# Debian/Ubuntu
sudo apt install shellcheck

# RHEL/Fedora
sudo dnf install ShellCheck

# macOS
brew install shellcheck

# Arch
sudo pacman -S shellcheck

# Standalone binary
wget -qO- https://github.com/koalaman/shellcheck/releases/latest/download/shellcheck-stable.linux.x86_64.tar.xz \
  | tar -xJ --strip-components=1 -C /usr/local/bin shellcheck-stable/shellcheck

# Docker
docker run --rm -v "$PWD:/mnt" koalaman/shellcheck:stable myscript.sh

# Verify
shellcheck --version

ShellCheck - shell script analysis tool
version: 0.11.0
license: GNU General Public License, version 3
website: https://www.shellcheck.net

shellcheck [OPTIONS] FILE [FILE...]
shellcheck -                       # read script from stdin
find . -name '*.sh' -exec shellcheck {} +

cat > greet.sh <<'EOF'
#!/usr/bin/env bash
name=$1
echo Hello $name, the time is `date`
EOF
shellcheck greet.sh

In greet.sh line 2:
name=$1
     ^-- SC2086 (info): Double quote to prevent globbing and word splitting.

Did you mean:
name="$1"

In greet.sh line 3:
echo Hello $name, the time is `date`
           ^---^ SC2086 (info): Double quote to prevent globbing and word splitting.
                              ^---^ SC2006 (style): Use $(...) notation instead of legacy backticks `...`.

For more information:
  https://www.shellcheck.net/wiki/SC2086 -- Double quote to prevent globbi...
  https://www.shellcheck.net/wiki/SC2006 -- Use $(...) notation instead o...

shellcheck -S error    deploy.sh        # only show real bugs
shellcheck -S warning  deploy.sh        # include quoting issues
shellcheck -S style    deploy.sh        # the maximalist run (default)

# -S error on a clean script:
(no output)

#!/usr/bin/env bash
# shellcheck shell=bash               # force the dialect for ambiguous files

# Disable one rule for the whole file (must be near the top)
# shellcheck disable=SC2086

# Disable a rule for just the next statement
# shellcheck disable=SC2046
files=$(find . -type f)

# Disable multiple rules
# shellcheck disable=SC2086,SC2155
export PATH=/usr/local/bin:$PATH

# Enable an optional check globally
# shellcheck enable=require-variable-braces

# Tell shellcheck about a sourced file it can't follow
# shellcheck source=./lib/util.sh
source "$LIB/util.sh"

shellcheck --list-optional
shellcheck -o all deploy.sh
shellcheck -o require-double-brackets,quote-safe-variables deploy.sh

name:    add-default-case
default: disabled
help:    Suggest adding a default case in `case` statements

name:    avoid-negated-conditions
default: disabled
help:    Suggest replacing `[ ! a -eq b ]` with `[ a -ne b ]` (SC2335)

name:    avoid-nullary-conditions
default: disabled
help:    Suggest explicitly using -n in `[ $var ]`

name:    check-extra-masked-returns
default: disabled
help:    Check for additional cases where exit codes are masked

name:    check-set-e-suppressed
default: disabled
help:    Notify when set -e is suppressed during function invocation

name:    check-unassigned-uppercase
default: disabled
help:    Warn when uppercase variables are unassigned

name:    deprecate-which
default: disabled
help:    Suggest 'command -v' instead of 'which'

name:    quote-safe-variables
default: disabled
help:    Suggest quoting variables without metacharacters

name:    require-double-brackets
default: disabled
help:    Require [[ and warn about [ ]

name:    require-variable-braces
default: disabled
help:    Require {} on every variable reference

name:    useless-use-of-cat
default: disabled
help:    Suggest piping/redirecting input instead of using cat (was SC2002 default until v0.11.0)

# .shellcheckrc
shell=bash
severity=warning
enable=quote-safe-variables
enable=require-variable-braces
enable=avoid-negated-conditions    # v0.11.0+ (SC2335)
disable=SC2034                     # variable assigned but not used (we use indirection)
source-path=SCRIPTDIR
source-path=SCRIPTDIR/lib
external-sources=true
extended-analysis=true             # dataflow analysis (SC2317 unreachable, etc.)

