Introduce `bin/shellcheck`, add to ci (#4118)

PR #4117 was root-caused with the help of `shellcheck`.

This change introduces a `bin/shellcheck` script, and adds it to CI. In
CI, many checks are disabled to allow it to pass. This will at least
prevent introduction of new classes of shell issue, and should motivate
re-enabling more checks over time.

Signed-off-by: Andrew Seigner <siggy@buoyant.io>

.github/workflows/static_checks.yml

@@ -61,3 +61,57 @@ jobs:
       run: |
         echo "$GITCOOKIE_SH" | bash
         bin/fmt
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-18.04
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: shellcheck
+      # TODO: Each file listed here is excluded from shellcheck because it
+      # fails. As we fix files we can remove them from this list.
+      #
+      # Once we have this list paired down signficantly, we can switch to
+      # disabling specific checks across all files, for example:
+      # bin/shellcheck bin/* --exclude=SC1000
+      #
+      # For more information on shellcheck failures:
+      # https://github.com/koalaman/shellcheck/wiki/Checks
+      run: |
+        find ./bin -type f \
+        ! -name build-cli-bin \
+        ! -name docker-build-base \
+        ! -name docker-build-cli-bin \
+        ! -name docker-build-cni-plugin \
+        ! -name docker-build-controller \
+        ! -name docker-build-debug \
+        ! -name docker-build-go-deps \
+        ! -name docker-build-grafana \
+        ! -name docker-build-proxy \
+        ! -name docker-build-web \
+        ! -name docker-images \
+        ! -name docker-pull \
+        ! -name docker-pull-binaries \
+        ! -name docker-pull-deps \
+        ! -name docker-push \
+        ! -name docker-push-deps \
+        ! -name docker-retag-all \
+        ! -name _docker.sh \
+        ! -name fmt \
+        ! -name kind-load \
+        ! -name lint \
+        ! -name _log.sh \
+        ! -name minikube-start-hyperv.bat \
+        ! -name mkube \
+        ! -name protoc-go.sh \
+        ! -name root-tag \
+        ! -name _tag.sh \
+        ! -name test-cleanup \
+        ! -name test-clouds-cleanup \
+        ! -name test-clouds \
+        ! -name test-run \
+        ! -name _test-run.sh \
+        ! -name test-scale \
+        ! -name update-go-deps-shas \
+        ! -name web \
+        | xargs -I {} bin/shellcheck -x {}

TEST.md

@@ -13,6 +13,7 @@ of this repo, unless otherwise indicated by a `cd` command.
 - [Unit tests](#unit-tests)
   - [Go](#go)
   - [Javascript](#javascript)
+  - [Shell](#shell)
 - [Integration tests](#integration-tests)
   - [Prerequisites](#prerequisites)
   - [Running tests](#running-tests)
@@ -80,6 +81,12 @@ bin/web test --watch # runs -o by default (tests only files changed since last c
 bin/web test --watchAll # runs all tests after a change to a file
 ```
 
+## Shell
+
+```bash
+bin/shellcheck -x bin/*
+```
+
 # Integration tests
 
 The `test/` directory contains a test suite that can be run to validate Linkerd

bin/shellcheck

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -eu
+
+scversion=v0.7.0
+
+bindir=$( cd "${0%/*}" && pwd )
+targetbin=$( cd "$bindir"/.. && pwd )/target/bin
+scbin=$targetbin/.shellcheck-$scversion
+
+if [ ! -f "$scbin" ]; then
+  if [ "$(uname -s)" = Darwin ]; then
+    file=darwin.x86_64.tar.xz
+  elif [ "$(uname -o)" = Msys ]; then
+    # TODO: work on windows
+    file=zip
+  else
+    case $(uname -m) in
+      x86_64) file=linux.x86_64.tar.xz ;;
+      arm) file=linux.aarch64.tar.xz ;;
+    esac
+  fi
+
+  mkdir -p "$targetbin"
+  wget -qO- "https://storage.googleapis.com/shellcheck/shellcheck-${scversion?}.$file" | tar -OxJv "shellcheck-${scversion}/shellcheck" > "$scbin"
+  chmod +x "$scbin"
+fi
+
+"$scbin" "$@"