# Supported languages

> Every language MergeHarbor reviews, grouped by how much code structure it understands, from full parsing to plain text.

MergeHarbor reviews pull requests in any text file. What changes from one language to another is how much of the code's structure it understands. That structure decides how well it finds related code, follows calls across files and spots changed code without tests.

There are three support levels:

- **Full.** MergeHarbor parses the file with a real grammar. It finds functions, classes and methods with their exact line ranges, plus the calls and references between them. Impact analysis follows those edges across the repository.
- **Structural.** There is no reliable grammar for the language, so MergeHarbor uses a purpose-built line parser. It finds definitions (procedures, paragraphs, job steps, methods) and the calls between them, such as COBOL `PERFORM` and `CALL`, JCL `EXEC PGM=` or ABAP `CALL FUNCTION`. This is enough for related-code search and impact analysis, but it does not resolve types, and unusual formatting can hide a definition.
- **Text.** MergeHarbor splits the file into chunks that break at blank lines and headings and searches them by text and meaning. It finds no symbols.

At every level, the reviewer is told each changed file's language. For the languages listed with guidance below, it also gets a short list of the failure modes to check first, such as SOQL inside loops in Apex or truncation in COBOL `MOVE`s.

Some languages are recognized from content rather than the file name. A Python file that uses Spark is reviewed as PySpark. A YAML file with `apiVersion` and a Kubernetes `kind` is reviewed as a Kubernetes manifest. A `.sql` file with `GO` batches or `[dbo]` names is reviewed as T-SQL.

## Full support

- **Application:** Python, Java, C, C++, C#, JavaScript, TypeScript, TypeScript (TSX), Kotlin, PHP, Swift, Go, Ruby, Scala, Rust, Elixir, Groovy.
- **Data and SQL:** PySpark.
- **Infrastructure:** Terraform / HCL, Bash / shell, Starlark (Bazel), Protocol Buffers.

## Structural support

- **Application:** Dart, Lua, R, Objective-C, Haskell, Perl.
- **Data and SQL:** SQL, T-SQL, PL/SQL.
- **Enterprise platforms:** ABAP (SAP), Apex (Salesforce).
- **Legacy and mainframe:** COBOL, JCL, PL/I, RPG, Visual Basic 6 / VBA, VB.NET, Flex / ActionScript.
- **Infrastructure:** Dockerfile, PowerShell.

## Text support

- **Application:** Zig, Vue, Svelte.
- **Infrastructure:** Kubernetes YAML, Makefile, GraphQL.
- **Markup and config:** HTML, CSS / SCSS, XML, JSON, YAML, TOML, INI / properties, Markdown.
- **Other:** Plain text.

Language guidance covers every language with full or structural support except Starlark (Bazel), plus Kubernetes YAML, HTML and XML.

## Deterministic checks for these languages

Alongside the model review, a few zero-cost checks run on every pull request. They report only patterns that are almost always real problems:

- `apex.soql-injection`: a SOQL value concatenated into the query text.
- `sql.dynamic-concat`: PL/SQL or T-SQL dynamic SQL built by concatenating a parameter.
- `jcl.hardcoded-password`: a literal `PASSWORD=` in JCL.
- `terraform.hardcoded-secret`: a password, key or token set to a literal in Terraform.
- `docker.unpinned-base` and `docker.root-user`: a `:latest` or untagged base image, and a final stage that runs as root.

Turn any of them off with `checks.disable` in `.mergeharbor.yml`. See [Configure reviews](https://mergeharbor.com/docs/configuration).

## Limits

- Files with an extension that is not listed are not indexed for search. They are still reviewed when a pull request changes them.
- Structural parsers read definitions line by line. Generated code, macros and unusual layouts (for example a COBOL paragraph name outside area A) can be missed.
- Fixed-format COBOL, RPG and JCL are read with their column rules. Sequence numbers in columns 73-80 are ignored.
- Haskell has definitions but no call edges, because function application has no syntax a line parser can trust.