# Override discovery: point at a specific config
shellcheck --rcfile=./ci/shellcheckrc greet.sh

# Or bypass any discovered .shellcheckrc entirely
shellcheck --norc greet.sh

# Auto-discovery (default): walks parent dirs, then $XDG_CONFIG_HOME, then $HOME
shellcheck greet.sh

shellcheck -x deploy.sh

# Tell it where to look for sourced files
shellcheck -P ./lib:./common -x deploy.sh

# Or per-source hint
cat deploy.sh
# #!/usr/bin/env bash
# # shellcheck source=lib/util.sh
# source "$LIB_DIR/util.sh"

In deploy.sh line 4:
source "$LIB_DIR/util.sh"
       ^---------------^ SC1091 (info): Not following: $LIB_DIR/util.sh: openBinaryFile: does not exist (No such file or directory)

shellcheck -f gcc        deploy.sh    # editor-friendly: file:line:col:level: msg
shellcheck -f checkstyle deploy.sh    # Jenkins / static-analysis dashboards
shellcheck -f json       deploy.sh    # array of objects
shellcheck -f json1      deploy.sh    # one object with "comments": [...]
shellcheck -f diff       deploy.sh    # unified diff with suggested fixes
shellcheck -f quiet      deploy.sh    # no output, just exit code

deploy.sh:5:8: note: Double quote to prevent globbing and word splitting. [SC2086]
deploy.sh:9:1: warning: Tabs and spaces in indentation. [SC1107]

{
  "comments": [
    {
      "file": "deploy.sh",
      "line": 5,
      "endLine": 5,
      "column": 8,
      "endColumn": 12,
      "level": "info",
      "code": 2086,
      "message": "Double quote to prevent globbing and word splitting.",
      "fix": {
        "replacements": [
          {"line":5,"column":8,"endLine":5,"endColumn":12,
           "precedence":7,"insertionPoint":"afterEnd","replacement":"\"$NAME\""}
        ]
      }
    }
  ]
}

--- a/deploy.sh
+++ b/deploy.sh
@@ -2,3 +2,3 @@
-name=$1
-echo Hello $name, the time is `date`
+name="$1"
+echo Hello "$name", the time is "$(date)"

shellcheck -f diff deploy.sh | patch -p1
git diff                    # review what changed
git restore deploy.sh       # if you don't like it

patching file deploy.sh

# Bad
for f in $files; do rm $f; done

# Good
for f in "${files[@]}"; do rm -- "$f"; done

SC2086 (info): Double quote to prevent globbing and word splitting.

# Bad — failure of `date` is hidden
local now=$(date -u +%FT%TZ)

# Good
local now
now=$(date -u +%FT%TZ) || return

SC2155 (warning): Declare and assign separately to avoid masking return values.

# Bad
rm $(find . -name '*.log')

# Good
find . -name '*.log' -delete
# or, when you really need a list:
find . -name '*.log' -print0 | xargs -0 rm --

SC2046 (warning): Quote this to prevent word splitting.

# Bad
make build
if [ $? -ne 0 ]; then echo "failed"; exit 1; fi

# Good
if ! make build; then echo "failed"; exit 1; fi

SC2181 (style): Check exit code directly with e.g. `if mycmd;`, not indirectly with $?.

# Bad
cd /var/log
rm *.gz                # wrong if cd failed

# Good
cd /var/log || exit
rm /var/log/*.gz       # or be explicit about the path

SC2164 (warning): Use 'cd ... || exit' or similar to handle cd failures.

# Bad
mycmd $@

# Good
mycmd "$@"

SC2068 (error): Double quote array expansions to avoid re-splitting elements.

# False-positive case (genuine indirection)
ENV_PROD=prod
ENV_STAGE=stage
key=PROD
# shellcheck disable=SC2034
echo "${!key}"

SC2034 (warning): ENV_PROD appears unused. Verify use (or export if used externally).

# shellcheck source=lib/common.sh
source "$LIB_DIR/common.sh"

SC1090 (warning): ShellCheck can't follow non-constant source. Use a directive to specify location.

# Bad
ver=`git describe --tags`

# Good
ver=$(git describe --tags)

SC2006 (style): Use $(...) notation instead of legacy backticks `...`.

# Bad
files=( $(ls *.txt) )

# Good (bash 4+)
mapfile -t files < <(ls -1 *.txt)

# Or POSIX-ish
readarray -t files < <(find . -maxdepth 1 -name '*.txt')

SC2207 (warning): Prefer mapfile or read -a to split command output (or quote to avoid splitting).

# Bad — produces the string "01", not the number 1
x=0
x+=1

# Good
x=0
(( x += 1 ))

SC2324 (warning): x+=1 will append, not increment. Use (( x += 1 )) or x=$((x + 1)).

# Bad
log=$(make build > build.log)

# Good — pick one
log=$(make build); printf '%s\n' "$log" > build.log
make build > build.log

SC2327 (warning): This command redirects its standard output, so the assignment will be empty.

# Bad
cleanup() { rm -rf "$tmp"; }
# (no caller anywhere)

# Good
cleanup() { rm -rf "$tmp"; }
trap cleanup EXIT

SC2329 (info): This function is never invoked. Verify name, or make it a static analysis comment.

