Repository navigation
New audit: shell-syntax #2322
Description
Running shellcheck inside of zizmor is out of the question for performance reasons, but we can do a subset of what shellcheck does by looking for ERROR nodes when we parse each shell block with tree-sitter's bash and/or pwsh grammars.
I'll need to evaluate this to see how noisy it'll be.
h/t @AlexWaygood
Metadata
Metadata
Assignees
Labels
No labels
Activity
pygarap commentedon Aug 29, 2026
What about using shuck instead of shellcheck?
woodruffw commentedon Aug 29, 2026
Oh, that's very cool, I hadn't seen it before! That looks like a good option, although it also still looks pretty new. I think I'd like to see it bake for a bit longer before making it a core dependency of zizmor.
(Hopefully it has a library interface as well, since shelling out is the main performance risk.)
pygarap commentedon Aug 29, 2026
@woodruffw It looks like shuck already publishes the relevant Rust crates on crates.io:
shuck-linter, the lint engine behindshuck checkshuck-parser, the shell parser used by the linterSo zizmor may be able to integrate shuck directly as a Rust library.
Hopefully @ewhauser can clarify whether these crates are intended for external use and suitable for embedding in zizmor.
ewhauser commentedon Aug 29, 2026
The crates are intended for external use and should be embeddable. The APIs are fully mature but if zizmor picked them up then I'd be happy to add semver checks to shuck's CI over the used surface area.
The AST parser currently parses embedded GHA shell scripts by using a replacement for
$${}expressions so it should work fine for this use case. I am planning to add full support in the AST for GitHub expressions in the near future though. This would allow for the types of static checks thatactionlintprovides but would probably open up some additional use cases for zizmor.(ps zizmor is a great project and I use it both on all my personal projects and at work so happy to provide any assistance)
woodruffw commentedon Aug 29, 2026
Thanks @ewhauser! I'll look into those crates.
Yeah, I was going to ask how you handled expression substitutions -- that was one of the things I hadn't figured out how to make fully general (you can replace them with a placeholder of the same length, but there are weird edge cases where the expression itself modifies the shell syntax. Maybe those are niche/not relevant in practice however.)
In terms of parsing expressions, you may be able to use the parser in
github-actions-expressions-- it's what zizmor uses internally and has served pretty well over time.ewhauser commentedon Aug 30, 2026
I published
0.2.0which now has support for GitHub expressions in the AST usinggithub-actions-expressionsfeat(shell-syntax): report syntax errors in run scripts without shell…