New audit: `shell-syntax`

[woodruffw]

Running shellcheck inside of zizmor is out of the question for performance reasons, but we can do a subset of what shellcheck does by looking for ERROR nodes when we parse each shell block with tree-sitter's bash and/or pwsh grammars.

I'll need to evaluate this to see how noisy it'll be.

h/t @AlexWaygood

[pygarap]

What about using shuck instead of shellcheck?

[woodruffw]

Oh, that's very cool, I hadn't seen it before! That looks like a good option, although it also still looks pretty new. I think I'd like to see it bake for a bit longer before making it a core dependency of zizmor.

(Hopefully it has a library interface as well, since shelling out is the main performance risk.)

[pygarap]

@woodruffw It looks like shuck already publishes the relevant Rust crates on crates.io:

• shuck-linter, the lint engine behind shuck check
• shuck-parser, the shell parser used by the linter

So zizmor may be able to integrate shuck directly as a Rust library.

Hopefully @ewhauser can clarify whether these crates are intended for external use and suitable for embedding in zizmor.

[ewhauser]

The crates are intended for external use and should be embeddable. The APIs are fully mature but if zizmor picked them up then I'd be happy to add semver checks to shuck's CI over the used surface area.

The AST parser currently parses embedded GHA shell scripts by using a replacement for $${} expressions so it should work fine for this use case. I am planning to add full support in the AST for GitHub expressions in the near future though. This would allow for the types of static checks that actionlint provides but would probably open up some additional use cases for zizmor.

(ps zizmor is a great project and I use it both on all my personal projects and at work so happy to provide any assistance)

[woodruffw]

Thanks @ewhauser! I'll look into those crates.

Yeah, I was going to ask how you handled expression substitutions -- that was one of the things I hadn't figured out how to make fully general (you can replace them with a placeholder of the same length, but there are weird edge cases where the expression itself modifies the shell syntax. Maybe those are niche/not relevant in practice however.)

In terms of parsing expressions, you may be able to use the parser in github-actions-expressions -- it's what zizmor uses internally and has served pretty well over time.

[ewhauser]

I published 0.2.0 which now has support for GitHub expressions in the AST using github-actions-expressions