Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is there a static analysis tool like Lint or Perl::Critic for shell scripts?

Are there any shell (specifically bash or ksh) checkers that test shell scripts for style, best practices, naming conventions, etc? (Something like Lint for C, or Perl::Critic for Perl.)

I know with ksh you can do syntax checking by running ksh -n script.ksh but I was hoping for something more than just sytax checking - something that parses/analyzes the actual code?

I'm probably out of luck, but I guess it doesn't hurt to ask.

like image 519
BrianH Avatar asked Sep 08 '10 14:09

BrianH


People also ask

What is the most popular static code analysis tool?

SonarQube. SonarQube is the popular static analysis tool for continuously inspecting the code quality and security of your codebases and guiding development teams during code reviews. SonarQube is used for automated code review with CI/CD Integration.

Is static analysis can be automated?

The static analysis process is relatively simple, as long as it's automated. Generally, static analysis occurs before software testing in early development. In the DevOps development practice, it will occur in the create phases. Once the code is written, a static code analyzer should be run to look over the code.

What does static analysis tools detect?

Static analysis identifies defects before you run a program (e.g., between coding and unit testing). Dynamic code analysis identifies defects after you run a program (e.g., during unit testing). However, some coding errors might not surface during unit testing.


2 Answers

I found shellcheck: it tests for common errors in quoting and other things you overlook ("because it works").

like image 58
u0b34a0f6ae Avatar answered Sep 17 '22 18:09

u0b34a0f6ae


The Debian and Ubuntu projects use a script checkbashisms, that looks for particular patterns that might indicate that someone is relying on /bin/sh being bash.

Beyond that, most shells have a -n option to parse and report errors. You could check your script against several different shells to make sure it uses only portable syntax:

for shell in zsh ksh bash dash sh do   echo "Testing ${shell}"   ${shell} -n my_script.sh done 

edit to add: Since writing this answer, shellcheck has been written, as suggested in a later answer. This does a much more thorough job of linting shell scripts than the previous suggestions.

like image 31
Brian Campbell Avatar answered Sep 20 '22 18:09

Brian Campbell