What Is a Linter?

A linter scans source code for problems WITHOUT running it. It catches:

• Bugs: unused variables, unreachable code, off-by-one risks, == vs is.
• Style: indentation, line length, naming conventions.
• Antipatterns: mutable default args in Python, == NaN, missing await.
• Security: SQL injection, hard-coded secrets, weak crypto.

Examples: ESLint (JS), Pylint/Flake8/Ruff (Python), clippy (Rust), shellcheck (Bash), golangci-lint (Go).

Why static analysis works:

• Many bugs follow patterns visible in the AST (no execution needed).
• Type information (when available) catches more.
• It's CHEAP — milliseconds vs minutes for tests.

Lint vs format:

• Linter finds problems, may suggest fixes.
• Formatter (black, gofmt, prettier) rewrites style. No bug-finding.

We'll build a Python linter (any language is similar). Start with simple regex rules, then move to AST-based checks (more powerful, fewer false positives).

Architecture:

source code -> lexer -> tokens -> parser -> AST -> visitors run rules -> diagnostics -> output

Each rule is a class/function that walks the AST and emits diagnostics: (line, column, severity, message, rule_id).