timothyswan/shellcheck repository overview

shellcheck⁠ is a static analysis tool for shell scripts. It identifies common bugs and style issues: unquoted variables, missing set -e, [ ] vs [[ ]] mistakes, deprecated syntax, and hundreds of other patterns with specific SC-numbered codes and plain-English explanations.

This image rebases the upstream static Linux binary onto hi/core-runtime (Red Hat Hardened Image). The binary is extracted from the upstream release archive and SHA256-verified; the built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

⁠Usage

# Check a shell script
podman run --rm -v "$(pwd):/work:ro,Z" shellcheck:<version>-rhhi /work/script.sh

# JSON output for machine parsing
podman run --rm -v "$(pwd):/work:ro,Z" shellcheck:<version>-rhhi --format json /work/script.sh

# Exclude specific rules
podman run --rm -v "$(pwd):/work:ro,Z" shellcheck:<version>-rhhi --exclude SC2086 /work/script.sh

⁠Supply chain

• Base image: registry.access.redhat.com/hi/core-runtime (Red Hat Hardened)
• Binary: extracted from upstream release tarball, SHA256-verified against the archive
• Tier: 2 (prebuilt binary)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation