ShellCheck

ShellCheck reads a shell script without running it and points out mistakes and risky patterns. It runs on your own computer and sends your script nowhere, so you can check a script as soon as you write it.

This review is for people who are starting to write sh or bash scripts. After reading it, you can do the following:

• Install ShellCheck and check a script on your computer
• Look up a warning code such as SC2086 on the official wiki
• Silence warnings you don’t need, and add ShellCheck to CI

##What ShellCheck is for

The official README lists these goals:

• Explain the beginner syntax errors that make the shell print cryptic messages
• Point out intermediate-level code that behaves in surprising ways
• Point out subtle pitfalls that can make a working script fail later

ShellCheck supports the sh (POSIX), bash, dash, ksh, and busybox dialects. It picks the dialect from the shebang (such as #!/bin/bash) or the file extension. You can also set it with an option like -s bash.

These checks matter for security:

The SC2115 wiki page shows the fix "${STEAMROOT:?}/"*. With :?, the command fails and stops when the variable is empty or unset.

##Try it safely

1. Install it with a package manager. The official README lists options such as these:

   Environment	Command
   Debian-based	sudo apt install shellcheck
   Fedora-based	dnf install ShellCheck
   macOS (Homebrew)	brew install shellcheck
   Windows	winget install --id koalaman.shellcheck, choco install shellcheck, or scoop install shellcheck
   Docker	docker run --rm -v "$PWD:/mnt" koalaman/shellcheck:stable myscript

   GitHub Releases also has prebuilt binaries for Linux, macOS, and Windows.

2. Create a practice file named test.sh with these two lines. Don’t run it.

   #!/bin/bash
   echo $1

3. Run shellcheck test.sh. ShellCheck flags $1 with SC2086.

4. Change the line to echo "$1" and run ShellCheck again. When the warning is gone, you’re done.

To try it without installing anything, you can paste a script into ShellCheck.net. The pasted script is sent to a server, though. See “Cautions” below.

##Reading results and common options

Each warning has a code that starts with SC and a severity. Open https://www.shellcheck.net/wiki/SC<number> to read a bad example, a fixed example, and the reason. Severities, from most to least serious, are error, warning, info, and style.

ShellCheck exits with 0 when it finds no issues and 1 when it finds some. So adding shellcheck myscripts/*.sh to a Makefile or CI job is enough to fail the build on warnings. The README recommends pinning a specific version in CI, so a new release with new warnings doesn’t break your build by surprise. An official pre-commit hook is also available.

In editors, you can see warnings as you type in VS Code (vscode-shellcheck), Vim (ALE and others), Emacs (Flycheck and others), Sublime Text (SublimeLinter), and more.

##Cautions

##Read next

• cd ../gitleaksGitleaksfinds passwords and API keys committed to a repository
• cd ../trivyTrivya scanner for vulnerabilities and misconfigurations in container images and code