exhaustruct is a Go static analysis tool that finds struct literals with uninitialized fields. It operates as a standalone CLI tool or as an integrated linter within golangci-lint. The analyzer inspects all composite literals in Go source code, resolves their types using go/types, and reports missing field initializations based on configurable rules: comment directives (//exhaustruct:optional, :ignore, :enforce), regex patterns for type inclusion/exclusion, and various flags for allowing empty literals in specific contexts (returns, declarations, blank assignments). It supports both implicit (check all) and explicit (opt-in) modes, and provides automatic migration from deprecated struct tags to comment directives. The architecture is modular and highly crafted: the analyzer package orchestrates inspection, while internal packages handle caching, pattern matching, directive scanning, AST file parsing with correct handling of //line directives, and struct metadata resolution with promotion indexing for composite literals that name promoted fields (Go 1.27+). The codebase demonstrates exceptional attention to edge cases: concurrent access to shared caches, type parameter constraint resolution for generic structs, proper handling of embedded fields across packages, version-gated promotion resolution, and robust diagnostic generation with suggested fixes for tag migration. The implementation is production-ready with comprehensive test coverage including benchmarks, race detection, and dogfooding (running exhaustruct on its own code). The internal cache package provides a generic GetOrSet with once-only computation semantics that could be reused in other projects, and the pattern list offers full-string matching with alternation-aware longest match. The code is well-documented, with clear separation of concerns and thorough testing of all directive combinations and edge cases.
Checkstyle is a production-grade Java static analysis library and CLI tool that enforces configurable coding standards. In operation, it reads Java source files (and related resources like property files, package-info, and HTML docs), parses them with an ANTLR-based Java and Javadoc grammar, builds a concrete syntax tree, and traverses it through a Checker/TreeWalker pipeline. Individual checks are modular and validate naming, whitespace, imports, Javadoc, coding practices, design, metrics, and more. Violations flow through configurable filters - including comment-based suppression, @SuppressWarnings, and XPath-based suppression - and are emitted by pluggable loggers for plain text, XML, or SARIF output. The project also ships a CLI for AST printing, XPath query generation, and suppression file generation, plus an Ant task integration.
ESLint is a mature, widely-used static analysis tool for JavaScript and TypeScript. It operates as both a CLI tool and a programmatic library, parsing source code into an AST and applying a configurable set of lint rules to detect and fix code quality, style, and correctness issues. The architecture is modular: a core linter (`lib/linter/linter.js`) orchestrates parsing (via espree or custom parsers), rule execution, and fix application; a configuration system (`lib/config/`) resolves flat config files; and a CLI engine (`lib/cli.js`) handles command-line invocation, file globbing, and result formatting. Key entry points include `bin/eslint.js` (CLI), `lib/api.js` (public API exposing `ESLint`, `Linter`, `RuleTester`, `SourceCode`), and `lib/universal.js` (browser-compatible Linter). Data flows: source files are read, parsed into ASTs, traversed by rule visitors, and lint messages are collected, filtered, and formatted. External dependencies include espree (parser), eslint-scope (scope analysis), eslint-visitor-keys, and various community utilities. The codebase is self-hosting, using its own rules and config for development, and includes extensive test suites, fuzzing tools, and ecosystem regression testing.
eslint-plugin-vue is an ESLint plugin specifically designed for linting Vue.js single-file components (SFCs). It provides over 100 rules covering template syntax, script setup, Options API, Composition API, and Vue-specific best practices. The architecture follows standard ESLint plugin patterns with rule implementations in lib/rules/, shareable configurations in lib/configs/ (both legacy and Flat Config formats), and a processor for handling .vue files. Key entry points include the main plugin export (lib/index.ts), the processor (lib/processor.ts), and utility modules (lib/utils/) that provide AST traversal helpers, scope analysis, and component introspection. The plugin relies on peer dependencies eslint and vue-eslint-parser, with optional TypeScript support via @typescript-eslint/parser. It demonstrates strong craftsmanship through well-tested rules, comprehensive documentation, and active maintenance for both Vue 2 and Vue 3 ecosystems.
Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
include-what-you-use (IWYU) is a Clang-based static analysis tool for C/C++ that enforces minimal and correct `#include` directives. It analyzes every symbol used in a translation unit and ensures that the file directly includes the header that provides that symbol, suggesting removal of unused includes and addition of missing ones. The tool is designed for integration into build systems (e.g., CMake, Make, or via a compilation database driver) and can generate automatic fixes through its companion script `fix_includes.py`. The architecture is a pipeline: the Clang preprocessor and AST callbacks (`IwyuPreprocessorInfo`, `IwyuAstConsumer`) track macro expansions, symbol references, and template instantiations. A core component is the `IncludePicker` which maintains a large built-in map of symbol-to-header and private-to-public header mappings (for libc, libstdc++, libc++, Clang builtins) and supports user-supplied mapping files in YAML/JSON format. The analysis output is structured text that `fix_includes.py` parses to rewrite source files. The codebase is thoroughly tested with hundreds of small regression tests and a large monolithic test (`badinc.cc`), plus unit tests for internal utilities. IWYU is tightly coupled to Clang's AST and preprocessor APIs, requiring regular updates to track Clang mainline. Despite this, the project maintains a sophisticated handling of C++ complexities: templates, alias templates, forward declarations, macros, inline namespaces, and pragmas for manual override. The mapping system is extensible and includes generators for popular libraries (Boost, Qt, Python, Windows SDK). The tool is mature enough for production use in large codebases, though it acknowledges some known limitations (marked as `IWYU_XFAIL` tests).
reviewdog is a Go CLI that bridges linter output to code review platforms. It consumes diagnostic output from any linter or compiler via stdin in multiple formats — Vim errorformat, SARIF 2.1.0, Checkstyle XML, the project's own RDJSON/RDJSONL protobuf-defined format, or raw unified diff — parses it, filters findings against a code diff so only issues on changed lines get posted, and reports them to GitHub (check runs, PR reviews, annotations), GitLab MRs, Bitbucket, Gerrit, or Gitea, or writes them locally in text, RDJSON, or SARIF form. The core architecture is a set of loosely coupled Go packages: parser/ for format decoders, diff/ for unified diff parsing, filter/ for diff-aware result filtering, service/ for per-platform comment and diff API clients, cienv/ for CI context detection, and project/ for executing multi-runner .reviewdog.yml configs. The CLI entry point is cmd/reviewdog/main.go, with orchestration in reviewdog.go around the CommentService and DiffService interfaces; command flow is: subprocess or stdin -> parser -> ResultMap -> diff filter -> reporter service -> host-platform API.
Vulture is a fast static analysis tool for finding unused code in Python programs. It uses the AST module to scan Python files, recording definitions and usages of functions, classes, variables, imports, and attributes, then reports those that are defined but never used. It also detects unreachable code after return, break, continue, raise, and unsatisfiable if/while conditions. The tool is implemented as a library (Vulture class) and a CLI entry point. It supports configuration via pyproject.toml, whitelists to suppress false positives, and noqa comment support. The architecture is modular with separate modules for reachability analysis, noqa parsing, line number utilities, and configuration handling. The codebase is well-tested, with near 100% coverage, and is actively maintained.
This is an ESLint plugin (`eslint-plugin-functional`) that enforces functional programming patterns in JavaScript and TypeScript code. It provides 20 actively maintained rules targeting immutability, functional parameters, no classes, no exceptions, no statements, and other FP principles. The plugin deeply integrates with TypeScript's type system via `@typescript-eslint/utils` and libraries like `is-immutable-type` for type-aware immutability checks. It offers multiple configuration presets (strict, recommended, lite, etc.) and supports ESLint 9 and 10 flat configs. The codebase is well-structured with a consistent rule factory (`createRule`), shared utilities (type guards, option overrides), and an extensive test suite using snapshot testing. It is actively maintained with frequent releases, a comprehensive CI pipeline, and semantic versioning.
Sqlvet is a static analysis CLI tool for Go projects that scans raw SQL queries embedded in Go source code to detect potential runtime errors at build time. It uses Go's SSA (Static Single Assignment) representation and call graph analysis to trace SQL query strings through function calls, handling common patterns like string concatenation, functions returning query strings, and pass-through functions like sqlx.Rebind. Extracted queries are parsed with a PostgreSQL grammar (via pg_query_go) to validate syntax, table/column names against a schema, and detect unsafe dynamic SQL that could lead to injection. The tool supports custom SQL function matchers via TOML configuration, allowing users to extend analysis to their own wrapper libraries. The architecture is a single Go binary with modular packages for configuration, schema parsing, query extraction, and SQL validation, with comprehensive test coverage including integration tests using real Go packages.
