\

Go Analysis Framework: modular static analysis by go team

158 points - today at 12:21 PM

Source
  • b7e7d855b448

    today at 5:07 PM

    You guys can keep complaining about how go is too verbose, but I love everything about go.

    I love the error handling, I love the forced formatting, i love all the linting it has including style guides. When you read other source code it's so easy to understand it and make sense of it. Thank you go team

    (Ok, maybe I am a bit sceptical with the latest generic additions, but overall it's a great language. I love it.)

      • BobbyJo

        today at 8:59 PM

        100% with you on every point. It's the only language I've worked in that lets me read other codebases without an hour or two of "wut?" happening, so they did something right!

        • wannabe44

          today at 5:41 PM

          Oh yeah totally agree. I don't understand why someone would want to write `slices.Contains(s, needle)` when you can write this beautiful poem like a Shakespeare in VSCode:

              found := false
              for _, v := range s {
                  if v == needle {
                      found = true
                      break
                  }
              }
          
          Oh and I totally want to build a stack trace manually. It's like doing cardio to me.

              if err != nil {
                 return fmt.Errorf("my function name but in spaces: %w", err);
              }
          
          This is very elegant by the way, so that we need errors.Is now, which has to dynamically check if the error implements Unwrap() error or Unwrap() []error. Because having any language facilities for error handling is harmful.

            • b7e7d855b448

              today at 6:33 PM

              I don't say it's perfect, but right in this moment I feel most comfortable with go and I don't mind jumping through a few hoops or writing things multiple times

              • logicchains

                today at 5:56 PM

                Your handwritten one has a major performance bug:

                    found := false
                    for _, v := range s {
                        if v == needle {
                            found = true
                            break
                        }
                    }
                
                Do you see it? It copies the v into a local variable, which could be tremendously wasteful if it's a large struct. You should instead be taking a pointer to s[i] and comparing the value there with `needle`.

                If you'd used `slices.Contains(s, needle)`, on the other hand, it could have such a performance bug in it and you'd never know.

                  • irq-1

                    today at 8:59 PM

                    You're right. Just for information, slices.Contains() uses the index, not a copied value.

                    https://cs.opensource.google/go/go/+/refs/tags/go1.26.5:src/...

                    • kajman

                      today at 7:23 PM

                      > If you'd used `slices.Contains(s, needle)`, on the other hand, it could have such a performance bug in it and you'd never know.

                      Perhaps you're much better at programming than I am, but I prefer these semantics in a language because I figure they're much more likely to have been optimized empirically, support vectorization, and be less buggy than another rote loop I'm trying to speed through.

                      • boredatoms

                        today at 7:37 PM

                        or contains() could be written by those who can write performant code, ..once

                        • mathisfun123

                          today at 7:19 PM

                          > on the other hand, it could have such a performance bug in it and you'd never know.

                          wut...? the debate isn't between closed (incompetent) source and open (competent) source - the debate is between verbose language and expressive language.

                      • msie

                        today at 6:05 PM

                        You forgot to put /s after your post.

                    • spockz

                      today at 8:48 PM

                      I do love the batteries included attitude. Having benchmarking included as well as a mechanism to run tests to check (test) for race-conditions right from the language/build tool is amazing.

                      My only wish is that go could become less verbose. There are several frontends to go that are more compact, compile down into golang, and then let you enjoy all the benefits.

                      • Someone

                        today at 6:44 PM

                        > I love the error handling

                        Even if you prefer manually checking for errors after every call that might fail, I fail to see how one can love goโ€™s verbosity. Compare goโ€™s

                           foo, err := bar()
                           if err != nil {
                             return ERR;
                           }
                        
                        with something like (hypothetical)

                          foo := bar() ||| return ERR;
                        
                        where the compiler, seeing that bar returns an Either<int,err> can enforce the presence of the ||| clause or, alternatively, require later code to check for errors if the ||| clause isnโ€™t present. I think thatโ€™s both more robust (prevents one from forgetting to check for errors) and shorter (allowing for showing a lot more code on a screen or page)

                        • eptcyka

                          today at 7:04 PM

                          I love how during prototyping, the compiler will tell me off for having an unused variable and fail to compile. I totally love the idea of crashing when writing on a closed channel.

                          • jerf

                            today at 5:18 PM

                            If generics were going to ruin the language, they would have by now. I think you can rest easy.

                              • ncruces

                                today at 5:41 PM

                                The greatest thing about generics is โ€ฆ that they're not used much if at all.

                                Which is a great way to make sure they're not overused, which in my experience is better than underuse.

                            • gempir

                              today at 6:37 PM

                              It doesn't have a lot of style guides or linting though. You have to install and configure quite a lot of tooling for that

                          • jamescun

                            today at 1:52 PM

                            This isn't new?

                            You can see it's used by _a lot_ of linters already:

                            https://pkg.go.dev/golang.org/x/tools/go/analysis?tab=import...

                              • tgv

                                today at 2:15 PM

                                I visited that link three years ago. It isn't new. It's nifty, though.

                                • stephbook

                                  today at 3:26 PM

                                  It was mentioned in the Ruff article comments and probably reposted.

                              • jzelinskie

                                today at 6:02 PM

                                For SpiceDB[0], we've found a lot of success using this framework to define our own analyzers; it's probably 10x easier now with LLMs. No need for tribal knowledge or more time wasted on code review if you can just turn it into a linter and move on.

                                [0]: https://github.com/authzed/spicedb/tree/main/tools/analyzers

                                • mchav

                                  today at 7:40 PM

                                  Can these sorts of primitives be used to create broader "architectural" linters?

                                  • ksec

                                    today at 5:21 PM

                                    So what is context? This isn't new and why the submission ?

                                      • hxtk

                                        today at 6:20 PM

                                        Someone in the thread about the Ruff update ingenuously said they wished Go had something like Ruff, being unaware of this framework. In that thread, someone seemed to take it as a sign that many people who might care to know about this don't yet, so they made a dedicated post for it.

                                    • hoppp

                                      today at 1:19 PM

                                      I was just looking for this. Will give it a spin.

                                      • verdverm

                                        today at 6:49 PM

                                        The Go team's emphasis on tooling in the service of software engineering is a boon to human and agentic development alike. Give yourself and your agents great tools.

                                        An example from one of my recent projects: https://github.com/verdverm/gmd/blob/main/Makefile (give agents simple "tool calls" instead of needing to divine the correct args/flags every time, essentially invocable agents.md content)

                                        One of the interesting things to call out from this is using build tags for testing { unit, coverage, recorded, real api }, with the buffet allowing the agent to iterate faster and more targeted. I tend to run the linting and coverage in a new session, have a report generated, and then another fresh session to start dealing with gaps.

                                        Another super cool testing tool in the Go internal source is `testscript`. Roger Peppe extracted a number of those internal utilities here https://github.com/rogpeppe/go-internal/tree/master/testscri...

                                        • k9294

                                          today at 6:00 PM

                                          [flagged]

                                          • someworkk

                                            today at 3:46 PM

                                            [flagged]

                                            • dfasifsaf

                                              today at 2:22 PM

                                              [flagged]

                                                • zikohh

                                                  today at 2:31 PM

                                                  It's spam look at the users history. They just comment the same thing everywhere

                                                • today at 2:28 PM