{"id":34051743,"url":"https://github.com/saleor/shellcheck-gha","last_synced_at":"2026-04-11T10:03:09.730Z","repository":{"id":224969965,"uuid":"764760844","full_name":"saleor/shellcheck-gha","owner":"saleor","description":"Extracts and checks shell scripts in Github Workflows for potential issues using ShellCheck.","archived":false,"fork":false,"pushed_at":"2025-09-05T09:19:46.000Z","size":70,"stargazers_count":6,"open_issues_count":0,"forks_count":0,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-12-15T19:40:04.779Z","etag":null,"topics":["bash","github-workflows","linter","shell","shellcheck","static-analysis","static-code-analysis"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/saleor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-02-28T16:57:42.000Z","updated_at":"2025-09-05T09:19:48.000Z","dependencies_parsed_at":"2024-05-07T11:30:39.105Z","dependency_job_id":"4cb69450-4deb-478f-becb-0cae6f0d249b","html_url":"https://github.com/saleor/shellcheck-gha","commit_stats":null,"previous_names":["saleor/shellcheck-gha"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/saleor/shellcheck-gha","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fshellcheck-gha","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fshellcheck-gha/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fshellcheck-gha/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fshellcheck-gha/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/saleor","download_url":"https://codeload.github.com/saleor/shellcheck-gha/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fshellcheck-gha/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31676210,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-11T08:18:19.405Z","status":"ssl_error","status_checked_at":"2026-04-11T08:17:08.892Z","response_time":54,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bash","github-workflows","linter","shell","shellcheck","static-analysis","static-code-analysis"],"created_at":"2025-12-14T01:38:08.256Z","updated_at":"2026-04-11T10:03:09.725Z","avatar_url":"https://github.com/saleor.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"shellcheck-gha\n==============\n\n![PyPI Project Version](https://img.shields.io/pypi/v/shellcheck-gha.svg)\n![Supported Python Versions](https://img.shields.io/pypi/pyversions/shellcheck-gha.svg)\n![Project Python Implementations](https://img.shields.io/pypi/implementation/shellcheck-gha.svg)\n\nThis Python script extracts shell scripts from GitHub workflows\n(`jobs.\u003cjob_id\u003e.steps[*].run`) and runs them against [ShellCheck].\n\n\u003c!-- TOC --\u003e\n* [shellcheck-gha](#shellcheck-gha)\n  * [Installation](#installation)\n    * [Using GitHub Actions (recommended)](#using-github-actions-recommended)\n    * [PyPI](#pypi)\n    * [From Source](#from-source)\n  * [Usage](#usage)\n  * [Example](#example)\n  * [Goals](#goals)\n  * [Non-Goals](#non-goals)\n\u003c!-- TOC --\u003e\n\n## Installation\n\n**Requirements:**\n\n- Python ≥ 3.11\n- [ShellCheck] ≥ 0.9.0, available on `apt`, `brew`, `cabal`, `dnf`, and `pkg`.\n\n### Using GitHub Actions (recommended)\n\nThe `shellcheck-gha` project can be used as a GitHub Workflow step:\n\n```yaml\non:\n  push:\n    paths:\n      - .github/**\n  pull_request:\n    paths:\n      - .github/**\n\npermissions:\n  contents: read\n\njobs:\n  check:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Checkout\n        uses: actions/checkout@v4\n\n      - name: Run ShellCheck\n        uses: saleor/shellcheck-gha@v0\n        # Uncomment to customize the scan directory:\n        # with:\n        #   scan-directory-path: .github/\n```\n\n\u003e [!IMPORTANT]  \n\u003e By default only the `./.github` directory is scanned (recursively).\n\u003e If some GitHub Composite actions are defined outside the `.github` directory,\n\u003e consider adding steps to scan the additional directories by changing the `scan-directory-path`\n\u003e parameter.\n\n### PyPI\n\nThe project is hosted on PyPI at https://pypi.org/project/shellcheck-gha/.\nTo install the project, run:\n\n```\n$ pip install shellcheck-gha\n```\n\n### From Source\n\nAlternatively, the project can be cloned and installed using [poetry].\n\n```\n$ git clone https://github.com/saleor/shellcheck-gha\n$ pip install poetry\n$ poetry install\n$ shellcheck-gha --help\n```\n\n## Usage\n\n```\n$ shellcheck-gha --help\nusage: shellcheck-gha [-h] [--default-shell DEFAULT_SHELL] [--verbose] [--debug] [--skip-unknown-files | --no-skip-unknown-files] [directory]\n\npositional arguments:\n  directory\n\noptions:\n  -h, --help            show this help message and exit\n  --default-shell DEFAULT_SHELL\n                        The default shell running in the workflow(s)\n  --verbose             Show more details about the execution.\n  --debug               Add debug information (takes precedence over --verbose).\n  --skip-unknown-files, --no-skip-unknown-files\n                        Whether to exit with an error on when parsing non-GitHub workflow or composite action YAML files. Skipping is useful when a directory\n                        may be mixed with other YAML files (e.g. config files such as .github/dependabot.yaml). Unknown files are skipped by default.\n```\n\n## Example\n\n```\n$ shellcheck-gha .\n=== Results: 2 file(s) have findings ===\nScanned 5 files (16 shell scripts)\n[INFO] In bad.yaml:\n    Message: Double quote to prevent globbing and word splitting.\n    More information: https://www.shellcheck.net/wiki/SC2086\n    Code:\n        test $USE_GITIGNORE == true\n             ^^^^^^^^^^^^^^^\n[INFO] In tests/sample_workflows/with-findings.yaml:\n    Message: Double quote to prevent globbing and word splitting.\n    More information: https://www.shellcheck.net/wiki/SC2086\n    Code:\n        echo $BAD_JOB1\n             ^^^^^^^^^^\n[INFO] In tests/sample_workflows/with-findings.yaml:\n    Message: Double quote to prevent globbing and word splitting.\n    More information: https://www.shellcheck.net/wiki/SC2086\n    Code:\n        echo $BAD_JOB2\n             ^^^^^^^^^^\n```\n\n## Goals\n\n- Only check *nix related shells (sh, bash, ksh)\n- Provide useful logs that allow the users to quickly find the problematic \n  code in their workflow.\n\n## Non-Goals\n\n- Differential checking (base vs head commit)\n- Logical understanding of GitHub workflows, such as (but not limited to):\n  - Handling `defaults.run.shell`\n  - Support for string interpolation (`${{ ... }}`)\n- Tracking down exact locations of the findings (line numbers, columns)\n\n[ShellCheck]: https://github.com/koalaman/shellcheck\n[poetry]: https://pypi.org/project/poetry/\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsaleor%2Fshellcheck-gha","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsaleor%2Fshellcheck-gha","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsaleor%2Fshellcheck-gha/lists"}