ShellCheck for static analysis in Bash Scripting - Step-by-Step Execution

Concept Flow - ShellCheck for static analysis

Write Bash Script

↓

Run ShellCheck

↓

ShellCheck Analyzes Script

↓

Reports Warnings/Errors

↓

Fix Issues in Script

↓

Repeat or Run Script Safely

The flow shows writing a bash script, running ShellCheck to analyze it, getting feedback, fixing issues, and repeating until the script is safe.

Execution Sample

Bash Scripting

echo "$USER"
if [ "$USER" = "root" ]; then
  echo "You are root"
fi

A simple bash script that prints the user and checks if the user is root.

Execution Table

Step	Action	ShellCheck Output	Explanation
1	Analyze script	Line 2: SC2086: Double quote to prevent globbing and word splitting.	ShellCheck warns that $USER should be quoted in the if condition.
2	Analyze script	No other warnings	No other issues found in the script.
3	Fix script	No warnings	After quoting $USER, ShellCheck finds no problems.
4	Run script	Outputs current user and message if root	Script runs safely after fixes.

💡 ShellCheck stops after reporting all issues or confirming no issues.

Variable Tracker

Variable	Start	After Fix	Final
USER	environment variable	unchanged	unchanged

Key Moments - 2 Insights

Why does ShellCheck warn about quoting $USER in the if condition?

ShellCheck warns because unquoted variables can cause unexpected word splitting or globbing, which can break the script. See execution_table step 1 where SC2086 is reported.

What does it mean when ShellCheck reports no warnings after fixing?

It means the script follows best practices and is less likely to have bugs. Refer to execution_table step 3 where no warnings appear after quoting.

Visual Quiz - 3 Questions

Look at the execution table, what warning does ShellCheck give at step 1?

A SC2086: Double quote to prevent globbing and word splitting.

B SC1009: Unexpected token.

C SC2006: Use $(..) instead of backticks.

D No warnings.

💡 Hint

Check the ShellCheck Output column in execution_table row 1.

At which step does ShellCheck report no warnings?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look at the ShellCheck Output column in execution_table rows 2 and 3.

If you forget to fix the quoting issue, what might happen when running the script?

A Script runs perfectly without issues.

B ShellCheck will automatically fix the script.

C Script may fail or behave unexpectedly due to word splitting.

D Script will print an error message and exit.

💡 Hint

Refer to key_moments question 1 and execution_table step 1 explanation.

Concept Snapshot

ShellCheck is a tool to check bash scripts for errors.
Run it on your script to get warnings and suggestions.
Common issue: unquoted variables causing bugs.
Fix issues and rerun ShellCheck until no warnings.
This helps write safer, more reliable scripts.

Full Transcript

ShellCheck is a static analysis tool for bash scripts. You write your script, then run ShellCheck on it. ShellCheck reads your script and looks for common mistakes, like missing quotes around variables. It reports warnings with codes like SC2086. You then fix these issues in your script, for example by adding quotes around variables like $USER. After fixing, you run ShellCheck again to confirm no warnings remain. This process helps you catch bugs early and write safer scripts. The example script prints the current user and checks if it is root. ShellCheck warns about unquoted $USER in the if condition. After quoting it, no warnings remain and the script runs safely.

Practice

1. What is the main purpose of using ShellCheck in shell scripting?

easy

A. To find errors and suggest fixes before running the script

B. To execute the script faster

C. To convert shell scripts to Python

D. To add colors to the terminal output

Solution

1. Step 1: Understand what ShellCheck does

   ShellCheck is a tool that analyzes shell scripts without running them to find mistakes.

2. Step 2: Identify the main benefit

   It helps catch errors early, like missing quotes or bad syntax, making scripts safer.

