What is ShellCheck?
ShellCheck is a static analysis tool designed to identify and report syntax errors and potential issues in shell scripts. ShellCheck helps developers improve the quality, safety, and performance of their scripts. ShellCheck offers suggestions and explanations for each identified issue, making it a helpful resource for both novice and experienced shell scripters.
ShellCheck primarily focuses on scripts written for sh, including derivatives and extensions such as Bash, Dash, and Ksh. It's adept at handling scripts with various shebangs (#!/bin/sh, #!/bin/bash, etc.) and even scripts without a shebang, assuming a Bourne-like shell syntax.
Installing ShellCheck
With Trunk Check, you can automatically install and configure ShellCheck along with any relevant linters in a few straightforward steps. Here's how:
First, if you haven't already installed Trunk CLI, you can do so with the command below:
1curl https://get.trunk.io -fsSL | bash
Next, you can initialize Trunk from the root of your git repository:
1trunk init
This command will scan your repository and create a .trunk/trunk.yaml file that enables all linters, formatters, and security analyzers, recommended by Trunk Check. This includes ShellCheck if applicable to your project.
To see all available linters Trunk Check installed, simply run:
1trunk check list
If you find ShellCheck is not automatically enabled, you can do so by running:
1trunk check enable shellcheck
Alternatively, to disable ShellCheck run the command below. To disable other tooling applied by Trunk Check, simply replace schellcheck with the respective tool you're looking to disable.
1trunk check disable shellcheck
For more details on Trunk Check setup, see here.
Configuring ShellCheck
Most linters provide some mechanism to tweak their configuration, e.g. .eslintrc or Cargo.toml. Trunk is aware of all the ways individual tools are configured and supports them. This means linters you've already configured will continue to work exactly the same, just now supercharged by Trunk Check.
Like many linters with Trunk, ShellCheck works out of the box so there's no need to set up a custom configuration. You can learn more about shellcheck and its config in our docs.
If you're interested in other tooling outside of ShellCheck, check out our open-source repository to see how we define and support 90+ linters.
Running ShellCheck
To check your code with ShellCheck, run the command below. This command executes ShellCheck, along with any other linters Trunk Check has enabled on files you've modified. Since Trunk is git-aware, it knows what you've changed, and by adding batched execution and caching, you end up with a much faster and smoother way to run ShellCheck and other tools.
1trunk check
If you prefer to check files you've modified with ShellCheck only, run the following:
1trunk check --filter=shellcheck
Although we'd recommend against it depending on the size of your repository, you can check all files with ShellCheck by running the command below.
1trunk check --all --filter=shellcheck
In most scenarios, you'll want to execute against modified files. Since Trunk is git-aware, it knows what you've changed, and by adding batched execution and caching, you end up with a much faster and smoother way to run ShellCheck and other tools.
Updating Trunk Check & ShellCheck
To upgrade the Trunk CLI along with all plugins and linters in your trunk.yaml simply run:
1trunk upgrade
We highly recommend running on the latest validated versions of tools as updates will frequently include important security fixes and additional valuable checks. Trunk only auto-suggests linter upgrades to versions that we have tested and support, so you may see a slight lag time when a new linter version is released.
Upgrade will also recommend new tools that have become applicable since the last time your repository was scanned. This can be a result of using new technologies in your repository or Trunk itself adding support for more tools. If you don't like a particular recommendation, you can always run trunk check disable <linter> to teach trunk not to recommend it.
Recommended Linters to Pair with ShellCheck
While ShellCheck excels in shell script analysis, pairing it with other linters can help in multi-language projects. Some recommended linters to complement ShellCheck are:
ESLint for JavaScript, to maintain code quality and adherence to best practices in scripts that may interact with shell scripts.
Prettier for code formatting across various languages, ensuring consistent style.
Flake8 for Python scripts, combining the power of
pyflakes,pycodestyle, andmccabefor comprehensive code checks.