Go team publishes modular static analysis framework for code inspection

The Go team has published the analysis package within the golang.org/x/tools repository, establishing a standard interface for modular static analysis functions and driver programs. This framework allows checkers to inspect Go code packages and report diagnostics, such as mistakes in format strings or other code issues. The release marks a significant step in standardising how static analysis is conducted within the Go ecosystem, moving beyond ad-hoc implementations to a unified architecture.

Central to the framework is the support for modular analysis, which mirrors the separate compilation model used in toolchains. This allows information to be saved from lower-level packages for use in higher-level ones, facilitating efficient, parallel processing of large codebases. The system introduces the Analyzer type to statically describe analysis functions, including their name, documentation, flags, and logic, while the Pass type provides the interface between analysis logic and the driver, offering syntax trees and type information.

A key feature of the new API is the implementation of "Facts," which are stateless, serialisable data associated with objects or packages. These facts are encoded using the gob protocol to ensure determinism and compatibility with content-addressable caches, a requirement for build systems that rely on incremental compilation. Drivers are responsible for propagating these facts between packages, potentially across different address spaces, enabling analyzers to build upon the findings of previous passes.

The framework is designed for broad reuse across various development environments. Checkers can be incorporated into command-line utilities, IDEs, build systems, and code review tools. Helper packages such as singlechecker and multichecker simplify the creation of analysis commands, while the analysistest subpackage provides utilities for testing analyzers using specific comments in test data. This modularity ensures that developers can select and incorporate checkers from a variety of sources without rewriting core logic.

While the framework offers robust capabilities, the documentation notes certain limitations regarding standard library packages. Some driver implementations, such as those based on Bazel and Blaze, do not currently apply analyzers to standard library packages. Consequently, analyzer authors are advised not to rely on facts being available for standard packages, although the Go team intends to remove this limitation in future iterations. The release also includes a Validate function to perform sanity checks on analyzer configurations, ensuring acyclic dependency graphs and unique fact types.