LGTM Code Analysis

[swissspidy]

Feature description

I noticed that the amphtml repo uses LGTM for code analysis, which seems to provide some useful results that might not be caught by other linters.

I've just set it up for the Web Stories repo and fixed quite a few bugs found by it:

GoogleForCreators/web-stories-wp#8900

For the AMP plugin there are not too many alerts, which is good: https://lgtm.com/projects/g/ampproject/amp-wp/?mode=list

Setting up LGTM for this repo would be as easy as installing the GitHub app via https://lgtm.com/projects/g/ampproject/amp-wp/ci/ so LGTM will be added as a status check for PRs and can leave comments and such.

Then, it's about fixing alerts or ignoring some if needed.

There are also status badges for the readme if desired.

---

Do not alter or remove anything below. The following sections will be managed by moderators only.

Acceptance criteria

Implementation brief

QA testing instructions

Demo

Changelog entry

[pierlon]

This indeed looks like a good status check to have for our PRs. At the same time we could add the CodeQL GitHub Action to scan for security vulnerabilities.

@westonruter Any objection to adding the LGTM GitHub app?

[pierlon]

Note that LGTM (and CodeQL) at this time would only support our Python & JavaScript codebase, and not PHP. We already have PHPStan doing static code analysis on that part, though.

[westonruter]

SGTM! 😄

[swissspidy]

Yeah we‘ve been using CodeQL for some time as well already. Some of its errors are apparently based on LGTM, so there‘s some overlap. Still useful though.

[westonruter]

LGTM has now been enabled for the repo: https://lgtm.com/projects/g/ampproject/amp-wp