SaaSHub helps you find the best software and product alternatives Learn more →
Top 23 Go Static Analysis Projects
-
Project mention: Performance Test: Grype 0.70 vs Trivy 0.50 Scan Times – 15% Faster for Alpine Images | dev.to | 2026-04-28
After 120+ benchmark runs across 6 Alpine image variants, 2 hardware configurations, and 3 CI environments, our verdict is clear: Grype 0.70 is 15% faster than Trivy 0.50 for Alpine-based container images, with identical vulnerability detection parity. For teams scanning Alpine images at scale, this speedup translates to thousands of dollars in CI compute savings and hundreds of engineer hours reclaimed per month. If you're only scanning Alpine images, migrate to Grype today—the 15% speedup is worth the migration effort for any team with more than 100 daily scans. For heterogeneous image stacks, Trivy remains the better all-in-one option. We recommend running the benchmark script we provided earlier on your own images to validate the speedup for your specific workload.
-
SaaSHub
SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives
-
Project mention: Performance Test: Grype 0.70 vs Trivy 0.50 Scan Times – 15% Faster for Alpine Images | dev.to | 2026-04-28
How does Clair compare to Grype and Trivy for Alpine image scans?
-
reviewdog
🐶 Automated code review tool integrated with any code analysis tools regardless of programming language
github.com - reviewdog/reviewdog
-
syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Project mention: War Story: We Implemented SBOMs with Syft 0.10 and Cut Compliance Audit Time 60% for 500 Services | dev.to | 2026-04-28 -
-
Sign and scan artifacts before deployment. Container image scanning with Trivy, Snyk, or Grype identifies known vulnerabilities in base images and dependencies. Fail the pipeline if critical or high-severity vulnerabilities are detected.
-
Project mention: 2026 Benchmark: Gemini 2.5 vs. OpenAI o4 for Translating Code Between Python 3.13 and Go 1.24 | dev.to | 2026-04-28
Go’s static analysis ecosystem is mature enough to catch 80% of translation errors before runtime. staticcheck (https://github.com/dominikh/go-tools) is a state-of-the-art linter that detects unused variables, race conditions, and incorrect error handling—common issues in LLM-translated Go code. In our benchmark, teams that integrated staticcheck into their CI pipeline reduced post-translation bugs by 72%. For example, running staticcheck ./... after translation will catch issues like unhandled errors or shadowed variables that Gemini 2.5 occasionally misses. Similarly, go vet detects suspicious constructs, such as fmt.Printf calls with incorrect format verbs. A sample CI step looks like:
-
-
revive
🔥 ~6x faster, stricter, configurable, extensible, and beautiful drop-in replacement for golint
> Our coding standards require that functions have a fairly low cyclomatic complexity. The goal is to ensure that we never have a a function which is really hard to understand.
https://github.com/fzipp/gocyclo
> * We also require a properly descriptive header comment for each function and one of the main emphases in our code reviews is to evaluate the legibility and sensibility of each function signature very carefully. My thinking is the comment sort of describes "developer's intent" whereas the naming of everything in the signature should give you a strong indication of what the function really does.
https://github.com/mgechev/revive
> Now is this going to buy you good architecture for free, of course not.
It's not architecture to tell people to comment on their functions.
Also FTR, people confuse cyclomatic complexity for automagically making code confusing to the weirdest example I have ever had to deal with - a team had unilaterally decided that the 'else' keyword could never be used in code.
-
-
Project mention: Show HN: Soppo – A Golang superset that adds enums, pattern matching, nil safety | news.ycombinator.com | 2025-12-03
Hey HN, I've been working on Soppo, a language that compiles to Go, adding features to catch errors at compile time instead of runtime: enums with exhaustive matching, `?` for error propagation, and nil safety from static analysis of nil flows (sort of like https://github.com/uber-go/nilaway but currently much less sophisticated). It's designed to still look and feel like Go, and be able to use any Go library directly.
Playground: https://play.soppolang.dev
Not production ready and still a little early in development, but curious what people think about the design.
-
kube-linter
KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.
-
bearer
Code security scanning tool (SAST) to discover, filter and prioritize security and privacy risks.
-
Project mention: The Hidden Risks of "Secure by Default": Why Security Contexts in Kubernetes Matter | dev.to | 2025-10-30
Scan manifests with tools like kubesec or Polaris
-
horusec
Horusec is an open source tool that improves identification of vulnerabilities in your project with just one command.
-
Project mention: Show HN: Tips to stay safe from NPM supply chain attacks | news.ycombinator.com | 2025-09-21
For GitHub Actions, i found http://safedep.io/ to be helpful, not only it guard against known attacks, but also it has its own malware detection engine.
-
Project mention: From CLI to GitHub Bot: Building a Code Management AI for Python | dev.to | 2026-02-06
So I built pyscn — a static analysis engine in Go with tree-sitter. It scans Python code and gives you a Health Score (0–100) based on:
-
-
-
-
-
globstar
Globstar is a fast, feature-rich, and open-source static analysis toolkit for writing and running code checkers. Based on tree-sitter.
-
NOTE:
The open source projects on this list are ordered by number of github stars.
The number of mentions indicates repo mentiontions in the last 12 Months or
since we started tracking (Dec 2020).
Go Static Analysis discussion
Go Static Analysis related posts
-
2026 Benchmark: Gemini 2.5 vs. OpenAI o4 for Translating Code Between Python 3.13 and Go 1.24
-
War Story: We Implemented SBOMs with Syft 0.10 and Cut Compliance Audit Time 60% for 500 Services
-
Show HN: Backlit – Lit Web Component SSR for Drupal via Go and WASM, No Node.js
-
Why TODOs rot — and how I built a tool to make them expire
-
Show HN: DebtBomb – Make TODOs expire and automatically create Jira tickets
-
Top 7 Terraform Scanning Tools You Should Know
-
Show HN: Soppo – A Golang superset that adds enums, pattern matching, nil safety
-
A note from our sponsor - SaaSHub
www.saashub.com | 15 Jun 2026
Index
What are some of the best open-source Static Analysis projects in Go? This list will help you:
| # | Project | Stars |
|---|---|---|
| 1 | grype | 12,394 |
| 2 | clair | 11,005 |
| 3 | reviewdog | 9,353 |
| 4 | syft | 9,091 |
| 5 | gosec | 8,858 |
| 6 | tfsec | 7,011 |
| 7 | go-tools | 6,817 |
| 8 | go-callvis | 6,485 |
| 9 | revive | 5,522 |
| 10 | go-recipes | 4,489 |
| 11 | nilaway | 3,827 |
| 12 | kube-linter | 3,469 |
| 13 | bearer | 2,678 |
| 14 | kubesec | 1,459 |
| 15 | horusec | 1,320 |
| 16 | vet | 1,073 |
| 17 | pyscn | 1,017 |
| 18 | go-ruleguard | 870 |
| 19 | huskyCI | 593 |
| 20 | woke | 513 |
| 21 | sqlvet | 499 |
| 22 | globstar | 489 |
| 23 | Chronos | 440 |
Sponsored
SaaSHub - Software Alternatives and Reviews
SaaSHub helps you find the best software and product alternatives
www.saashub.com