starter.wiki

Developer Workflow

Linters & Static Analysis

Choose non-security code analysis by language, feedback loop, rule ownership, autofix, and governance.

Recommendation

Choose by language and feedback loop, then add centralized governance only when needed.

Use ESLint or Biome for JS/TS workflows, Ruff for Python, and SonarQube when multi-language quality governance across repositories is a real operating requirement.12

For: Development teams establishing non-security static checks in local and continuous-integration workflows

Main trade-off

Stronger static analysis catches more defects and enforces consistency while increasing rule maintenance, false-positive handling, runtime, central-service dependence, and developer friction.1234

Three static-quality layers

Fast local linting, integrated formatting, and centralized quality governance solve different adoption and ownership problems.

  1. Language and semantics

    Match parser, language version, type information, framework syntax, generated code, and repository topology.12

  2. Feedback loop

    Choose editor, pre-commit, local command, pull-request annotation, and central dashboard placement intentionally.12

  3. Rule ownership

    Define defaults, exceptions, suppressions, false positives, baselines, generated code, and change governance.12

  4. Operating cost

    Include runtime, cache, service administration, upgrades, plugins, developer friction, and policy review.12

Static-quality routes

Keep security findings out of this decision even when a platform also sells security capabilities.

A JavaScript or TypeScript codebase needs configurable ecosystem linting

Evaluate ESLint.

ESLint is the configurable JS and TS route when ecosystem plugins, explicit rules, and repository-owned policy are priorities.

Verify: Own configuration complexity, plugin compatibility, type-aware cost, rule conflicts, and upgrade discipline.1

A web project wants a fast integrated formatter and linter

Evaluate Biome.

Biome is the integrated web-tooling route when its language coverage and rules can replace multiple formatting and linting steps.

Verify: Verify rule and plugin gaps, migration behavior, framework support, editor integration, and required exceptions.2

A Python codebase needs fast linting and import or formatting workflows

Evaluate Ruff.

Ruff is the Python-specific route when fast repository checks and its supported rule and formatting surface fit.

Verify: Validate rule equivalence, preview behavior, formatter choices, type checking, and migration from existing Python tools.3

An organization needs centralized multi-repository code-quality governance

Evaluate SonarQube.

SonarQube is the centralized quality route when multi-language analysis, quality gates, history, and administration justify a shared platform.

Verify: This route covers maintainability and quality governance only; security scanning remains a separate Task and the team must own service operations or commercial terms.4

Boundary: Vulnerability Scanning owns security-focused SAST, dependency, container, and infrastructure findings; Testing executes behavior instead of inspecting code.

Differences that change the choice

Compare only the boundaries that materially alter adoption and ongoing ownership.

Language scope
ESLint and Biome focus web ecosystems, Ruff focuses Python, and SonarQube spans centralized multi-language analysis.4
Feedback placement
Editor and local feedback differs from pull-request or central quality-gate enforcement.14
Rule ecosystem
Plugins, built-in rules, type awareness, suppressions, and migration coverage vary materially.1
Ownership
Repository tools require configuration discipline; a central platform adds service and policy administration.14

Official resources

Verify current product boundaries, control-plane behavior, execution limits, pricing, licensing, and operating requirements in first-party material before adoption.

DocumentationBiome documentation

Sources

Official product material supports the bounded routes and verification points; route selection remains an editorial judgment.

  1. 1
    ESLint core concepts

    ESLint · Accessed Official

  2. 2
    Biome documentation

    Biome · Accessed Official

  3. 3
    Ruff linter documentation

    Astral · Accessed Official

  4. 4
    SonarQube Server documentation

    Sonar · Accessed Official