Static analysis
Static analysis is the examination of source code or other program artifacts without executing the program to infer properties or identify potential issues.
100 Java Mistakes and How to Avoid Them
A static analysis tool is software that examines code without executing it to detect defects, policy violations, or other properties.
- How it is used
- Flags recurring suspicious Java code patterns as automated review feedback during editing, builds, and CI.
- How deep it goes
- Explains tool integration, online versus offline scope, configuration, and suppression, while cautioning that pattern checks miss defects.
- Examples
- Uses a 32-bit int shift warning, misleading shift-parenthesis quick fix, unused debug collection, and assert-side-effect detection.
- What you can do after
- Apply it via IDE plugins or build integration, then configure and narrowly suppress findings with judgment.
Read how 100 Java Mistakes and How to Avoid Them explains static analysis →
Authorization in Action
Static analysis is the examination of programs or policies without executing them to identify properties, errors, or behavioral consequences.
- How it is used
- Provides a predeployment safety net for authorization policy changes alongside testing and CI checks.
- How deep it goes
- Explains structural checks for conflicts, redundancy, gaps, coverage, invariants, and equivalence, but defers SMT-check mechanics.
- Examples
- Uses pull-request checks and document-access policies to contrast scenario tests with policy-set verification.
- What you can do after
- Operate/configure it in CI pipelines to catch policy conflicts, unreachable rules, gaps, and regressions before deployment.
Effective Platform Engineering
Static analysis is the automated examination of source code or related artifacts without executing the analyzed software.
- How it is used
- Provides early quality and security feedback on infrastructure-as-code changes locally and in CI before deployment.
- How deep it goes
- Details Terraform validation, formatting, linting, and security scans, but leaves deployed-state verification to later pipeline tests.
- Examples
- Uses a Terraform VPC and ingress rule, Tflint AWS plugin configuration, and a Trivy scan.
- What you can do after
- Apply it via Terraform CLI, Tflint, and Trivy to correct validation errors, lint warnings, and security findings before deployment.
Read how Effective Platform Engineering explains static analysis →
Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform
Static analysis is the examination of source code or configuration without executing or deploying it to detect errors, inconsistencies, or violations of specified standards.
- How it is used
- Uses pre-deployment checks to validate infrastructure configuration before changes reach live resources.
- How deep it goes
- Explains parsing, isolated unit tests, dry-run handling, contracts, correction, and rollback, but defers post-deployment verification to dynamic testing.
- Examples
- Demonstrates network names, subnet ranges, Terraform plans, pytest fixtures, and module facades connecting network outputs to server inputs.
- What you can do after
- Diagnose configuration errors, enforce standards, verify module contracts, and decide whether infrastructure changes are safe to apply.
Shipping Go: Develop, deliver, discuss, design, and go again
Static code analysis is the automated examination of source code without executing it to identify defects, suspicious constructs, style violations, or security risks.
- How it is used
- Catches known bug, security, and practice-related patterns early in a code-quality pipeline so reviewers can focus on less mechanical work.
- How deep it goes
- Works through Go vet and configurable linter checks, including CI placement and local commands, without detailing the analyzers’ internals.
- Examples
- Uses a `fmt.Sprintf` argument mismatch, `go vet ./...`, and YAML configurations for `gosec` and comment-checking linters.
- What you can do after
- Operate/configure it with Go vet and golangci-lint locally and in CI to flag known issues before tests and deployment.
Read how Shipping Go: Develop, deliver, discuss, design, and go again explains static analysis →
Data Pipelines with Apache Airflow, Second Edition
Static code analysis is the examination of source code without executing it to detect defects, style violations, or other issues.
- How it is used
- Uses automated code checks to improve Python DAG readability, detect defects, and gate merges in CI/CD.
- How deep it goes
- Explains checker roles, commands, diagnostics, configuration, and CI integration, but stops short of checker internals.
- Examples
- Uses Flake8 commands, an unused-import diagnostic, and a GitHub Actions workflow combining checks with DAG tests.
- What you can do after
- Apply it via Flake8 or Pylint locally and automate checks with GitHub Actions before merging Python DAG changes.
Read how Data Pipelines with Apache Airflow, Second Edition explains static analysis →
Related concepts
- autocompleteused by · Autocomplete is an interactive input feature that suggests or completes likely continuations of partially entered text, code, commands, or other values.
- dynamic analysiscontrasts with · Dynamic analysis is the examination of a program, model, or system by observing its behavior during execution or operation.
- code reviewcontrasts with · Code review is the systematic examination of source code or proposed changes to identify problems and assess or improve quality.
- deployment pipelineused by · A sequence of automated or manual stages that builds, tests or validates, packages, and delivers software or models toward deployment.
- lintingincludes · Linting is the automated static analysis of source code or configuration against rules to identify potential errors, suspicious patterns, and style or consistency violations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.