Table of Contents

Are you tired of chasing bugs in your python code? If you are, then you are in the right place! Yes, this article is your complete guide about harnessing the power of static code analysis tools and how they can greatly amplify your productivity by finding errors before running the code. This blog post will walk you through the power of Static Code Analysis and how to set it up in your favorite editor.

In this blog, we will explore the concept of Static Code Analysis and its importance in modern software development. We’ll dive into how it helps identify potential issues in your code without execution, differentiate static analysis from linters and then guide you through setting up popular Python static analysis tools like Flake8, Mypy, and Pyright within different code editors such as VS Code, Sublime Text, and Neovim, ensuring a smoother development workflow and more reliable code.

What is Static Code Analysis?

Static analysis or Static Code Analysis is a type of code analysis that examines code without executing it. In static code analysis we have the entire code available for the analysis of issues and bugs. Static analysis can help you (developers) identify potential issues before they occur, making code more reliable and secure.

Unlike dynamic analysis, which is all about running your code and seeing what happens (like watching its behavior in real-time), static analysis just looks at the code itself. It’s like reading the blueprint of a building to find flaws in the design, instead of waiting for the building to be built and then testing if it stands up to an earthquake. Static analysis inspects the codebase to detect potential issues such as security vulnerabilities, coding standard violations, and logical errors.

Why is Static Code Analysis So Important?

As already said before, Static Analysis plays a very important role in Modern Software Development for several reasons. Let’s go through them in detail for clarity:

Catch Bugs Early (Like, Really Early): It helps catch issues in the early stages of development. This saves you a ton of time and frustration later on when you’re trying to debug something complex.
Security Improvements: Detects security flaws like SQL injection (nasty stuff!), buffer overflows, type mismatch, and unsafe function calls that are known to be unsafe. Finding these issues before your code is out in the wild means you can fix them before they become serious security holes that could be used by someone as exploitable vulnerabilities.
Enforces Coding Standards: Ensures adherence to style guides and best practices, leading to more maintainable and readable code.
Faster Development Cycles: Reduces the number of defects that need to be addressed during later testing phases.

Are Linters and Static Analysis Tools the Same?

Linters and static analysis tools have overlapping functionality, but they are not exactly the same! This is a common point of confusion. Yes, linting is a type of static code analysis, but linters primarily focus on enforcing coding style and syntax rules. They only check for formatting inconsistencies, code smells, unused variables, or stylistic deviations from the established best practices.

You might be familiar with tools like ESLint for JavaScript. Those are linters, and they’re a type of static analysis tools, but they’re not the whole story.

While linting is a type of static analysis, there is much more a complete static analysis tool can do. While linting checks for stylistic and simple syntax issues, static analysis encompasses a wider range of checks, including security vulnerabilities, more complex logical errors, and advanced type analysis. Think of linters as a subset of static analysis tools, focused primarily on code style and basic correctness.

Look at some popular linters for example (you may already be using them or heard of them before): –

ESLint for JavaScript and TypeScript,
Mypy for Python,
Clangd(primarily a language-server but also works great as a fast linter) for C and C++,
SonarLint for various language.

And when it comes to more comprehensive static analysis tools for Python, we’ve got some great options. We’ll touch on a few in the "Recommended Setup" section coming up!

Checking out some noteworthy static analysis tools for python

Let’s look at some popular static analysis tools for your python code –

Flake8: This tool checks for style errors and simple programming mistakes.