# Bad
[ -a "$path" ] && echo "exists"

# Good
[ -e "$path" ] && echo "exists"

SC2331 (warning): Use -e instead of unary -a (which is bashism and not POSIX).

# .shellcheckrc
enable=useless-use-of-cat

0  no issues found
1  issues found at requested severity
2  fatal error (file not found, parse error)
3  bad options / usage error

shellcheck deploy.sh && echo "clean"
echo "exit=$?"

clean
exit=0

# Vim — via ALE
# .vimrc
let g:ale_linters = {'sh': ['shellcheck']}

# Neovim — via nvim-lint
require('lint').linters_by_ft = { sh = {'shellcheck'}, bash = {'shellcheck'} }

# VS Code: install "ShellCheck" extension by Timon Wong

# Emacs — via flycheck
(setq flycheck-shellcheck-supported-shells '(bash dash ksh sh))

# fish completion
shellcheck --version            # uses fish's hosted completion

# .pre-commit-config.yaml — using the pre-commit framework
repos:
  - repo: https://github.com/koalaman/shellcheck-precommit
    rev: v0.11.0
    hooks:
      - id: shellcheck
        args: [--severity=warning, --external-sources]

# Plain .git/hooks/pre-commit (executable)
#!/usr/bin/env bash
set -e
mapfile -t files < <(git diff --cached --name-only --diff-filter=ACM \
                       | grep -E '\.(sh|bash)$' || true)
[ "${#files[@]}" -eq 0 ] && exit 0
shellcheck -x -S warning "${files[@]}"

# .github/workflows/shellcheck.yml
cat > .github/workflows/shellcheck.yml <<'YAML'
name: shellcheck
on: [push, pull_request]
jobs:
  shellcheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ludeeus/action-shellcheck@2.0.0
        with:
          severity: warning
          additional_files: 'install setup'
          ignore_paths: vendor third_party
YAML

shellcheck:
  image: koalaman/shellcheck-alpine:stable
  script:
    - find . -type f \( -name '*.sh' -o -name '*.bash' \) -print0 \
        | xargs -0 shellcheck -x -S warning

find . -path ./vendor -prune -o \( -name '*.sh' -o -name '*.bash' \) -print0 \
  | xargs -0 shellcheck -x -S warning

(no output, exit 0 — everything clean)

# .shellcheckrc — strict subset only, expand over time
shell=bash
severity=warning
disable=SC2034,SC2155,SC1091         # not ready yet
enable=quote-safe-variables

shellcheck -x -f gcc -S warning ./scripts/*.sh \
  | tee shellcheck.log
# CI uploads shellcheck.log as a problem-matcher / SARIF artefact

scripts/deploy.sh:12:8: note: Double quote to prevent globbing and word splitting. [SC2086]
scripts/deploy.sh:20:1: warning: 'cd' may fail. Use 'cd ... || exit' or similar. [SC2164]

# Generate one combined patch
find . -name '*.sh' -print0 \
  | xargs -0 -I{} shellcheck -f diff {} >> fixes.patch
# Review what's about to change
diffstat fixes.patch
# Apply
patch -p1 < fixes.patch

 deploy.sh   |  4 ++--
 setup.sh    |  6 +++---
 backup.sh   |  2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

shellcheck -s bash install
shellcheck -s bash ~/.bashrc ~/.bash_profile
shellcheck -s sh   /etc/init.d/myservice

(findings, if any)

lint:
	@find . -name '*.sh' -print0 | xargs -0 shellcheck -x -S warning
	@echo "shellcheck: clean"

.PHONY: lint

$ make lint
shellcheck: clean

cat > /tmp/bad.sh <<'EOF'
#!/usr/bin/env bash
files=$(find . -name *.log)
for f in $files; do
  rm $f
done
EOF
shellcheck /tmp/bad.sh
echo "exit=$?"

In /tmp/bad.sh line 2:
files=$(find . -name *.log)
                     ^---^ SC2061 (warning): Quote the parameter to -name so the shell won't interpret it.
^----^ SC2207 (warning): Prefer mapfile or read -a to split command output ...

In /tmp/bad.sh line 3:
for f in $files; do
         ^----^ SC2086 (info): Double quote to prevent globbing and word splitting.

In /tmp/bad.sh line 4:
  rm $f
     ^-- SC2086 (info): Double quote to prevent globbing and word splitting.

exit=1

shellcheck -f json1 deploy.sh \
  | jq -r '.comments[] | "\(.file):\(.line):\(.column) SC\(.code) (\(.level)) \(.message)"'

deploy.sh:12:8 SC2086 (info) Double quote to prevent globbing and word splitting.
deploy.sh:20:1 SC2164 (warning) Use 'cd ... || exit' or similar to handle cd failures.