ShellCheck

What it is

ShellCheck reads Bash and sh scripts and warns about problems without running them. Each warning has a code, such as SC2086 ("Double quote to prevent globbing and word splitting"), and a page on its wiki explaining the problem, why it matters and how to fix it. You can paste a script into shellcheck.net, run shellcheck script.sh in the terminal, or install an extension so your editor underlines issues as you type. It is open source on GitHub and available from most package managers, including apt and Homebrew.

Why it matters

Shell scripts fail in surprising ways. An unquoted variable with a space in it splits into two arguments; a failed cd followed by rm deletes files in the wrong folder; a typo in a test silently evaluates to true. These bugs rarely show up in quick testing and then break on real data. ShellCheck catches a large share of them automatically, and its explanations teach you how the shell actually behaves, which makes you a better script writer even when it is not running.

How to use it well

• Run it on every script before you commit it, and aim for zero warnings.
• Read the wiki page for any warning you do not understand rather than silencing it.
• Add it to your editor (the VS Code extension is popular) so feedback is immediate.
• Add it to CI for repositories with scripts, so every pull request is checked.

Is it worth it?

Yes. It is free, fast and widely used, and there is little reason not to run it. It will not tell you whether your script does the right thing, so you still need to test with realistic inputs, but it removes most of the classic mistakes.

Common questions

Does it support zsh? No. It checks sh, Bash, dash and ksh scripts. Write scripts for Bash if you want them checked.

Can I disable a warning? Yes, with a # shellcheck disable=SC.... comment, but only when you understand the warning and have a real reason.

Is it free? Yes. It is open source under the GPL.