This is a production-grade, AI-powered code review automation tool that integrates with multiple version control systems (GitHub, GitLab, Bitbucket Cloud/Server, Azure DevOps, Gitea) and multiple LLM providers (OpenAI, Claude, Gemini, Ollama, Bedrock, OpenRouter, Azure OpenAI). The system is implemented as a Python async CLI application, packaged as a Docker image, and includes CI/CD integration templates for GitHub Actions, GitLab CI, Jenkins, Bitbucket Pipelines, and Azure Pipelines. Architecturally, it follows a clean layered design: a CLI layer (Typer) drives commands; a configuration layer (Pydantic Settings with multiple file/env sources) manages nested settings for LLM, VCS, agent, review, artifacts, and logging; a service layer orchestrates the review process through runners, gateways, and internal services (prompt building, diff analysis, policy enforcement, cost tracking, artifact persistence); and a client layer provides unified abstractions for VCS and LLM providers with provider-specific implementations. The tool supports multiple review modes: inline comments on specific code lines, summary comments on the entire PR, context review (full repository exploration via an optional agent loop), and reply to existing comments. The agent loop uses a ReAct pattern with tool execution (shell commands like `rg`, `cat`, `git`) to gather deeper context, with duplicate detection and context limits. A dry-run mode allows testing without posting to VCS. The system also includes a hook service for lifecycle events, cost tracking per request, and optional artifact saving of LLM interactions. Key strengths include extensive test coverage (unit tests with fake clients and fixtures), generic reusable components (HTTP client with retry, pagination helpers, diff parser, LLM output JSON parser, cost service), and a well-structured configuration system that supports discriminated unions for provider-specific settings. The codebase is actively maintained, uses modern Python async patterns, and demonstrates high craftsmanship in its abstraction layers and separation of concerns.
This repository implements the official VS Code ESLint extension, which integrates ESLint into the editor via the Language Server Protocol (LSP). The extension is structured as a client-server architecture: the client (`client/`) handles VS Code activation, settings, and UI interactions, while the server (`server/`) runs the actual ESLint validation, computes diagnostics, code actions, and formatting. The shared module (`$shared/`) defines protocol messages and settings types used by both sides. The system dynamically loads the ESLint library from the user's workspace and supports both legacy ESLintrc and modern flat config formats. It provides real-time linting on type or save, auto-fix on save, formatting, rule customization, bulk suppression, and workspace-level task integration. The codebase is well-engineered with clean abstractions for settings resolution, module loading, error handling, and diff computation. It includes standalone reusable components such as an LCS diff algorithm, a linked map with LRU cache, and path normalization utilities.
GPTLint is a linting tool that uses Large Language Models (LLMs) to enforce code quality rules. It employs a two-pass approach: a faster, cheaper LLM model identifies potential violations, and a more accurate, expensive model validates them to reduce false positives. The tool supports both built-in and custom rules defined in markdown files, caches results to avoid reprocessing unchanged files, and provides both a CLI and programmatic API. The architecture is modular, with separate components for configuration, rule parsing, linting, caching, and LLM abstraction.
pg-index-health is an embeddable Java library and schema linter for PostgreSQL that detects common database anti-patterns and promotes best practices. It provides over 40 diagnostic checks covering duplicated/intersected indexes, bloat, missing indexes, inappropriate column types, naming violations, unlogged tables, sequence overflow, and many more. The library is designed for integration into applications (via Spring Boot starter) or use in CI pipelines to enforce schema quality. It supports both single-host and high-availability PostgreSQL clusters, with checks that can run statically (against schema only) or require accumulated statistics. The architecture is a multi-module Gradle project: `pg-index-health-model` defines immutable domain objects (Table, Index, Column, ForeignKey, etc.) with validation and composable predicates; `pg-index-health-core` implements host-level checks using a template pattern (`AbstractCheckOnHost`) with SQL queries loaded from a separate submodule; `pg-index-health` wraps these into cluster-level checks (`AbstractCheckOnCluster`) that aggregate results across primary and standby nodes; `pg-index-health-jdbc-connection` provides connection factories with primary host detection and multi-host URL parsing; `pg-index-health-generator` produces corrective SQL migrations; `pg-index-health-logger` formats results; and `pg-index-health-testing` offers Testcontainers-based test fixtures. Optional Jackson 2/3 modules enable JSON serialization of results. Key entry points include `StandardChecksOnHost` and `StandardChecksOnCluster` which enumerate all available checks, and the Spring Boot auto-configuration (`DatabaseStructureHealthAutoConfiguration`) that registers check beans. Data flows involve querying PostgreSQL system catalogs (`pg_catalog`, `pg_stat_*`), mapping result sets to domain objects via `ResultSetExtractor` implementations, applying exclusion predicates (e.g., skip Flyway/Liquibase tables, small tables, named objects), and returning lists of deviations. External dependencies are minimal: PostgreSQL JDBC driver, Apache DBCP2 connection pool, and Testcontainers for testing. The library is published to Maven Central and includes a BOM for dependency management.
eslint-plugin-project-structure is a TypeScript-based ESLint plugin that enforces scalable, consistent project architecture through three configurable rules: folder-structure enforcement, file-composition constraints (e.g., `**/*.consts.ts` may only contain variables, `**/*.types.ts` only interfaces/types), and independent-modules enforcement to prevent massive dependency trees. The plugin parses all import syntaxes — ESM, CJS, dynamic `import()`, `require()`, `jest.mock()`, `jest.requireActual()`, plus `ExportAllDeclaration`/`ExportNamedDeclaration` — and validates file paths against micromatch glob patterns. Configuration is provided via JSON files validated against a bundled JSON schema, enabling IDE autocompletion and early error detection. The codebase is a standard ESLint plugin library: rules receive AST nodes and report violations, with utility modules handling import classification, cross-platform path resolution (Windows/POSIX), and multi-pattern glob matching. It is distributed as compiled CommonJS (`dist/index.js`) with a self-referencing dev dependency for integration testing. The project ships with comprehensive tests covering edge cases like Windows paths, `@types/` scoped packages, and external-import detection, plus CI running type checks, format checks, lint, and tests via Yarn 3.6.3.
Flog is a Ruby code complexity analyzer that calculates an ABC (assignments, branches, conditionals) complexity metric with Ruby-specific enhancements. It processes Ruby source files to identify complex/tortured code that is difficult to test and maintain. The system consists of a core Flog library that performs the analysis, a CLI interface for command-line usage, a Rake task for integration with build systems, and a plugin system for extensibility. The architecture cleanly separates concerns: the Flog class handles AST processing and scoring, FlogCLI manages option parsing and file discovery, and FlogTask provides Rake integration. Recent versions have switched to using the prism parser for improved performance while maintaining backward compatibility with a --legacy flag for RubyParser.
This repository contains the official Helm charts for deploying SonarQube on Kubernetes, maintained by SonarSource. It provides two charts: `sonarqube` for standard (Community/Developer/Enterprise) deployments and `sonarqube-dce` for Data Center Edition with clustered search and application nodes. The charts are production-grade, supporting a wide range of Kubernetes features including StatefulSets, Deployments, Ingress, NetworkPolicies, PodDisruptionBudgets, Prometheus monitoring, Istio service mesh with strict mTLS, OpenShift integration, and autoscaling via HPA and KEDA. A distinguishing feature is the agentic AI subsystem: the charts deploy an orchestrator, hunter, and remediation agent runtimes, a Squid-based egress proxy for sandboxed runtime isolation, gVisor/Kata sandboxing, and an HKDF-based key derivation hook for secure inter-component communication. The repository also includes integrations for Azure and Google Cloud marketplaces, comprehensive CI/CD pipelines (build, sign, publish, compatibility tests), and migration scripts for PostgreSQL and ingress-nginx to Gateway API/Istio. The codebase demonstrates high craftsmanship in Helm template design, with extensive validation, test fixtures, and golden-file tests covering hundreds of configuration permutations.
This repository provides a collection of Claude Code plugins designed to enhance AI-assisted development workflows. It consists of four specialized utilities: deslop for removing AI-generated code artifacts, dig for conducting deep exploratory interviews to clarify plans, fix-ci for automatically diagnosing and resolving CI failures, and decomposition for breaking down complex tasks into detailed, actionable todos. Each plugin implements sophisticated patterns for improving developer productivity when working with AI assistants. The system follows a modular architecture where each plugin is self-contained with its own command implementation, skill definitions, and metadata. Plugins can be installed via Claude Code's plugin marketplace system and integrate directly into the AI assistant's workflow. The plugins leverage Claude Code's built-in tools (Read, Edit, Write, Bash, etc.) to interact with the development environment, analyze code, and make targeted improvements. Rather than being a monolithic application, it offers composable tools that address specific pain points in AI-assisted development.
This is a GitHub Action that parses JaCoCo XML coverage reports and posts a formatted coverage summary as a comment on pull requests. It supports single and multi-module projects, aggregate reports, multiple counter types (INSTRUCTION, BRANCH, LINE, COMPLEXITY, METHOD), custom emojis, and comment update strategies. The action fetches the list of changed files from the PR via the GitHub API, computes overall and per-file coverage percentages, and renders a markdown table with pass/fail indicators based on configurable thresholds. The codebase is written in TypeScript, well-structured with clear separation of concerns (action orchestration, XML parsing, coverage computation, markdown rendering), and includes a comprehensive test suite with fixtures covering various report structures and edge cases.
A Visual Studio extension (VSIX) that integrates SonarQube/SonarCloud static analysis into the IDE. It provides real-time code quality and security analysis for C#, VB.NET, C/C++, JavaScript/TypeScript, CSS, and other languages via an embedded SLCore backend (Java process) and a separate Roslyn analyzer server for .NET. The extension supports both standalone analysis and 'connected mode' that binds to SonarQube/SonarCloud servers, including project binding, credential management, issue visualization with flows and locations, security hotspots, taint vulnerabilities, dependency risks, quick fixes, rule education (HTML-to-XAML rendering), and telemetry. The architecture is modular, heavily relying on MEF for dependency injection, with distinct assemblies for core abstractions, VS integration, connected mode UI, issue visualization, security-specific features, and education. The codebase is well-tested with extensive unit tests and some integration tests, but shows signs of ongoing migration from legacy binding models to a modern SLCore-based protocol, resulting in some technical debt and backward-compatibility code.