Flake8 is a static analysis tool exclusively for python that glues together pycodestyle, pyflakes, mccabe, and third-party plugins to check the style and quality of some python code. It is a comparatively generic tool and even if there are Modern alternatives available, it still is a versatile tool widely used and adopted.
Mypy:

Mypy adds static typing to Python, helping you catch type-related errors. Mypy is an optional static type-checker for Python that aims to combine the benefits of dynamic (or "duck") typing and static typing. Mypy combines the expressive power and convenience of Python with a powerful type-system and compile-time type checking. Mypy type checks standard Python programs; run them using any Python VM with basically no runtime overhead.
Pyright:

A blazingly fast type-checker created by Microsoft. Pyright is a full-featured, standards-based static type checker for Python. It is designed for high performance and can be used with large Python source bases. The best thing about Pyright is, it is not just a static analysis tool but can also be used as a language server. Pyright is a common and popular choice of Vim/Neovim nerds as their go to tool and complete setup for code suggestion, autocompletion, linting and other data type related static analysis aspects.
Pylint:

Pylint is a Static Analysis tool that has a latest version supporting Python 3.9.0 and above. Pylint analyses your code, checks for errors, enforces a coding standard, looks for code smells, and can make suggestions about how the code could be refactored. It is one of the most popular Python linters available.

It is Fully customizable.

Pylint integrates well into CI/CD pipelines using tools like Jenkins or GitHub Actions, enabling automated code quality checks.
Ruff:

Based on what the Ruff official website says, – Ruff is an extremely fast Python linter and formatter, written in Rust. It can be used to replace tools like Flake8, black, isort, pydocstyle, pylint, while executing much faster than any individual tool.

Recommended Setup

Alright, so you’re convinced about static analysis (and if you’re not yet, trust me, you will be!). Now, let’s talk about how to actually use it in your Python development workflow. The good news is, setting up static analysis in your code editor is easier than you might think. Let’s look at some popular editors and how to get things configured.

VS Code: The "One-Stop Shop":

If you’re a VS Code user, you’re in luck. Setting up static analysis is incredibly straightforward. In fact, you can get pretty much everything you need with one single extension: the official "Python" extension from Microsoft.

Seriously, this extension is a powerhouse. It includes a bunch of goodies, most notably the Pylance extension (which is technically optional but comes bundled and highly recommended) and a Python debugger. And guess what? Pylance is the key component we’re interested in for static analysis!

Pylance is like a complete intelligence package for your Python code. It gives you intelligent code completion (autocomplete), helps with code navigation, provides rich IntelliSense (those helpful pop-up tips as you code), and obviously – you guessed it – linting!

Under the hood, Pylance is powered by Pyright, the open-source static analysis tool we’ve discussed before. So, by simply installing the "Python" extension in VS Code, you’re essentially getting a fantastic static analysis setup right out of the box. No need to hunt down and configure a bunch of different tools – it’s all included and ready to go. Just install the "Python" extension, and VS Code will start analyzing your Python code in real-time as you type, flagging potential issues and helping you write cleaner, more robust code.

In the image above you can see an example of the static analysis support we get when python extension is installed and enabled (look at the red highlighted line saying SyntaxError, that’s it).

Sublime Text: Crafting Your Perfect Setup:

Sublime Text is known for being lightweight, its speed and customizability, and you absolutely can get a solid static analysis setup going. It might require a bit more manual configuration than VS Code, but the flexibility is worth it for many Sublime Text fans.

For Sublime Text, we’ll aim for a setup using a combination of tools to cover different aspects of static analysis. Based on the tools we mentioned earlier (Flake8, mypy, pyright, pylint, ruff), a great starting point is to combine Flake8 for general linting and style checks with Mypy for robust type checking.

So, let’s see how to get a beautiful python Static Analysis setup in Sublime Text 4.

Install Package Control: If you haven’t already, Package Control is essential for managing packages in Sublime Text. Follow the instructions on the Package Control website to install it.
Install SublimeLinter and SublimeLinter-flake8: SublimeLinter is a framework that allows linters to work in Sublime Text. SublimeLinter-flake8 is the specific plugin that integrates Flake8 with SublimeLinter. Open the Command Palette in Sublime Text (Ctrl+Shift+P or Cmd+Shift+P), type Package Control: Install Package.

