ci: add shellcheck step (#484)

Author: DevelopmentCats

.github/scripts/check_registry_site_health.sh

@@ -82,7 +82,8 @@ create_incident() {
 # Function to check for existing unresolved incidents
 check_existing_incident() {
   # Fetch the latest incidents with status not equal to "RESOLVED"
-  local unresolved_incidents=$(curl -s -X GET "https://api.instatus.com/v1/$INSTATUS_PAGE_ID/incidents" \
+  local unresolved_incidents
+  unresolved_incidents=$(curl -s -X GET "https://api.instatus.com/v1/$INSTATUS_PAGE_ID/incidents" \
     -H "Authorization: Bearer $INSTATUS_API_KEY" \
     -H "Content-Type: application/json" | jq -r '.incidents[] | select(.status != "RESOLVED") | .id')
 

.github/workflows/ci.yaml

@@ -29,8 +29,11 @@ jobs:
               - 'scripts/ts_test_auto.sh'
               - 'scripts/terraform_test_all.sh'
               - 'scripts/terraform_validate.sh'
+              - 'scripts/shellcheck_validate.sh'
             modules:
               - 'registry/**/modules/**'
+            shell:
+              - '**/*.sh'
             all:
               - '**'
       - name: Set up Terraform
@@ -64,6 +67,14 @@ jobs:
           SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
           MODULE_CHANGED_FILES: ${{ steps.filter.outputs.modules_files }}
         run: bun terraform-validate
+      - name: Run ShellCheck
+        env:
+          ALL_CHANGED_FILES: ${{ steps.filter.outputs.all_files }}
+          SHARED_CHANGED: ${{ steps.filter.outputs.shared }}
+          SHELL_CHANGED_FILES: ${{ steps.filter.outputs.shell_files }}
+        run: bun shellcheck
+      - name: Validate set -u ordering
+        run: ./scripts/validate_set_u_order.sh
   validate-style:
     name: Check for typos and unformatted code
     runs-on: ubuntu-latest

.shellcheckrc

@@ -0,0 +1,22 @@
+# ShellCheck configuration for Coder Registry
+# https://www.shellcheck.net/wiki/
+
+# Set default shell dialect to bash (most scripts use bash)
+shell=bash
+
+# Disable checks that conflict with Terraform templating syntax
+# Many scripts use Terraform's templatefile() function with $${VAR} escape syntax
+disable=SC2154  # Variable is referenced but not assigned (injected by Terraform)
+disable=SC2034  # Variable appears unused (used via $${VAR} syntax)
+disable=SC1083  # Literal braces (Terraform's $${VAR} escape syntax)
+disable=SC2193  # Comparison arguments never equal (Terraform interpolation)
+disable=SC2125  # Brace expansion/globs in assignments (Terraform syntax)
+disable=SC2157  # Argument to -n/-z is always true/false (Terraform $${VAR} syntax)
+disable=SC2066  # Loop will only run once (Terraform $${VAR} array syntax)
+
+# Disable checks that conflict with intentional patterns
+disable=SC2076  # Quoted regex in =~ (intentional literal string match, not regex, for array membership checks)
+
+# Enable all optional checks for thorough analysis
+enable=all
+

bun.lock

@@ -6,6 +6,7 @@
     "terraform-validate": "./scripts/terraform_validate.sh",
     "tftest": "./scripts/terraform_test_all.sh",
     "tstest": "./scripts/ts_test_auto.sh",
+    "shellcheck": "./scripts/shellcheck_validate.sh",
     "update-version": "./update-version.sh"
   },
   "devDependencies": {
@@ -16,7 +17,8 @@
     "marked": "^16.2.0",
     "prettier": "^3.6.2",
     "prettier-plugin-sh": "^0.18.0",
-    "prettier-plugin-terraform-formatter": "^1.2.1"
+    "prettier-plugin-terraform-formatter": "^1.2.1",
+    "shellcheck": "^4.1.0"
   },
   "peerDependencies": {
     "typescript": "^5.8.3"

package.json

@@ -15,8 +15,8 @@ up a default or custom tmux configuration with session save/restore capabilities
 ```tf
 module "tmux" {
   source   = "registry.coder.com/anomaly/tmux/coder"
-  version  = "1.0.2"
-  agent_id = coder_agent.main.id
+  version  = "1.0.3"
+  agent_id = coder_agent.example.id
 }
 ```
 
@@ -39,8 +39,8 @@ module "tmux" {
 ```tf
 module "tmux" {
   source        = "registry.coder.com/anomaly/tmux/coder"
-  version       = "1.0.2"
-  agent_id      = coder_agent.main.id
+  version       = "1.0.3"
+  agent_id      = coder_agent.example.id
   tmux_config   = ""                        # Optional: custom tmux.conf content
   save_interval = 1                         # Optional: save interval in minutes
   sessions      = ["default", "dev", "ops"] # Optional: list of tmux sessions
@@ -78,7 +78,7 @@ This module can provision multiple tmux sessions, each as a separate app in the
 ```tf
 module "tmux" {
   source      = "registry.coder.com/anomaly/tmux/coder"
-  version     = "1.0.2"
+  version     = "1.0.3"
   agent_id    = var.agent_id
   sessions    = ["default", "dev", "anomaly"]
   tmux_config = <<-EOT

registry/anomaly/modules/tmux/README.md

@@ -144,7 +144,7 @@ main() {
   printf "$${BOLD}✅ tmux setup complete! \n\n"
 
   printf "$${BOLD} Attempting to restore sessions\n"
-  tmux new-session -d \; source-file ~/.tmux.conf \; run-shell '~/.tmux/plugins/tmux-resurrect/scripts/restore.sh'
+  tmux new-session -d \; source-file ~/.tmux.conf \; run-shell "$HOME/.tmux/plugins/tmux-resurrect/scripts/restore.sh"
   printf "$${BOLD} Sessions restored: -> %s\n" "$(tmux ls)"
 
