ANanotherhue·Dec 7, 2021
This advice is largely automated by https://github.com/koalaman/shellcheck
In Common shell script mistakes (2008)koalaman
shellcheck
Haskell2013–2025
koalaman / shellcheck
shellcheck
ShellCheck, a static analysis tool for shell scripts
92Distinct people
100Mentions
5Explicit recommenders
40.3KGitHub stars
What to know before exploring
What it is
ShellCheck, a static analysis tool for shell scripts
GitHub
Where it is used
- GitLab — GitLab uses ShellCheck to lint its shell scripts. It also prescribes a GitLab CI/CD job configuration to run it across projects. Source
- ShellCheck for Visual Studio Code — ShellCheck for Visual Studio Code bundles the ShellCheck tool and uses it to lint shell scripts, showing ShellCheck warnings in the editor and the Problems view. Source
What people are saying
One of my favorite things about Shellcheck is that the error messages come with a link to a wiki page about the problem. Does anyone know other programs that have a similar…
ufo used a recommendation phrase. 5 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- mvdan/sh · linked in 3 of the same discussions
- bash-lsp/bash-language-server · linked in 2 of the same discussions
- hadolint/hadolint · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 10:56:20 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year100 dated mentions
Observed mentions: 2013-11-18 12:25:12 UTC to 2025-12-30 22:10:57 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 6 | 2 | 4 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 8 | 2 | 6 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 9 | 2 | 7 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 6 | 1 | 5 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 13 | 1 | 12 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 13 | 2 | 11 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 15 | 2 | 13 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 9 | 0 | 9 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 1 | 2 |
What Hacker News says
13 sourcesShellcheck Version 0.8.0 Released
4 points · Open discussiontl;dr - If worried about leaking the path to a secret file, use <() (e.g. <( < "${secret_file_path}")) which makes an opaque ephemeral file i.e. /dev/fdX on the command line (1)
Sorry for the top level comment, but I am surprised this hasn't been shared by someone else already. Process substitution(1) (e.g. <(SECRET_STUFF_HERE)) totally solves the problem of leaking secrets to the process table.
From RTFA, the author is using "$(< $STEPPATH/certs/root_ca.crt)" and is concerned about leaking "$STEPPATH/certs/root_ca.crt" to the process table. If the Author instead ran <(< $STEPPATH/certs/root_ca.crt) the process table would just have some junk ephemeral file path instead.
For example... lets say for an arbitrary example, I didn't want folks knowing from the process table that I was getting the file details of /etc/passwd
### LEAKY
~ %
Read the rest
wc /etc/passwd
110 297 6946 /etc/passwd
I could instead use process substitution:
% wc <( < /etc/passwd )
110 297 6946 /dev/fd/11
I have found this to be most useful not for files, but for temporary secret variables that I want to wrap in a file, but not have to deal with the cleanup and management of that file.
For a shell variable example, rather than writing "B64 is not encryption" to a file, and then having to cleanup that file... use process substitution to create the temporary file which doesn't leak to the process table.
## Don't do :
~ % echo "B64 is not encryption" | base64
QjY0IGlzIG5vdCBlbmNyeXB0aW9uCg==
## Do this instead; also 'echo' is a bash builtin and won't leak
~ % base64 <(echo "B64 is not encryption")
QjY0IGlzIG5vdCBlbmNyeXB0aW9uCg==
Or if used in scripting:
secret="B64 is not encryption"
bar="$(base64 <(echo "${secret}"))"
Some caveats: This only works for commands that accept files for arguments. If a command requires a secret to be passed in as a plaintext argument, then maybe the right answer is to rethink using that command in the first place (maybe <<<"HERESTRINGS" (2) helps in that case though I doubt it).
PROTIP: And for the love of all that's holy... run shellcheck(3) before considering running your script for realz if you want to keep your butt out of the fire. Also, the google shell style guide (4) is full of practical/good stuff. Shellcheck and the google style guide are pretty magical. I lost 10 lbs without dieting, became more attractive, and married my wife from following the guidance from those two resources. You can too! (caveat lector, ymmv, not legal advice (ianal), wife is already taken... sorry)
---
(1) https://www.gnu.org/software/bash/manual/html_node/Process-S...
(2) https://en.wikipedia.org/wiki/Here_document#Here_strings
(3) https://github.com/koalaman/shellcheck
(4) https://google.github.io/styleguide/shellguide.html
Yeah, there are still issues with Haskell and the new Mac architecture. Pandoc and ShellCheck are two of the essential tools affected. In the case of ShellCheck, I just downloaded an x86 binary from the GitHub Releases page and put it in /usr/local/bin. Good enough for the time being.
https://github.com/koalaman/shellcheck/releases
In ShellCheck: Finds bugs in your shell scriptsIf you use iTerm2 (or I think this feature is available in other terminal software) you can use "Smart Selections" to transform any ShellCheck errors into links to the wiki.
1. Create a Smart Selection with the regular expression "SC\d+"
2. Add an action to "Open URL...", with the URL "https://github.com/koalaman/shellcheck/wiki/\0" (\0 will be replaced with the matched regex)
3. Now holding down the command key will change any ShellCheck errors to be active http links.
In ShellCheck: Finds bugs in your shell scriptsNote ShellCheck's SC2015, especially if you do stuff with permanent consequences in the place of "say":
"A && B || C is not if-then-else. C may run when A is true":
https://github.com/koalaman/shellcheck/wiki/SC2015
In My Favorite One LinersIf you’re interested in writing safe shell scripts then check out shellcheck:
https://github.com/koalaman/shellcheck
If you’re interested I’ve written a git hook for it that runs a check when you git commit:
https://github.com/alblue/scripts/blob/main/shellcheck-pre-c...
You should also check out her Google shell script style guide:
https://google.github.io/styleguide/shellguide.html
In How to do things safely in Bash (2018)This is really cool and having spoken with the lead dev, Kenneth, I trust that this will continue to be well supported.
This is built on tree-sitter, but there are a couple of other interesting shell parser projects:
* https://github.com/mvdan/sh
* https://github.com/koalaman/shellcheck
At Fig (https://withfig.com), we had to write a bash parser from scratch. These projects all work well in the IDE context, but in a repl environment (ie when typing in your terminal) they don't support incomplete commands very well. e.g if I type `echo "$(` the above parsers will break as the double quote and parentheses are not closed.
In Bash-LSP: A language server for BashOne of my favorite things about Shellcheck is that the error messages come with a link to a wiki page about the problem. Does anyone know other programs that have a similar approach to error messages?
https://github.com/koalaman/shellcheck/wiki/Checks
In ShellCheck: A static analysis tool for shell scriptsShellCheck: A static analysis tool for shell scripts
399 points · Open discussionI highly recommend https://github.com/koalaman/shellcheck It's a wonderful piece of software to help and guide users writing shell scripts. Hook it up to your editor/IDE and all those arcane caveats will be things of the past.
In Intercal, YAML, and Other Horrible Programming LanguagesI like the approach that ShellCheck uses for its verbose error messages. Every error message is identified by an easily-googleable error ID that is not translated and there is a link to the shellcheck wiki where you can find an in-depth explanation of the error and possible ways to fix it.
For example, a typical run of shellcheck might look something like this:
~/test> shellcheck blah.sh
In blah.sh line 2:
echo $1
^-- SC2086: Double quote to prevent globbing and word splitting.
Did you mean:
echo "$1"
For more information:
https://www.shellcheck.net/wiki/SC2086 -- Double quote to prevent globbing ...
https://github.com/koalaman/shellcheck/
In Program Eloquence Considered Harmful