Then search for and install both SublimeLinter and SublimeLinter-flake8.
Install Mypy and SublimeLinter-mypy: Similarly, you’ll need the SublimeLinter-mypy plugin to integrate Mypy. Use Package Control again to install SublimeLinter-mypy. Make sure you also have mypy installed.
Optional: Configure Settings (if needed): Both SublimeLinter-flake8 and SublimeLinter-mypy have settings you can customize. For example, you might want to adjust Flake8’s configuration to ignore certain rules or configure Mypy’s strictness. You can access these settings through the Sublime Text menu: Preferences -> Package Settings.

With this setup, Sublime Text will now use Flake8 to lint your Python code for style issues and potential errors, and Mypy will perform type checking in the background, highlighting type-related problems directly in your editor as you code. You get a powerful combination for catching a wide range of issues in your Python projects.

Look at the beautiful popup message we get when hover on the warning and error messages, after sublimeLinter and sublimeLinter-mypy are installed.

Neovim: Power and Infinite Customizability:

For Neovim users who love customization and speed, setting up static analysis is all about leveraging Neovim‘s Language Server Protocol (LSP) capabilities and plugin ecosystem.

When it comes to Python in Neovim, you have excellent choices for LSP servers. Pyright is often praised as a rock-solid option, providing comprehensive support including smart code suggestions, linting, and more. However, if type checking accuracy is your absolute top priority, Mypy is generally considered to be even more thorough and precise in its type-analysis.

Ideally, for a truly robust setup, you might want to use both Pyright and Mypy in Neovim, taking advantage of each tool’s strengths. Here’s how you can configure Neovim to use both, using popular plugins like lazy.nvim (for plugin management), mason.nvim (for LSP server installation) and none-ls.nvim (for attaching static analysis tools):

(Assuming you have Lazy.nvim and Mason already set up. If not, refer to their respective documentation for installation instructions.)

Install Pyright and Mypy LSP Servers using Mason:

Add the following to your Neovim configuration (e.g., your init.lua file) within your Mason setup block:
```
require("mason").setup({
    ensure_installed = {
        "pyright",
        "mypy",
    },
})
```
This tells Mason to ensure that both pyright and mypy LSP servers are installed. When you first start Neovim after adding this, Mason will automatically install them. You can also manually install them with :MasonInstall command though.

Configure LSP Client with lspconfig for Pyright:

In your LSP configuration (often in a separate file or within your init.lua), configure Pyright as your primary Python LSP server. This will handle general LSP features and provide a good base for static analysis.

A key advantage of Pyright is its ease of setup. You don’t need to separately configure it to make it work on Neovim. You can just apply the default setup option and enjoy most of the pyright features thanks to the ‘cmp-nvim-lsp’ plugin.

Although you can definitely do it if you want to get some specific features enabled.

For experienced Neovim users, the following configuration will be familiar. If you are new to Neovim LSP configuration, carefully copy and paste the provided Lua code into your LSP configuration file (typically within your init.lua or a dedicated LSP configuration file).

local lspconfig = require('lspconfig')
local lsp_capabilities = require('cmp_nvim_lsp').default_capabilities()

vim.api.nvim_create_autocmd('LspAttach', {
    desc = 'LSP actions',
    callback = function(event)
        local opts = {buffer = event.buf}

        -- any keymaps you would want to set, examples below
        vim.keymap.set('n', 'K', 'lua vim.lsp.buf.hover()', opts)
        vim.keymap.set('n', 'gd', 'lua vim.lsp.buf.definition()', opts)
        vim.keymap.set('n', 'go', 'lua vim.lsp.buf.type_definition()', opts)
        vim.keymap.set('n', 'gr', 'lua vim.lsp.buf.references()', opts)
        vim.keymap.set('n', '', 'lua vim.lsp.buf.rename()', opts)
        vim.keymap.set('n', '', 'lua vim.lsp.buf.code_action()', opts)
    end
})
-- the default setup
local default_setup = function(server)
    lspconfig[server].setup({
        capabilities = lsp_capabilities,
    })
end

require('mason').setup({})
require('mason-lspconfig').setup({
    handlers = {default_setup},
})

local cmp = require('cmp')

cmp.setup({
    window = {
        completion = {
            winhighlight = "Normal:Pmenu,FloatBorder:Pmenu,Search:None,CursorLine:PmenuSel",
            col_offset = -3,
            side_padding = 0,
        },
    },
    sources = {
        { name = 'nvim_lsp' },
        { name = 'buffer' },
    },
    mapping = cmp.mapping.preset.insert({
        -- enter key confirms completion item
        [''] = cmp.mapping.confirm({select = false}),

