PoC - Static analyzer for Python

[josh-berry]

No description provided.

[dandavison]

Ultimately, we want static analysis for Temporal SDKs to be both runnable as a standalone process and easily integratable into LSP-based IDE tooling.

One possibility here would be mypy plugins. However, it's not clear that mypy is going to be dominant in the future of Python type-checking: Microsoft subsequently created Pyright, which is more closely associated with and widely deployed in developer LSP tooling due to VSCode (as well as a bit faster and perhaps has some other advantages). However, my impression is that Pyright will not provide extensibility of the sort that we need.

Now, Astral are creating a new Python type-checker. Astral's ruff linter and formatter has been extremely well received, and they have created LSP tools to go with it. Clearly, their type checker will be integrated into their LSP solution. (They've also released a competitor to pip/poetry/pyenv etc).

I think that we should watch this space. In particular to understand whether Astral are creating type-checking technology that is extensible in a way that we can make use of, and if so when it would make sense to start prototyping.

[cretz]

Basically there are two static analyzers needed IMO:

• General purpose Python static analyzer that catches people making thread-blocking calls (directly or transitively) in an async def function
• Temporal-specific Python static analyzer that catches people making illegal calls (directly or transitively) in a workflow

The first one should be a general product/repo IMO, but they both need a call graph so there is an opportunity for code sharing.

I have POC'd this with MyPy plugins by the way. You can build a reasonable call graph but storing it in cache is difficult because they only allow you to set some plugin metadata at a higher level not a per function level (read https://github.com/python/mypy/blob/master/mypy/plugin.py). It can be hacked, but I think we should contribute a very small PR to MyPy to allow plugins to store a metadata dict on more specific objects.

I have researched a good bit about Python call graph builders and there are no good/fast modern ones. And I've only found MyPy to provide extensibility and semantic analysis to build proper call graphs (this can't be done without static analysis). It will be great if Ruff gets this analysis, we could definitely build on it.