From a37316a3369514e298ced6f0f64f7e17cfe3d64b Mon Sep 17 00:00:00 2001
From: Andrew Seigner <andrew@sig.gy>
Date: Mon, 2 Mar 2020 13:18:08 -0800
Subject: [PATCH] Introduce `bin/shellcheck`, add to ci (#4118)

PR #4117 was root-caused with the help of `shellcheck`.

This change introduces a `bin/shellcheck` script, and adds it to CI. In
CI, many checks are disabled to allow it to pass. This will at least
prevent introduction of new classes of shell issue, and should motivate
re-enabling more checks over time.

Signed-off-by: Andrew Seigner <siggy@buoyant.io>
---
 .github/workflows/static_checks.yml | 54 +++++++++++++++++++++++++++++
 TEST.md                             |  7 ++++
 bin/shellcheck                      | 29 ++++++++++++++++
 3 files changed, 90 insertions(+)
 create mode 100755 bin/shellcheck

diff --git a/.github/workflows/static_checks.yml b/.github/workflows/static_checks.yml
index ebfd04d06..24d152585 100644
--- a/.github/workflows/static_checks.yml
+++ b/.github/workflows/static_checks.yml
@@ -61,3 +61,57 @@ jobs:
       run: |
         echo "$GITCOOKIE_SH" | bash
         bin/fmt
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-18.04
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: shellcheck
+      # TODO: Each file listed here is excluded from shellcheck because it
+      # fails. As we fix files we can remove them from this list.
+      #
+      # Once we have this list paired down signficantly, we can switch to
+      # disabling specific checks across all files, for example:
+      # bin/shellcheck bin/* --exclude=SC1000
+      #
+      # For more information on shellcheck failures:
+      # https://github.com/koalaman/shellcheck/wiki/Checks
+      run: |
+        find ./bin -type f \
+        ! -name build-cli-bin \
+        ! -name docker-build-base \
+        ! -name docker-build-cli-bin \
+        ! -name docker-build-cni-plugin \
+        ! -name docker-build-controller \
+        ! -name docker-build-debug \
+        ! -name docker-build-go-deps \
+        ! -name docker-build-grafana \
+        ! -name docker-build-proxy \
+        ! -name docker-build-web \
+        ! -name docker-images \
+        ! -name docker-pull \
+        ! -name docker-pull-binaries \
+        ! -name docker-pull-deps \
+        ! -name docker-push \
+        ! -name docker-push-deps \
+        ! -name docker-retag-all \
+        ! -name _docker.sh \
+        ! -name fmt \
+        ! -name kind-load \
+        ! -name lint \
+        ! -name _log.sh \
+        ! -name minikube-start-hyperv.bat \
+        ! -name mkube \
+        ! -name protoc-go.sh \
+        ! -name root-tag \
+        ! -name _tag.sh \
+        ! -name test-cleanup \
+        ! -name test-clouds-cleanup \
+        ! -name test-clouds \
+        ! -name test-run \
+        ! -name _test-run.sh \
+        ! -name test-scale \
+        ! -name update-go-deps-shas \
+        ! -name web \
+        | xargs -I {} bin/shellcheck -x {}
diff --git a/TEST.md b/TEST.md
index 3ae6e6faa..104346aee 100644
--- a/TEST.md
+++ b/TEST.md
@@ -13,6 +13,7 @@ of this repo, unless otherwise indicated by a `cd` command.
 - [Unit tests](#unit-tests)
   - [Go](#go)
   - [Javascript](#javascript)
+  - [Shell](#shell)
 - [Integration tests](#integration-tests)
   - [Prerequisites](#prerequisites)
   - [Running tests](#running-tests)
@@ -80,6 +81,12 @@ bin/web test --watch # runs -o by default (tests only files changed since last c
 bin/web test --watchAll # runs all tests after a change to a file
 ```
 
+## Shell
+
+```bash
+bin/shellcheck -x bin/*
+```
+
 # Integration tests
 
 The `test/` directory contains a test suite that can be run to validate Linkerd
diff --git a/bin/shellcheck b/bin/shellcheck
new file mode 100755
index 000000000..622b4bc4f
--- /dev/null
+++ b/bin/shellcheck
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+set -eu
+
+scversion=v0.7.0
+
+bindir=$( cd "${0%/*}" && pwd )
+targetbin=$( cd "$bindir"/.. && pwd )/target/bin
+scbin=$targetbin/.shellcheck-$scversion
+
+if [ ! -f "$scbin" ]; then
+  if [ "$(uname -s)" = Darwin ]; then
+    file=darwin.x86_64.tar.xz
+  elif [ "$(uname -o)" = Msys ]; then
+    # TODO: work on windows
+    file=zip
+  else
+    case $(uname -m) in
+      x86_64) file=linux.x86_64.tar.xz ;;
+      arm) file=linux.aarch64.tar.xz ;;
+    esac
+  fi
+
+  mkdir -p "$targetbin"
+  wget -qO- "https://storage.googleapis.com/shellcheck/shellcheck-${scversion?}.$file" | tar -OxJv "shellcheck-${scversion}/shellcheck" > "$scbin"
+  chmod +x "$scbin"
+fi
+
+"$scbin" "$@"