3. Final Answer:

   To find errors and suggest fixes before running the script -> Option A

4. Quick Check:

   ShellCheck finds errors [OK]

Hint: ShellCheck checks scripts for errors before execution [OK]

Common Mistakes:

• Thinking ShellCheck runs the script
• Believing it speeds up script execution
• Confusing it with a code converter

2. Which of the following is the correct way to run ShellCheck on a script named myscript.sh?

easy

A. bash shellcheck myscript.sh

B. checkshell myscript.sh

C. run shellcheck myscript.sh

D. shellcheck myscript.sh

Solution

1. Step 1: Recall the ShellCheck command syntax

   The correct command to run ShellCheck is simply shellcheck followed by the script name.

2. Step 2: Verify the options

   Options B, C, and D use incorrect command names or extra words.

3. Final Answer:

   shellcheck myscript.sh -> Option D

4. Quick Check:

   Use 'shellcheck scriptname' [OK]

Hint: Use 'shellcheck' command followed by script name [OK]

Common Mistakes:

• Typing 'checkshell' instead of 'shellcheck'
• Adding extra words like 'run' before the command
• Using 'bash shellcheck' which is invalid

3. Given this script echo Hello $name and running shellcheck script.sh, what warning will ShellCheck most likely show?

medium

A. SC1000: Syntax error near unexpected token.

B. SC2001: Use 'sed' instead of 'echo'.

C. SC2086: Double quote to prevent globbing and word splitting.

D. No warnings, script is perfect.

Solution

1. Step 1: Understand ShellCheck's common warnings

   ShellCheck warns when variables are unquoted because it can cause word splitting or globbing.

2. Step 2: Match warning to the script

   The script uses $name without quotes, so ShellCheck will warn about missing quotes (SC2086).

3. Final Answer:

   SC2086: Double quote to prevent globbing and word splitting. -> Option C

4. Quick Check:

   Unquoted variables cause SC2086 warning [OK]

Hint: Look for unquoted variables to spot SC2086 warnings [OK]

Common Mistakes:

• Expecting syntax errors for simple echo
• Thinking no warning appears for unquoted variables
• Confusing warning codes with unrelated messages

4. You have this script snippet:

if [ $count -eq 10 ]; then
echo "Count is 10"
fi

ShellCheck reports an error. What is the best fix?

medium

A. Add quotes around $count: if [ "$count" -eq 10 ]; then

B. Remove the spaces inside [ ]

C. Change -eq to ==

D. Add a semicolon after echo statement

Solution

1. Step 1: Identify the ShellCheck warning cause

   Using $count without quotes can cause errors if $count is empty or contains spaces.

2. Step 2: Apply the fix

   Adding quotes around $count ensures the test works safely even if the variable is empty.

3. Final Answer:

   Add quotes around $count: if [ "$count" -eq 10 ]; then -> Option A

4. Quick Check:

   Quote variables in tests to avoid errors [OK]

Hint: Always quote variables inside [ ] tests [OK]

Common Mistakes:

• Removing spaces inside [ ] which breaks syntax
• Using == instead of -eq for numbers
• Adding unnecessary semicolons

5. You want to write a script that reads a filename from user input and safely prints its contents. Which ShellCheck advice should you follow?

hard

A. Use backticks instead of $( ) for command substitution

B. Always quote variables when using them, e.g., cat "$filename"

C. Avoid quoting variables to allow filename expansion

D. Use eval to run commands with variables

Solution

1. Step 1: Understand safe variable usage

   Quoting variables prevents word splitting and globbing, which can cause errors or security issues.

2. Step 2: Apply ShellCheck best practice

   ShellCheck recommends quoting variables like "$filename" when used in commands like cat.

3. Final Answer:

   Always quote variables when using them, e.g., cat "$filename" -> Option B

4. Quick Check:

   Quote variables to avoid unsafe expansions [OK]

Hint: Quote variables to prevent unsafe expansions [OK]

Common Mistakes:

• Using backticks which are outdated
• Not quoting variables causing errors
• Using eval which can be dangerous