$ show koalaman/shellcheck
ShellCheck is a static analysis tool for shell scripts, written in Haskell. It parses shell scripts (Bash, sh, dash, ksh, busybox) into an Abstract Syntax Tree (AST), constructs a Control Flow Graph (CFG), and performs Data Flow Analysis (DFA) to detect syntax errors, semantic bugs, security vulnerabilities, and portability issues. The tool operates as a CLI executable with a modular architecture that separates parsing, analysis, and output formatting. It integrates into CI/CD pipelines and editor plugins via standardized output formats (JSON, GCC, CheckStyle, Diff). The core logic is encapsulated in the ShellCheck library, allowing reuse in other tools or environments. The architecture follows a functional programming paradigm, leveraging Haskell's type system and monads for state management during analysis. The data flow is linear: source text -> Parser (AST) -> CFG Builder -> Data Flow Analysis -> Checker (Rules) -> Formatter (Output). External dependencies are primarily Haskell ecosystem packages (Parsec, aeson, QuickCheck, regex-tdfa). The tool supports configuration via `.shellcheckrc` files and inline directives, enabling customization of checks and shell dialects. ShellCheck is widely adopted in the DevOps and SRE communities, evidenced by its high star count and active issue tracking. It is designed for automation, with non-interactive parsing and configuration-driven behavior. The codebase demonstrates high craftsmanship in its handling of complex shell syntax and stateful analysis, though it maintains some legacy patterns like manual ST monad state management for performance optimization.
The LLM identified 3 files worth highlighting for reuse:
Implements the core Data Flow Analysis engine using a state machine (Ctx) and mutable references (STRef) for performance. It tracks variable states (global, local, prefix), exit codes, and value properties (integer, string, array) across the script's control flow. The component is reusable for any language analysis tool requiring iterative DFA, demonstrating non-obvious skill in optimizing functional state management for performance-critical analysis.
Implements a Monoid-based fix merging system using a Prefix Sum Tree for position tracking across line changes. This allows multiple automated fixes to be merged without overlapping or corrupting the source text. The pattern is reusable for any code refactoring tool that needs to apply multiple edits to a text buffer, demonstrating a sophisticated algorithmic approach to text manipulation.
Defines the polymorphic output strategy for analysis results. It decouples the core analysis logic from the presentation layer, allowing multiple formatters (TTY, JSON, GCC, CheckStyle, Diff) to be implemented without modifying the analysis engine. This demonstrates clean separation of concerns and is reusable for any tool that needs to support multiple output formats.