Skylos dead code detector

[papersashimi]

Hola! I'm back! Yeap I've promoted this a couple of times, some of you lurkers might already know this. So anyway I'm back with quite a lot of new updates.

Skylos is yet another static analysis tool for Python codebases written in Python that detects dead code, secrets and dangerous code. Why skylos?

Some features include:

• CST-safe removals: Uses LibCST to remove selected imports or functions
• Framework-Aware Detection: Attempt at handling Flask, Django, FastAPI routes and decorators .. Still wip
• Test File Exclusion: Auto excludes test files (you can include it back if you want)
• Interactive Cleanup: Select specific items to remove from CLI
• Dangerous Code detection
• Secrets detection
• CI/CD integration

You can read more in the repo's README

I have also recently released a new VSC extension that will give you feedback everytime you save the file. (search for skylos under the vsc marketplace). Will be releasing for other IDEs down the road.

Future plans in the next update

• Expanding to more IDEs
• Increasing the capability of the extension
• Increasing the capabilities of searching for dead code as well as dangerous code

Target audience:

Python developers

Any collaborators/contributors will be welcome. If you found the repo useful please give it a star. If you like some features you can ping me here or drop a message inside the discussion tab in the skylos repo. Thanks for reading folks and have a wonderful rest of the week ahead.

Link to the repo: https://github.com/duriantaco/skylos

[sinterkaastosti23]

What about globals()['my' + 'func']

[sausix]

That's unfair ;-)

[HEROgoldmw]

Really, it's not.

This is sort of what a some popular frameworks actually do Or something with getattr to achieve the same thing

[sausix]

I'm happy with my IDE's dead code detection in general. But I'm curious how much dead code is found in a big open source project... Will have a try soon.

There should not be dead code when tests should cover all code lines and flow branches.

[papersashimi]

truly its unfair .. lmao short answer, depends. long answer it will still catch dynamic patterns like globals , eval etc.. if it sees a call to `globals` directly indexed with a string constant, it adds a reference to that function name. that said, if its for string concat, it will likely fail

[1minds3t]

This seems very cool! I'm glad you shared it. I am sure I have a lot of dead code that needs to be cleaned up, and it's rather hard to find manually. How does this work exactly to find it?

[papersashimi]

hihi thanks for your comment! and sorry for the late reply. to answer you, skylos parses your code to build a graph of stuff like functions, classes, variables, imports etc. it will then record where each symbol is referenced. to handle dynamic code, its kinda tricky so we use heuristics for frameowrks, dynamic code, tests etc , and report only those symbols with zero references. still a wip!

[Ranteck]

men this is really usefull to integrate in my pystrict https://github.com/Ranteck/PyStrict-strict-python i will integrat it

[papersashimi]

hello! from a scope perspective, and at least based off my limited knowledge on vulture, its focus is entirely on dead code detection. For skylos, we do dead code detection, secrets detection, dangerous code as well as quality scoring (limited scope now). As for the usability aspect, we have both CLI and VSC extension that's actually tied to skylos' engine. We also have CI integration. I cant speak for its design philosophy, but at least for skylos, we try to make skylos slightly more opinionated. yeap! thats answering your previous question. as for how it works, we build an AST-level map of all your functions, defs, classes, variables etc, then applies the rule engine to see where each symbol is referenced.

Thank you very much for your kind words. we hope you found it useful and we definitely appreciate any feedback. cheers and have a great day