 }

registry/anomaly/modules/tmux/scripts/run.sh

@@ -14,8 +14,8 @@ This module installs small, robust scripts in your workspace to create and extra
 module "archive" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder-labs/archive/coder"
-  version  = "0.0.2"
-  agent_id = coder_agent.main.id
+  version  = "0.0.3"
+  agent_id = coder_agent.example.id
 
   paths = ["./projects", "./code"]
 }
@@ -43,8 +43,8 @@ Basic example:
 module "archive" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder-labs/archive/coder"
-  version  = "0.0.2"
-  agent_id = coder_agent.main.id
+  version  = "0.0.3"
+  agent_id = coder_agent.example.id
 
   # Paths to include in the archive (files or directories).
   directory = "~"
@@ -61,8 +61,8 @@ Customize compression and output:
 module "archive" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder-labs/archive/coder"
-  version  = "0.0.2"
-  agent_id = coder_agent.main.id
+  version  = "0.0.3"
+  agent_id = coder_agent.example.id
 
   directory    = "/"
   paths        = ["/etc", "/home"]
@@ -78,8 +78,8 @@ Enable auto-archive on stop:
 module "archive" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder-labs/archive/coder"
-  version  = "0.0.2"
-  agent_id = coder_agent.main.id
+  version  = "0.0.3"
+  agent_id = coder_agent.example.id
 
   # Creates /tmp/coder-archive.tar.gz of the users home directory (defaults).
   create_on_stop = true
@@ -92,8 +92,8 @@ Extract on start:
 module "archive" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder-labs/archive/coder"
-  version  = "0.0.2"
-  agent_id = coder_agent.main.id
+  version  = "0.0.3"
+  agent_id = coder_agent.example.id
 
   # Where to look for the archive file to extract:
   output_dir   = "/tmp"

registry/coder-labs/modules/archive/README.md

@@ -6,8 +6,8 @@ EXTRACT_ON_START="${TF_EXTRACT_ON_START}"
 EXTRACT_WAIT_TIMEOUT="${TF_EXTRACT_WAIT_TIMEOUT}"
 
 # Set script defaults from Terraform.
-DEFAULT_PATHS=(${TF_PATHS})
-DEFAULT_EXCLUDE_PATTERNS=(${TF_EXCLUDE_PATTERNS})
+IFS=' ' read -r -a DEFAULT_PATHS <<< "${TF_PATHS}"
+IFS=' ' read -r -a DEFAULT_EXCLUDE_PATTERNS <<< "${TF_EXCLUDE_PATTERNS}"
 DEFAULT_COMPRESSION="${TF_COMPRESSION}"
 DEFAULT_ARCHIVE_PATH="${TF_ARCHIVE_PATH}"
 DEFAULT_DIRECTORY="${TF_DIRECTORY}"
@@ -62,6 +62,7 @@ echo "Installed extract script to:  $EXTRACT_WRAPPER_PATH"
 
 # 3) Optionally wait for and extract an archive on start.
 if [[ $EXTRACT_ON_START = true ]]; then
+  # shellcheck disable=SC1090
   . "$LIB_PATH"
 
   archive_wait_and_extract "$EXTRACT_WAIT_TIMEOUT" quiet || {

registry/coder-labs/modules/archive/run.sh

@@ -14,7 +14,7 @@ Run Auggie CLI in your workspace to access Augment's AI coding assistant with ad
 module "auggie" {
   source   = "registry.coder.com/coder-labs/auggie/coder"
   version  = "0.2.2"
-  agent_id = coder_agent.main.id
+  agent_id = coder_agent.example.id
   folder   = "/home/coder/project"
 }
 ```
@@ -41,14 +41,14 @@ data "coder_parameter" "ai_prompt" {
 module "coder-login" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/coder-login/coder"
-  version  = "1.0.31"
-  agent_id = coder_agent.main.id
+  version  = "0.2.2"
+  agent_id = coder_agent.example.id
 }
 
 module "auggie" {
   source   = "registry.coder.com/coder-labs/auggie/coder"
   version  = "0.2.2"
-  agent_id = coder_agent.main.id
+  agent_id = coder_agent.example.id
   folder   = "/home/coder/project"
 
   # Authentication
@@ -57,7 +57,7 @@ module "auggie" {
 EOF  # Required for tasks
 
   # Version
-   auggie_version = "0.3.0"
+   auggie_version  = "0.2.2"
 
   # Task configuration
   ai_prompt                      = data.coder_parameter.ai_prompt.value
@@ -74,7 +74,6 @@ EOF  # Required for tasks
       "command": "npx",
       "args": ["-y", "@modelcontextprotocol/server-filesystem", "/home/coder/project"]
     }
-
   }
 }
 EOF
@@ -105,7 +104,7 @@ EOF
 module "auggie" {
   source   = "registry.coder.com/coder-labs/auggie/coder"
   version  = "0.2.2"
-  agent_id = coder_agent.main.id
+  agent_id = coder_agent.example.id
   folder   = "/home/coder/project"
 
   # Multiple MCP configuration files
@@ -128,7 +127,6 @@ module "auggie" {
       ],
       "timeout": 600
     }
-
   }
 }
 EOF