ShellCheck for static analysis in Bash Scripting

Introduction

ShellCheck helps find mistakes in your shell scripts before you run them. It points out errors and suggests fixes so your scripts work better.

Before running a new shell script to catch typos or syntax errors.

When you want to improve an existing script and make it safer.

To learn better shell scripting habits by seeing suggestions.

When sharing scripts with others to ensure they are error-free.

Syntax

Bash Scripting

shellcheck [options] script.sh

Replace script.sh with your script file name.

You can run ShellCheck from the command line on your computer.

Examples

Check the script named myscript.sh for errors and warnings.

Bash Scripting

shellcheck myscript.sh

Show output in GCC style format, useful for some editors.

Bash Scripting

shellcheck -f gcc myscript.sh

Ignore warning SC2086 (word splitting) for this run.

Bash Scripting

shellcheck -e SC2086 myscript.sh

Sample Program

This script tries to read a file but forgets to quote the variable. ShellCheck will warn about this.

Bash Scripting

#!/bin/bash

# Example script with a common mistake
filename="some file.txt"
cat $filename

# Run ShellCheck on this script to see the warning

Important Notes

Always fix warnings about quoting variables to avoid bugs.

ShellCheck can be integrated into many code editors for instant feedback.

It works offline and does not run your script, so it is safe to use.

Summary

ShellCheck finds errors in shell scripts before running them.

Use it to catch common mistakes like missing quotes or wrong syntax.

It helps write safer and more reliable shell scripts.

Practice

1. What is the main purpose of using ShellCheck in shell scripting?

easy

A. To find errors and suggest fixes before running the script

B. To execute the script faster

C. To convert shell scripts to Python

D. To add colors to the terminal output

Solution

1. Step 1: Understand what ShellCheck does

   ShellCheck is a tool that analyzes shell scripts without running them to find mistakes.

2. Step 2: Identify the main benefit

   It helps catch errors early, like missing quotes or bad syntax, making scripts safer.

3. Final Answer:

   To find errors and suggest fixes before running the script -> Option A

4. Quick Check:

   ShellCheck finds errors [OK]

Hint: ShellCheck checks scripts for errors before execution [OK]

Common Mistakes:

• Thinking ShellCheck runs the script
• Believing it speeds up script execution
• Confusing it with a code converter

2. Which of the following is the correct way to run ShellCheck on a script named myscript.sh?

easy

A. bash shellcheck myscript.sh

B. checkshell myscript.sh

C. run shellcheck myscript.sh

D. shellcheck myscript.sh

Solution

1. Step 1: Recall the ShellCheck command syntax

   The correct command to run ShellCheck is simply shellcheck followed by the script name.

2. Step 2: Verify the options

   Options B, C, and D use incorrect command names or extra words.

3. Final Answer:

   shellcheck myscript.sh -> Option D

4. Quick Check:

   Use 'shellcheck scriptname' [OK]

Hint: Use 'shellcheck' command followed by script name [OK]

Common Mistakes:

• Typing 'checkshell' instead of 'shellcheck'
• Adding extra words like 'run' before the command
• Using 'bash shellcheck' which is invalid

3. Given this script echo Hello $name and running shellcheck script.sh, what warning will ShellCheck most likely show?

medium

A. SC1000: Syntax error near unexpected token.

B. SC2001: Use 'sed' instead of 'echo'.

C. SC2086: Double quote to prevent globbing and word splitting.

D. No warnings, script is perfect.

Solution

1. Step 1: Understand ShellCheck's common warnings

   ShellCheck warns when variables are unquoted because it can cause word splitting or globbing.

2. Step 2: Match warning to the script

   The script uses $name without quotes, so ShellCheck will warn about missing quotes (SC2086).

3. Final Answer:

   SC2086: Double quote to prevent globbing and word splitting. -> Option C

4. Quick Check:

   Unquoted variables cause SC2086 warning [OK]

Hint: Look for unquoted variables to spot SC2086 warnings [OK]

Common Mistakes:

• Expecting syntax errors for simple echo
• Thinking no warning appears for unquoted variables
• Confusing warning codes with unrelated messages

4. You have this script snippet:

if [ $count -eq 10 ]; then
echo "Count is 10"
fi

ShellCheck reports an error. What is the best fix?

medium

A. Add quotes around $count: if [ "$count" -eq 10 ]; then

B. Remove the spaces inside [ ]

C. Change -eq to ==

D. Add a semicolon after echo statement

Solution

1. Step 1: Identify the ShellCheck warning cause

   Using $count without quotes can cause errors if $count is empty or contains spaces.

2. Step 2: Apply the fix

   Adding quotes around $count ensures the test works safely even if the variable is empty.

3. Final Answer:

   Add quotes around $count: if [ "$count" -eq 10 ]; then -> Option A

4. Quick Check:

   Quote variables in tests to avoid errors [OK]

Hint: Always quote variables inside [ ] tests [OK]

Common Mistakes:

• Removing spaces inside [ ] which breaks syntax
• Using == instead of -eq for numbers
• Adding unnecessary semicolons

5. You want to write a script that reads a filename from user input and safely prints its contents. Which ShellCheck advice should you follow?

hard

A. Use backticks instead of $( ) for command substitution

B. Always quote variables when using them, e.g., cat "$filename"

C. Avoid quoting variables to allow filename expansion

D. Use eval to run commands with variables

Solution

1. Step 1: Understand safe variable usage

   Quoting variables prevents word splitting and globbing, which can cause errors or security issues.

2. Step 2: Apply ShellCheck best practice

   ShellCheck recommends quoting variables like "$filename" when used in commands like cat.

3. Final Answer:

   Always quote variables when using them, e.g., cat "$filename" -> Option B

4. Quick Check:

   Quote variables to avoid unsafe expansions [OK]

Hint: Quote variables to prevent unsafe expansions [OK]

Common Mistakes:

• Using backticks which are outdated
• Not quoting variables causing errors
• Using eval which can be dangerous