Add ShellCheck Action

.github/workflows/lint.yml

@@ -0,0 +1,24 @@
+name: Lint
+
+on:
+  pull_request:
+    paths:
+    - '**/*.sh'
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Install ShellCheck
+      run: sudo apt-get update && sudo apt-get install -y shellcheck
+
+    - name: Run ShellCheck on all scripts
+      run: |
+        # Find all .sh files and run shellcheck
+        # -f gcc makes the output clickable in GitHub UI
+        shopt -s globstar nullglob
+        shellcheck -f gcc **/*.sh

docker/linux/debian/docker-entrypoint.sh

@@ -20,7 +20,7 @@ start_docker () {
 get_docker_info () {
     DOCKER_GID=$(stat -c '%g' $DOCKER_SOCK)
     DOCKER_GROUP=$(stat -c '%G' $DOCKER_SOCK)
-    EXISTING_GROUP=$(getent group $DOCKER_GID | cut -d: -f1)
+    EXISTING_GROUP=$(getent group "$DOCKER_GID" | cut -d: -f1)
     echo "Docker socket found with GID: $DOCKER_GID (group: $DOCKER_GROUP)"
 }
 
@@ -37,14 +37,14 @@ set_user_permissions () {
 set_user_groups () {
     if [[ -z "$EXISTING_GROUP" ]]; then
         echo "Creating docker group with GID $DOCKER_GID"
-        groupadd -g $DOCKER_GID docker
+        groupadd -g "$DOCKER_GID" docker
         DOCKER_GROUP="docker"
     else
         echo "Using existing group: $EXISTING_GROUP"
         DOCKER_GROUP=$EXISTING_GROUP
     fi
     echo "Adding user envoybuild to group $DOCKER_GROUP" >&2
-    usermod -aG $DOCKER_GROUP envoybuild
+    usermod -aG "$DOCKER_GROUP" envoybuild
 }
 
 start_docker
@@ -53,9 +53,8 @@ set_user_permissions
 set_user_groups
 
 if [[ -f /entrypoint-extra.sh ]]; then
+    # shellcheck disable=SC1091
     . /entrypoint-extra.sh
 fi
+
 exec gosu envoybuild "$@"
-if [[ -f /cleanup.sh ]]; then
-    . /cleanup.sh
-fi

docker/linux/debian/entrypoint.sh

@@ -8,9 +8,8 @@ if [[ -e /home/envoybuild/.cache ]]; then
     chown envoybuild:envoybuild /home/envoybuild/.cache
 fi
 if [[ -f /entrypoint-extra.sh ]]; then
+    # shellcheck disable=SC1091
     . /entrypoint-extra.sh
 fi
+
 exec gosu envoybuild "$@"
-if [[ -f /cleanup.sh ]]; then
-    . /cleanup.sh
-fi

docker/linux/debian/fun.sh

@@ -14,7 +14,6 @@ COMMON_PACKAGES=(
     ca-certificates
     libtinfo5
     patch)
-DEV_PACKAGES=()
 CI_PACKAGES=(git gosu sudo)
 DEBIAN_PACKAGES=(
     aspell

docker/linux/debian/llvm-entrypoint.sh

@@ -9,9 +9,8 @@ if [[ -e /home/envoybuild/.cache ]]; then
     chown envoybuild:envoybuild /home/envoybuild/.cache
 fi
 if [[ -f /entrypoint-extra.sh ]]; then
+    # shellcheck disable=SC1091
     . /entrypoint-extra.sh
 fi
+
 exec gosu envoybuild "$@"
-if [[ -f /cleanup.sh ]]; then
-    . /cleanup.sh
-fi

docker/linux/group_manifests.sh

@@ -19,7 +19,6 @@ append_variant () {
     local repo=$1
     local variant=$2
     local arch=$3
-    local flags
 
     tag="${repo}:${variant}-${TAG_SHA}-${arch}"
     if ! exists "$tag"; then

docker/push.sh

@@ -5,11 +5,10 @@
 set -e
 
 IMAGE_PREFIX="${IMAGE_PREFIX:-envoyproxy/envoy-build-}"
-GCR_IMAGE_PREFIX=gcr.io/envoy-ci/
 # Enable docker experimental
 export DOCKER_CLI_EXPERIMENTAL=enabled
 CONTAINER_SHA="${CONTAINER_SHA:-$(git log -1 --pretty=format:"%H" .)}"
-CONTAINER_TAG="${CONTAINER_SHA}"
+export CONTAINER_TAG="${CONTAINER_SHA}"
 IMAGE_TAGS=()
 OCI_OUTPUT_DIR="oci-output"
 
@@ -83,8 +82,10 @@ export BASE_IMAGE_NAME
 
 # Use distro-specific build script if available
 if [[ "${OS_DISTRO}" == "debian" && -f "./debian_build.sh" ]]; then
+    # shellcheck source=docker/linux/debian_build.sh
     source "./debian_build.sh"
 else
+    # shellcheck source=docker/linux/build.sh
     source "./build.sh"
 fi