mirror of
https://github.com/authelia/authelia.git
synced 2026-10-28 09:34:52 +08:00
Amir ZarrinkafshandJames Elliott
fef15f6b8a
Introduce ShellCheck as an enforced lint step so shell scripts are held
to the same strictness as the Go, YAML, and JavaScript surfaces, and
take the opportunity to normalize the repository's shell hygiene while
the tooling is being put in place. A new .shellcheckrc keeps the default
ShellCheck rule set enabled and opts in to require-variable-braces
(SC2250) to enforce the ${VAR} style repo-wide. The tool is wired into
the local pre-commit path via lefthook (with file_types filtering on
text/x-shellscript and text/x-sh so only libmagic-detected shell files
are passed in, and --format=gcc so the output is clickable from the
IDE), into the Buildkite 🐕🦺 Linting step via a new shellcheck
subcommand on .buildkite/steps/lint.sh that discovers every tracked
shell script through git ls-files and a shebang scan, and into reviewdog
via .reviewdog.yml using the same lint.sh subcommand with --format=gcc
so findings annotate pull requests inline.
Along with the wiring this commit clears the ShellCheck baseline against
the current tree. Every bare $VAR reference was rewritten to ${VAR} so
SC2250 lands on an already-clean repository. Unquoted expansions and
command substitutions (SC2086 and SC2046) were quoted across the
Buildkite steps, hooks, pipeline.sh, setup.sh, redis and samba
entrypoints, and grypescans.sh; read calls gained -r (SC2162), cd calls
got || exit guards (SC2164), declare-and-assign in bootstrap.sh was
split to preserve return values (SC2155), indirect $? checks in setup.sh
were rewritten as if ! cmd (SC2181), repeated redirect blocks in samba
init.sh were collapsed into { ... } > file (SC2129), an unused LDOMAIN
variable was removed (SC2034), the runtime source in healthcheck.sh was
marked with a # shellcheck source=/dev/null directive (SC1091), and
framework-consumed variables in authelia-fb-rc.d gained a file-level
disable directive. Two suite entrypoints that used bash-only syntax
under #!/bin/sh had their shebangs bumped to #!/usr/bin/env bash, two
dev-host gen.sh scripts had their /bin/bash absolute paths swapped for
/usr/bin/env bash so they pick up Homebrew bash on developer machines,
and grypescans.sh had its split-string grypeCmd rewritten as a proper
bash array so the intentional word-splitting no longer needed an inline
disable.
---------
Signed-off-by: Amir Zarrinkafsh <3339418+nightah@users.noreply.github.com>
Co-authored-by: James Elliott <james-d-elliott@users.noreply.github.com>