Developer Tools
Tooling categories and recommendations for modern software development workflows.
| Category |
Purpose |
Key Notes |
| Developer Tools |
IDE, debugging, profiling, CLI |
Developer Tools |
| Build Tools |
Compilation, bundling, task automation |
Build Tools |
| Static Analysis |
Linting, type checking, SAST |
Static Analysis |
| Package Management |
Dependencies, lockfiles, registries |
Package Management |
Selection Principles
- Standardize per language — One toolchain per language across the org
- Fast feedback — Tools must run in seconds locally, minutes in CI
- Automation first — Pre-commit hooks, CI gates, IDE integration
- Actionable output — Clear errors with fix suggestions
- Low friction — Zero-config where possible; sensible defaults
Recommended Stack by Language
| Language |
IDE |
Lint/Format |
Type Check |
Build |
Package |
| TypeScript/JS |
VS Code + Biome |
Biome |
tsc --noEmit |
Vite/esbuild |
pnpm |
| Python |
VS Code + Pylance |
Ruff |
mypy |
uv/hatch |
uv |
| Go |
GoLand / VS Code + gopls |
golangci-lint |
go vet |
go build |
Go modules |
| Rust |
VS Code + rust-analyzer |
clippy + rustfmt |
cargo check |
cargo build |
Cargo |
| JVM (Kotlin) |
IntelliJ IDEA |
detekt + ktlint |
Kotlin compiler |
Gradle (KTS) |
Gradle |
| JVM (Scala) |
IntelliJ + Metals |
scalafix + scalafmt |
Scala compiler |
Mill/sbt |
Coursier |
| JVM (Java) |
IntelliJ IDEA |
Checkstyle/SpotBugs |
javac |
Gradle/Maven |
Maven Central |
Version Control
- Git — Conventional commits; trunk-based development
- Git hooks —
pre-commit framework (language-agnostic)
- Git LFS — Large assets (not code)
Code Review
- GitHub/GitLab PRs — Required reviews; automated checks
- Review automation — Dependabot, Renovate, code owners
CI/CD
- GitHub Actions / GitLab CI — Pipeline as code
- Dagger / Earthly — Portable CI pipelines
- Act — Run GitHub Actions locally
Documentation
- MkDocs / Docusaurus / VitePress — Static sites from markdown
- OpenAPI/Swagger — API docs from code
- ADR tools —
adr-tools for architecture decisions
Security
- SAST — Semgrep, CodeQL, SonarQube
- SCA — OWASP Dependency Check, Snyk, Trivy
- Secrets — GitLeaks, TruffleHog, detect-secrets
- Container — Trivy, Grype, Cosign/Sigstore
Observability (Local Dev)
- Docker Compose — Local stack (DB, Kafka, Redis)
- Testcontainers — Integration tests with real services
- Telepresence — Local dev against remote cluster
- Tilt / Garden — Live reload for Kubernetes dev
Anti-Patterns
| Anti-Pattern |
Fix |
| Tool sprawl |
Standardize; one tool per category per language |
| Slow CI |
Parallelize; cache aggressively; fail fast |
| Ignored warnings |
Treat warnings as errors; fix or suppress with justification |
| Manual steps |
Automate everything repeatable |
| Outdated tools |
Regular upgrade cadence; dependabot/renovate |
| No local parity |
CI tools = local tools (same versions, configs) |
- Developer Tools — IDE, debugging, profiling
- Build Tools — Compilation, bundling, automation
- Static Analysis — Linting, type checking, SAST
- Package Management — Dependencies, registries
- CI CD Best Practices — Pipeline integration
- Supply Chain Security — Tooling for supply chain
Sources: Thoughtworks Technology Radar, CNCF Landscape, GitHub Octoverse, Stack Overflow Survey, JetBrains Developer Ecosystem
