Setup static code analysis for Python
Tags: staticanalysis, codereview, python
Published: 2020-12-03 06:20:29

---
title: Setup static code analysis for Python
published: true
description: Setup static code analysis with automated code formatting for Python repositories on GitHub with DeepSource.
tags: staticanalysis, codereview, python
//cover_image: https://assets.deepsource.io/e4acf93/images/blog/how-static-analysis-python/header.png
canonical_url: https://deepsource.io/blog/setup-static-analysis-python/
---
[Static code analysis](https://deepsource.io/blog/introduction-static-code-analysis/?utm_source=devto&utm_medium=organic&utm_campaign=contentdistribution&utm_term=setuppythonanalysis) is the technique of approximating the runtime behavior of a program. In other words, it is the process of predicting the output of a program without actually executing it. That’s what DeepSource does, statically analyzing your project and reporting to you the potential code quality issues which can be solved within no time.

This is what we will be doing here in this blog. We will try to integrate DeepSource over a forked repo, specifically on a Python project, and run analysis over it. We will further fix some of the issues with the auto-fix tool and let transformers fix some of the styling issues for our project.

Let’s get started!
>Note: In this guide, We will be analyzing only the Python project on GitHub. However, steps for other languages and platforms are similar.

## Steps to Integrate DeepSource With GitHub
DeepSource needs only a few steps to integrate continuous analysis on any repository. The process looks like this:

* [Create an account on DeepSource](https://deepsource.io/docs/quickstart/create-account.html)
* Pick a Python repository to analyse.
* Visit to DeepSource dashboard.
* Choose your project from the repository list.
* Add DeepSource configuration file.
* Run the analysis.

Pretty simple, isn’t it! Let us now look into the steps in detail:
We will first look for a python project on GitHub.
![python static analysis](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-1.png)

SIH-2019 is a Data visualisation project of National Accounts Statistics that was built within 36 hours. A short time span like this can be the obvious factor of introducing code quality issues.

Let us now fork this repo and open our DeepSource dashboard and activate the repo.

![python static code analysis](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-2.png)

From this list, you can choose the project on which you want to run the analysis. Here, I am choosing [pnijhara/sih-2019](https://github.com/pnijhara/sih-2019) which I forked. After clicking on the repository, you will be guided to add a DeepSource configuration file that is .deepsource.toml file for DeepSource to run analysis on the repo. The configuration file contains exclude file patterns which tell DeepSource to not to analyse these set of files, they can be migrations, example code, data, templates etc.

Followed by test file patterns to specify test files. These all patterns are written as glob patterns. You can read more about how to write these patterns correctly [here](https://deepsource.io/blog/glob-file-patterns/?utm_source=devto&utm_medium=organic&utm_campaign=contentdistribution&utm_term=setuppythonanalysis). After which you got to specify the language(s) that you want DeepSource to look for in your project. And finally followed by a transformer to improve your code style.

* From the list of projects, choose the project.
* Generate [configuration](https://deepsource.io/docs/analyzer/python.html)
    * (Optional but important) Write exclude file patterns and test file patterns
    * Choose Analyser as Python
    * (Optional) If your project contains Dockerfile, enable Docker
    * Choose Transformer
![generate configuration](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-3.png)

You can directly commit the configuration file to GitHub with a single click. This will add a commit to the master branch of your repo. Or you can manually add the file. DeepSource will automatically look at the `.deepsource.toml` config file and start running the analysis.

## Dashboard Overview
As soon as you commit configuration file to GitHub, DeepSource starts analyzing the repo. First run can take sometime but mostly within a 5 minutes span and generates a report that contains issues which can be fixed.

![dashboard review](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-4.png)

### Issue Categorization
DeepSource divides the issues into [categories](https://deepsource.io/docs/reference/issue-categories.html) such as Anti-patterns, Bug-risk, Style, Performance, Security, and Documentation. Out of which DeepSource on the basis of collected data recommends you some issues that can be considered as high priority.
![issue categorization](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-5.png)

### Automated Code Formatting
As soon as the Analysis finishes DeepSource automatically sends a PR related to fixing style issues because of the Transformer(black) we have added.

![automated code formatting](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-6.png)

### Issue Triage
Though DeepSource ensures less than [5% false positives](https://deepsource.io/blog/how-deepsource-ensures-less-false-positives/), you can still ignore the issues that you find not relevant to the project or are made intentionally. Read more about ignoring issues [here](https://deepsource.io/blog/actionable-issue-reporting/).

### Open Issue on GitHub
DeepSource allows you to create GitHub issues directly from the dashboard on your repo for letting other contributors to discuss and fix it. Again, it is a simple task. You just need to open any issue found be DeepSource and click on the button “Create issue on GitHub”. This button allows you to create an issue on your repository’s page on the VCS provider directly. You can edit the issue description and that title before the issue is created, and you’d also be able to add tags or assign it to someone in your team.

![Open Issue on GitHub](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-7.png)

This will redirect you to your repo with an issue that you can open.
![github issues](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-8.png)

Note: You can create GitHub issues through this method only if the repository settings allow you to do so. Else you will get a 404 Error.

## Autofixable Issues
Many issues that DeepSource found can be automatically fixed in a click. DeepSource sends a pull request for you with the fix which can be merged right away on approval. In the above forked project where DeepSource found 278 issues out of them 64 can be autofixed. Look for the “Autofix” button against an issue.

![Autofixable Issues](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-9.png)

And with a single click a PR is generated to the repo with an additional commit of formated code with black(transformer).

![Autofixable Issues](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-10.png)

![prefix unused arguments](https://deepsource.io/images/blog/how-static-analysis-python/deepsource-blog2-11.png)

### References
* [DeepSource configuration for python](https://deepsource.io/docs/analyzer/python.html)
* [Issue categories](https://deepsource.io/docs/reference/issue-categories.html)
* [About Transformers](https://deepsource.io/docs/transformer/)
* [Repository link](https://github.com/pnijhara/sih-2019)
* [Analysis report](https://deepsource.io/gh/pnijhara/sih-2019/issues/)