable Go library. The architecture is modular: a core analysis engine loads Go packages, applies AST-based rules and SSA-based analyzers, and runs a configurable taint analysis engine that tracks data flow from user-controlled sources to dangerous sinks. Results are output in multiple formats (text, JSON, SARIF, CSV, JUnit, HTML, SonarQube, golint, YAML). The tool also integrates with AI providers (OpenAI, Claude, Gemini, Atlas) to suggest automated fixes for detected vulnerabilities. Notable design highlights include a generic LRU cache for regex matching, a path-based rule exclusion filter, a comprehensive CWE knowledge base, and a well-abstracted taint analysis configuration system. The codebase demonstrates strong engineering practices with extensive test coverage, performance benchmarks, and CI/CD pipelines for release and scanning.