Skip to main content
When Corbulo analyzes your code, it automatically detects which languages are present and runs the appropriate analyzers. No configuration is required — detection is automatic. Analyzers are packaged into isolated container images. Language-specific images run only when that language is detected in the repository. Two cross-language images (analyze-semgrep and analyze-compliance) run on every analysis, regardless of the detected languages.

​
Language-Specific Analyzers

Go and Rust do not have a dedicated image. golangci-lint and clippy both require compiling the project and downloading dependencies, which is a supply-chain attack vector in a multi-tenant analysis environment. Go and Rust code is instead covered by Semgrep’s p/golang and p/rust rule packs in the cross-language Semgrep image below.

​
Cross-Language Analyzers

These run on every repository, independent of language detection.

​
What Gets Ignored

Standard build artifacts and dependency directories are automatically excluded from analysis: These directories contain generated code or third-party dependencies. Analyzing them would produce noise, not signal.

​
How Results Are Used

Analyzer findings are normalized to a unified severity scale: critical, high, medium, low, and info. These findings are merged with results from other sources (AI analysis, code graph, convention checks) and deduplicated so the same issue is never reported twice from different sources. All findings feed into your project’s Code Health score and appear in PR Analysis results.

​
Analyzer Configuration

Analyzers respect your project’s existing configuration files. If your repository contains a ruff.toml, biome.json, .rubocop.yml, phpstan.neon, or equivalent config, Corbulo uses those settings. Your team’s existing rules are honored automatically.
You do not need to configure analyzers in Corbulo. If your repository already has linter configuration, it is picked up and used as-is.