Static Analysis & Code Quality
Catch defects, duplication and drift before the code ever runs.
What this category is really about
Static analysis reads your code without executing it and flags bugs, code smells, duplication and dependency risk. Its value is compounding: a rule enforced from day one costs nothing, while the same rule applied to a five-year-old codebase produces 12,000 issues nobody will ever fix.
The practical strategy is the clean-as-you-code model — hold new and changed code to the standard, and let legacy debt sit behind a separate, deliberately planned effort. Nearly every tool in this category now supports that framing because the alternative demonstrably fails.
What to evaluate
Signal-to-noise ratio
False positives are the whole game. A tool at 40% noise gets disabled within a quarter.
Language coverage
Polyglot repos need one tool that covers all of it, or you maintain several quality gates.
PR-level gating
Inline comments on the diff, and a status check that can block merge on new issues only.
Self-hosting
Some organisations cannot send source code to a third party. Check for an on-prem edition.
Common mistakes
- Enabling every rule on day one and burying the team.
- Gating on total coverage rather than coverage of the diff.
- Auto-fixing formatting and quality in one commit, making the review unreadable.
8 tools built for this
Sorted by how widely adopted they are, not by preference. Tick the compare boxes to put two or more side by side.
ESLint
The JavaScript and TypeScript linter every project ends up using.
Ruff
Extremely fast Python linter and formatter that replaces most of the toolchain.
SonarQube
The static-analysis standard: 30+ languages, quality gates, clean-as-you-code.
Biome
Rust-based linter and formatter that replaces ESLint and Prettier, very fast.
Codacy
Automated code review with security scanning and coverage in the pull request.
Code Climate Quality
Maintainability and technical-debt tracking with a ten-point rating.
DeepSource
Static analysis with autofix, tuned hard for low false-positive rates.
Qodana
JetBrains' IDE inspections, running as a CI quality gate.
Tools that also cover this
These are built primarily for something else but handle this category as part of a broader platform — often a way to consolidate two subscriptions into one.
Dependabot
Security Testing
Free dependency updates and vulnerability alerts, built into GitHub.
Lighthouse
Accessibility
Google's built-in audit for performance, accessibility, SEO and best practices.
Renovate
Security Testing
Highly configurable automated dependency updates, free and self-hostable.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.
CodeQL
Security Testing
Query your codebase like a database to find vulnerability patterns across the whole repo.
Pest
Unit & Component
A friendlier front end for PHPUnit with a function-based, expressive API.
Semgrep
Security Testing
Pattern-based static analysis where rules look like the code they match.
Siteimprove
Accessibility
Enterprise accessibility, SEO and content-quality governance across whole websites.