[PATCH v2] [pre-commit] Add shellcheck

[Tom de Vries <tdevries@suse.de>]

I found a pure python implementation of shellcheck [1][2].

It's not an exact copy, but close enough.  One notable difference is the
absence of data flow analysis [3], so basically it's got a hardcoded
--extended-analysis=false.

I've done a security audit using Claude Sonnet 4.5 with the prompts:
...
/security-review
Please do the security review for the source code.
...
and that seemed fine.

Use it to check scripts in the repo.

Exclude any scripts that are not currently clean.

As an example, gdb/testsuite/make-check-all.sh is shellcheck clean, but not
with --extended-analysis=false:
...
$ shellcheck --extended-analysis=true make-check-all.sh >/dev/null; echo $?
0
$ shellcheck --extended-analysis=false make-check-all.sh >/dev/null; echo $?
1
...
so it's also excluded.

Running it seems reasonably fast:
...
$ pre-commit run pureshellcheck --all-files -v
pureshellcheck..........................................................Passed
- hook id: pureshellcheck
- duration: 0.06s
...

For information on other solutions, see this RFC [4].

Changes in v2:
- mention hardcoded --extended-analysis=false
- mention security audit
- use commit hash to pin down version, for now via a clone (as we've done
  before with tclint) because the official source doesn't contain a
  .pre-commit-hooks.yaml file

Versions:
- v1 https://sourceware.org/pipermail/gdb-patches/2026-June/228118.html

[1] https://pypi.org/project/pureshellcheck/0.2.2/
[2] https://github.com/adam2go/pureshellcheck
[3] https://github.com/adam2go/pureshellcheck/issues/1
[4] https://sourceware.org/pipermail/gdb-patches/2024-November/213400.html
---
 .pre-commit-config.yaml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 9910bbb82f2..af2fd6403e0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -94,6 +94,21 @@ repos:
       args: [--trust-plugins]
       files: '^gdb/testsuite/.*\.(exp|tcl)$'
 
+  # Pureshellcheck hooks.  The repo is a clone of pureshellcheck
+  # ( https://github.com/adam2go/pureshellcheck ), with a
+  # .pre-commit-hooks.yaml file added.  Use a commit hash rather than a tag to
+  # guard against supply chain attacks.
+  - repo: https://github.com/vries/pureshellcheck
+    # The commit hash corresponds to v0.2.2, that is:
+    # $ git diff --stat v0.2.2 <rev>
+    # .pre-commit-hooks.yaml | 5 +++++
+    rev: a41d65d3a941325e6cb901e60b0a7e7975d1fb64
+    hooks:
+    - id: pureshellcheck
+      files: '^(gdb|gdbsupport|gdbserver)/'
+      types: ['shell']
+      exclude: '^(gdb/config/djgpp/(djcheck.sh|djconfig.sh)|gdb/contrib/ari/(create-web-ari-in-src.sh|gdb_ari.sh|update-web-ari.sh)|gdb/contrib/(cc-with-tweaks.sh|expect-read1.sh|gdb-add-index.sh|license-check-new-files.sh)|gdb/gdb_buildall.sh|gdb/gdb_mbuild.sh|gdb/regformats/regdat.sh|gdb/syscalls/update-linux-from-src.sh|gdb/testsuite/make-check-all.sh|gdb/gcore-1.in|gdb/po/gdbtext|gdb/testsuite/lib/pdtrace.in)$|/configure$'
+
   # Local hooks.
   - repo: local
     hooks:

base-commit: fd3cf86c638b7fdc0ccb64e178ec43ccd7e9d3f9
-- 
2.51.0