ShellCheck: A static analysis tool for shell scripts

• ShellCheck

  488 34,934 8.6 Haskell

  ShellCheck, a static analysis tool for shell scripts

One of my favorite things about Shellcheck is that the error messages come with a link to a wiki page about the problem. Does anyone know other programs that have a similar approach to error messages?

https://github.com/koalaman/shellcheck/wiki/Checks

• sh

  21 6,751 7.8 Go

  A shell parser, formatter, and interpreter with bash support; includes shfmt (by mvdan)

This is one of my favorite tips for almost effortlessly improving devops productivity (along with using https://github.com/mvdan/sh for auto-formatting) — by now shellcheck has good editor support in e.g. VSCode and I have a standard pre-commit.com hook for all of my projects. I've seen so many long iterations where people flail at a complex shell script for something like a cron job which was immediately flagged by shellcheck. I generally recommend rewriting in Python but this is a good less invasive step.

One thing which might be worth considering is adding this to your personal ~/.shellcheckrc to make it more pedantic:

enable=all

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• hadolint

  24 9,677 2.3 Haskell

  Dockerfile linter, validate inline bash, written in Haskell

  

Hadolint is another. It's built atop shellcheck.

https://github.com/hadolint/hadolint

• find-sec-bugs

  8 2,201 6.1 Java

  The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

  

find-sec-bugs does that. It's used by, for example, SonarQube.

See hhttps://github.com/find-sec-bugs/find-sec-bugs/blob/master/f... and do a "CTRL-F" and search for "References".

• shunit2

  4 1,546 3.5 Shell

  shUnit2 is a xUnit based unit test framework for Bourne based shell scripts.

Alongside ShellCheck, I also use shUnit2 as my unit testing framework. Yes, you should test your bash.

https://github.com/kward/shunit2

• shellharden

  16 4,537 4.7 Rust

  The corrective bash syntax highlighter

I haven't used it, but I have seen something similar called shellharden. It pitches it's advantage as being able to auto apply the changes.

https://github.com/anordal/shellharden

• static-analysis

  15 12,811 9.4 Rust

  ⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

  

Same. Few years ago I started a little list of linters. Just kept adding tools and the list is huge now thanks to lots of contributors. https://github.com/analysis-tools-dev/static-analysis

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• Task

  113 9,977 9.6 MDX

  A task runner / simpler Make alternative written in Go

  

I really like task (http://taskfile.dev/) as a more usable layer on top of mydan/sh. Task is basically make but with a yaml syntax and built-in posix shell interpreter all in a single statically linked executable. It makes building something even on Windows a total breeze.

• spdk

  6 2,820 9.9 C

  Storage Performance Development Kit

  

Since the project I work on (https://spdk.io) largely produces a set of executables as output, it was most natural to write the tests in bash. There's one top level bash script that kicks off the full suite of tests and thousands and thousands of lines of tests all written as bash scripts stringing together calls to these executables.

One of these tests is to run shellcheck against all of the scripts in the repo. We don't allow any modifications to scripts without shellcheck giving them the green light now. The quality of our tests has increased dramatically since this was instituted - it's a really great tool.

• bats-core

  23 4,607 8.9 Shell

  Bash Automated Testing System

  

And talking about tests... I recommend [bats](https://github.com/bats-core/bats-core) for testing! I'm slowly adding tests to my dotfiles using this.

• shellcheck-repl

  4 15 3.1 Shell

  Validation of Shell Commands Before Evaluation

shellcheck-repl: Validation of Shell Commands Before Evaluation

https://github.com/HenrikBengtsson/shellcheck-repl

This tool validates your commands at the Bash prompt using ShellCheck and refuses to evaluate them if there's a mistake. It ignores a set of rules that doesn't play well with oneliners.

(Disclaimer: I'm one of the authors)

Suggest a related project