Finding problems without running code.
WHAT STATIC ANALYSIS DOES
Examines code and reports likely errors.
WHAT IT CATCHES
Type mismatches Undefined names and methods Unreachable code Impossible conditions Unused imports and variables
WHAT IT DOES NOT CATCH
Logic errors.
WHAT ELSE TO RUN
A formatter, applying style automatically A dependency vulnerability check A secrets scanner
WHY A FORMATTER
Style stops being discussed, and differences in reviews are real changes only.
WHAT TO DO WHEN INTRODUCING THESE TO EXISTING CODE
Set a baseline, so existing problems do not block everything.
Then prevent new ones.
WHY
Otherwise the first run reports thousands of issues and the tool is abandoned.
WHAT TO RAISE OVER TIME
The strictness, gradually.
WHAT TO RUN THEM ON
Every change, automatically.
WHAT TO FAIL THE BUILD ON
New problems.
WHAT TO AVOID
Warnings nobody acts on, which train people to ignore output.
