#staticanalysis

The staticcheck SA, ST, and S rules that catch real Go bugs go vet misses, and how to suppress the false positives without going numb to them.

PHPStan reads mixed on your factories and config lookups. Extensions teach it the real shape of your domain types.

Psalm and PHPStan both work in 2026. The right pick depends on your codebase, not a leaderboard. A decision guide by stack, team, and risk.

This article was originally published on wilfried.hashnode.dev Static analysis isn't about making...

graphlens: turn any repo into one typed graph — across Python, TypeScript, Go and...

The biggest issue Part 1 left open was that AI couldn't reach the 46-repo codebase by natural-language query (the entry-point problem). This post is how I solved it — by reusing the pattern proven in db-graph (1,133-table semantic search), then layering minimal annotations only around boundary nodes. Covers the separate-branch operation that keeps engineers' daily workflow untouched, the SLO that protects the joins between three graphs, the SAME_ENTITY normalization, and the April–May trial-and-error timeline traced through real commits.

If you've ever asked an AI to find all references to a function in your codebase, only to get back a...

TransLift is a CLI that statically finds user-facing strings in a React/TypeScript codebase and wraps...

Static analysis tools that only search for direct calls produce false positives. Here is what...

A static-analysis approach to unifying 46 repositories (37 air-closet-side + 9 mall-side) of legacy production code into one knowledge graph. Why simply 'letting AI read the code' isn't enough, why I had to chase down boundary nodes (API endpoints, DB tables, Event topics), how I dealt with framework and library diversity, and what 3 months of trial and error solved or didn't solve — looking back through actual git history.

I almost filed a wrong GitHub issue on a popular repo. Here's the false positive my CLAUDE.md scanner hit, and the two heuristics I added so it stops crying wolf.

Token efficiency isn't about saving tokens — it's about handing coding agents short, deterministic facts. Most of those are graph questions (impact, ordering, guard dominance, flow) writable in one language: a dependency graph. Why small domain-specific detectors beat generic OSS, how tree-sitter and LSP map onto verified/estimated labels, with a worked DB guard-bypass example.