        -- ctrl + space triggers completion menu
        [''] = cmp.mapping.complete(),
    })
})

-- optional setup explicitly for pyright
lspconfig.pyright.setup({
    -- add your extra setup options here
})

Configure none-ls plugin for Mypy Setup (for enhanced type checking):

Assuming you have already installed mypy via Mason, the only thing left is to set up mypy. Here also NO extra configurations are needed. And in our rescue is none-ls. Add the following piece of code (specs for mypy configuration) in your Lua file where plugins are listed for installation using Lazy.nvim.
```
    -- your other plugins
    {
        "nvimtools/none-ls.nvim",
        event = "VeryLazy",
        dependencies = {
            "nvimtools/none-ls-extras.nvim",
        },
        config = function()
            local null_ls = require("null-ls")
            null_ls.setup({
                debug = true,
                sources = {
                    null_ls.builtins.diagnostics.mypy,
                    }),
                },
            })
        end,
    },
```
After properly set up, you should be able to see mypy setup status in a python file by running the :NullLsInfo command. For checking status of pyright, you should run :LspInfo command.

Also, whenever you’ll open a python file, you’ll see mypy immediately startup and initiate checking your python code.

With this Neovim configuration, you get the best of both worlds: Pyright providing a solid foundation for LSP features and general linting, combined with mypy‘s in-depth type checking. This setup gives you a powerful and highly customizable static analysis environment in Neovim. Remember to adjust settings as needed to match your specific preferences.

The image above shows static analysis you get after successful setup of pyright and mypy.
Visit none-ls GitHub, for more info about configuring the static analysis tools attached to the null-ls client.

Conclusion

Static code analysis is a valuable tool for any developer. It helps you write better, more reliable, and more secure code. While linters help enforce style consistency, full-fledged static analysis tools provide deeper insights into potential bugs and security risks.

Using tools like Flake8, mypy, and pyright, developers can automate code checks effectively. Integrating static analysis into the development process ensures more reliable and rock-solid software.

Happy Coding!

FAQ

What exactly is the difference between static and dynamic code analysis?

Static code analysis examines code without executing it, like reading a blueprint. Dynamic analysis involves running the code and observing its behavior in real-time.

Are linters sufficient for all my static analysis needs?

While linters are a type of static analysis and excellent for enforcing code style, full-fledged static analysis tools offer deeper insights into potential bugs, security risks, and type-related errors that linters might miss.

Which Python static analysis tools should I use?

Popular choices include Flake8 for general linting, Mypy for static type checking, Pyright for fast type checking and language server features, Pylint for comprehensive analysis, and Ruff as a fast all-in-one linter and formatter. In this case, you should use a combination of these tools. The best combination depends on your project’s specific needs.

How can I integrate static code analysis into my workflow?

You can integrate static analysis directly into your code editor (as shown in the setup guides for VS Code, Sublime Text, and Neovim), and also as part of your CI/CD pipeline using GitHub Actions to automatically check code quality with every commit or pull request.

Author

Debajyati Dey

CSE undergrad, learning web development, Building projects in python and javascript, documenting my journey, learning, perspectives and experiences through technical articles at hashnode and dev.to . Have basic understanding of WebAssembly and emscripten, Made a small canvas animation project using WebAssembly & emscripten and express.js. Recently built an interactive CLI app `gitFM` in JavaScript to search, select & clone GitHub or Gitlab or any self-hosted repos from your favorite terminal.

Author Details

Posts by Debajyati Dey

Top Tools for Static Analysis Help in Your Python Projects

Top Selenium Alternatives For Your Node js Application