Hey r/golang ! For the past 2 months, I've been working really hard on a static analysis tool called gohawk , and have successfully used it to find bugs in Caddy , Docker , and Kubernetes . It's meant to catch resource leaks and concurrency errors in Go code, such as the following example:

func fetch(url string) ([]byte, error) { resp, err := http.Get(url) if err != nil { return nil, err } if resp.StatusCode != http.StatusOK { return nil, fmt.Errorf("unexpected status: %s", resp.Status) // resp isn't closed on all paths } defer resp.Body.Close() return io.ReadAll(resp.Body) }

I built this tool after realizing that Staticcheck and other linters don't really cover this ground yet. It works by building a symbolic heap model of the program under analysis, so that it can track object references with a high degree of accuracy.…