Nada

Go Code Quality Analyzer

A comprehensive static analysis tool for Go codebases that detects bugs, vulnerabilities, code smells, and provides quality metrics similar to SonarQube.

Get Started GitHub
Terminal
$ nada analyze .
🎯 Nada Code Quality Report
===========================
📁 Project: ./my-go-project
📊 Grade: 🟢 A (92.5/100)
📄 Files Analyzed: 15
📏 Lines of Code: 2,847
🔄 Avg Complexity: 4.2
🧪 Test Coverage: 87.3%
📋 Issues Summary:
🔴 High: 0
🟡 Medium: 3
🟢 Low: 8
🚪 Quality Gates: ✅ PASSED

Features

Comprehensive code analysis for Go projects

Static Code Analysis

Deep AST-based inspection of Go syntax trees with comprehensive rule engine

Security Scanning

Detects vulnerabilities including SQL injection, hardcoded secrets, and unsafe practices

Bug Detection

Identifies potential runtime issues, logic errors, and missing error handling

Complexity Analysis

Measures cyclomatic complexity and identifies overly complex functions

Quality Metrics

Comprehensive scoring system with grades A-F and quality trend analysis

Multiple Formats

CLI tool with console output, JSON export, and REST API interface

Installation

Get started with Nada in seconds

Install via Go

go install github.com/chaksack/nada@latest

Requires Go 1.21 or later. The binary will be installed to $GOPATH/bin/nada.

Download Binary

Download the latest release for your platform:

🐧 Linux AMD64 🍎 macOS AMD64 🍎 macOS ARM64 🪟 Windows AMD64

Docker

docker run --rm -v $(pwd):/workspace chaksack/nada analyze /workspace

Run Nada in a containerized environment without local installation.

Build from Source

git clone https://github.com/chaksack/nada.git
cd nada
make build

The binary will be built to build/nada.

Usage

Learn how to use Nada effectively

Basic Analysis

# Analyze current directory
nada analyze .

# Analyze specific project
nada analyze /path/to/project

# Export to JSON
nada analyze . --output report.json

Advanced Options

# Include test files
nada analyze . --include-tests

# Verbose output
nada analyze . --verbose

# Exclude files
nada analyze . --exclude='*_test.go,vendor/*'

# With coverage profile
nada analyze . --coverage=coverage.out

Git Integration

# Analyze only staged changes
nada analyze . --diff=staged

# Analyze changes since main
nada analyze . --diff=origin/main

# Analyze unstaged changes
nada analyze . --diff=unstaged

Command Reference

Flag Short Description Default
--output -o Output file for JSON report -
--coverage -c Coverage profile file -
--diff -d Analyze only changes -
--verbose -v Verbose output false
--include-tests -t Include test files false
--exclude -e Exclude file patterns []

Analysis Rules

Comprehensive rule reference for code quality analysis

Complexity Analysis

complexity

Checks for high cyclomatic complexity, deep nesting, and large functions

Detects:

  • high_complexity - Functions with cyclomatic complexity > 10 (threshold: 15 for high severity)
  • large_function - Functions longer than 50 lines (threshold: 100 for high severity)
  • deep_nesting - Code nested more than 4 levels deep

Security Analysis

security

Detects security vulnerabilities including hardcoded secrets, SQL injection, and unsafe practices

Detects:

  • hardcoded_secret - Hardcoded passwords, API keys, tokens, and private keys
  • sql_injection - Potential SQL injection vulnerabilities in query construction

Documentation

documentation

Checks for missing function and type documentation

Detects:

  • missing_doc - Missing documentation comments for exported functions and types
  • incomplete_doc - Inadequate or incomplete documentation

Error Handling

error_handling

Checks for proper error handling and deprecated function usage

Detects:

  • ignored_error - Ignored error return values
  • deprecated_usage - Usage of deprecated functions or packages
  • improper_error_handling - Inadequate error handling patterns

Naming Conventions

naming

Checks for proper Go naming conventions and descriptive names

Detects:

  • long_name - Excessively long function or variable names
  • short_name - Non-descriptive short names
  • naming_convention - Violations of Go naming conventions

Code Structure

structure

Checks for structural issues like TODO comments, long lines, and unused imports

Detects:

  • todo_comment - TODO, FIXME, and HACK comments
  • long_line - Lines exceeding recommended length (120 characters)
  • unused_import - Unused import statements

Severity Levels

🔴 High

Critical issues that should be fixed immediately (security vulnerabilities, major bugs)

🟡 Medium

Important issues that affect code quality and maintainability

🟢 Low

Minor issues and code style improvements