feat: add shellcheck

README.md

@@ -51,7 +51,7 @@ This leads to some minor differences in how they are used in rules_lint.
 | CSS/HTML                  | [Prettier]            |                  |
 | JSON                      | [Prettier]            |                  |
 | Markdown                  | [Prettier]            |                  |
-| Bash                      | [prettier-plugin-sh]  |                  |
+| Bash                      | [prettier-plugin-sh]  | [shellcheck]     |
 | SQL                       | [prettier-plugin-sql] |                  |
 | Starlark (Bazel)          | [Buildifier]          |                  |
 | Swift                     | [SwiftFormat] (1)     |                  |
@@ -79,6 +79,7 @@ This leads to some minor differences in how they are used in rules_lint.
 [jsonnetfmt]: https://github.com/google/go-jsonnet
 [scalafmt]: https://scalameta.org/scalafmt
 [ruff]: https://docs.astral.sh/ruff/
+[shellcheck]: https://www.shellcheck.net/
 
 1. Non-hermetic: requires that a swift toolchain is installed on the machine.
    See https://github.com/bazelbuild/rules_swift#1-install-swift

docs/BUILD.bazel

@@ -37,4 +37,9 @@ stardoc_with_diff_test(
     bzl_library_target = "//lint:ruff",
 )
 
+stardoc_with_diff_test(
+    name = "shellcheck",
+    bzl_library_target = "//lint:shellcheck",
+)
+
 update_docs(name = "update")

example/.shellcheckrc

@@ -0,0 +1,8 @@
+# Turn on warnings for unquoted variables with safe values
+enable=quote-safe-variables
+
+# Turn on warnings for unassigned uppercase variables
+enable=check-unassigned-uppercase
+
+# Allow [ ! -z foo ] instead of suggesting -n
+disable=SC2236

example/BUILD.bazel

@@ -1,4 +1,5 @@
 load("@aspect_rules_js//js:defs.bzl", "js_library")
+load("@aspect_rules_lint//lint:shellcheck.bzl", "shellcheck_binary")
 load("@bazel_skylib//rules:native_binary.bzl", "native_binary")
 load("@npm//:defs.bzl", "npm_link_all_packages")
 load("@npm//:eslint/package_json.bzl", eslint_bin = "bin")
@@ -20,6 +21,7 @@ exports_files(
         ".flake8",
         "pmd.xml",
         ".ruff.toml",
+        ".shellcheckrc",
     ],
     visibility = ["//visibility:public"],
 )
@@ -59,3 +61,6 @@ native_binary(
     out = "ruff",
     visibility = ["//visibility:public"],
 )
+
+# bazel run :shellcheck -- --help
+shellcheck_binary(name = "shellcheck")

example/WORKSPACE.bazel

@@ -170,3 +170,7 @@ fetch_swiftformat()
 load("@aspect_rules_lint//lint:ruff.bzl", "fetch_ruff")
 
 fetch_ruff()
+
+load("@aspect_rules_lint//lint:shellcheck.bzl", "fetch_shellcheck")
+
+fetch_shellcheck()

example/WORKSPACE.bzlmod

@@ -27,3 +27,7 @@ fetch_ktfmt()
 fetch_swiftformat()
 
 fetch_ruff()
+
+load("@aspect_rules_lint//lint:shellcheck.bzl", "fetch_shellcheck")
+
+fetch_shellcheck()

example/lint.sh

@@ -14,8 +14,8 @@ fi
 
 # Produce report files
 # You can add --aspects_parameters=fail_on_violation=true to make this command fail instead.
-
-bazel build --aspects //tools:lint.bzl%eslint,//tools:lint.bzl%buf,//tools:lint.bzl%flake8,//tools:lint.bzl%pmd,//tools:lint.bzl%ruff --output_groups=rules_lint_report $@
+# TODO: put back ruff after the output paths don't collide
+bazel build --aspects //tools:lint.bzl%eslint,//tools:lint.bzl%buf,//tools:lint.bzl%flake8,//tools:lint.bzl%pmd,//tools:lint.bzl%shellcheck --output_groups=rules_lint_report $@
 
 
 # Show the results.

example/src/BUILD.bazel

@@ -27,3 +27,8 @@ java_library(
     name = "foo",
     srcs = ["Foo.java"],
 )
+
+sh_library(
+    name = "hello_shell",
+    srcs = ["hello.sh"],
+)

example/src/hello.sh

@@ -1,3 +1,6 @@
 #!/bin/bash
 
 [ -z $THING ] && echo "hello world"
+
+# Note, we should not get a lint here because the .shellcheckrc excludes it
+[ ! -z "$foo" ] && echo "foo"

example/test/BUILD.bazel

@@ -1,7 +1,7 @@
 "Demonstrates how to enforce zero-lint-tolerance policy with tests"
 
 load("@aspect_rules_ts//ts:defs.bzl", "ts_project")
-load("//tools:lint.bzl", "eslint_test", "flake8_test", "pmd_test")
+load("//tools:lint.bzl", "eslint_test", "flake8_test", "pmd_test", "shellcheck_test")
 
 ts_project(
     name = "no_violations",
@@ -37,3 +37,11 @@ eslint_test(
     # Normally you'd fix the file instead of tagging this test.
     tags = ["manual"],
 )
+
+shellcheck_test(
+    name = "shellcheck",
+    srcs = ["//src:hello_shell"],
+    # Expected to fail based on current content of the file.
+    # Normally you'd fix the file instead of tagging this test.
+    tags = ["manual"],
+)

example/tools/lint.bzl

@@ -6,6 +6,7 @@ load("@aspect_rules_lint//lint:flake8.bzl", "flake8_aspect")
 load("@aspect_rules_lint//lint:lint_test.bzl", "make_lint_test")
 load("@aspect_rules_lint//lint:pmd.bzl", "pmd_aspect")
 load("@aspect_rules_lint//lint:ruff.bzl", "ruff_aspect")
+load("@aspect_rules_lint//lint:shellcheck.bzl", "shellcheck_aspect")
 
 buf = buf_lint_aspect(
     config = "@@//:buf.yaml",
@@ -36,3 +37,10 @@ ruff = ruff_aspect(
     binary = "@@//:ruff",
     config = "@@//:.ruff.toml",
 )
+
+shellcheck = shellcheck_aspect(
+    binary = "@@//:shellcheck",
+    config = "@@//:.shellcheckrc",
+)
+
+shellcheck_test = make_lint_test(aspect = shellcheck)

lint/BUILD.bazel

@@ -3,6 +3,22 @@ load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 
 exports_files(glob(["*.bzl"]) + ["lint_test.sh"])
 
+config_setting(
+    name = "linux_x86",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "linux_aarch64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:aarch64",
+    ],
+)
+
 js_library(
     name = "eslint.workaround_17660",
     srcs = ["eslint.workaround_17660.js"],
@@ -67,3 +83,15 @@ bzl_library(
         "@bazel_tools//tools/build_defs/repo:utils.bzl",
     ],
 )
+
+bzl_library(
+    name = "shellcheck",
+    srcs = ["shellcheck.bzl"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//lint/private:lint_aspect",
+        "@bazel_skylib//rules:native_binary",
+        "@bazel_tools//tools/build_defs/repo:http.bzl",
+        "@bazel_tools//tools/build_defs/repo:utils.bzl",
+    ],
+)