From 24b2f602db7fdf4ad290e1cd7e6da16b946d4fdd Mon Sep 17 00:00:00 2001 From: Chemaclass Date: Thu, 16 Jul 2026 06:18:42 +0200 Subject: [PATCH] fix(build): make sa actually fail on shellcheck findings MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 'find -exec shellcheck {} \;' swallows shellcheck's exit code — find returns 0 regardless of findings, so 'make sa' printed warnings yet reported OK and let them through to CI (which then failed on SC1087/SC2034 that the local gate had 'passed'). Run one file per invocation via xargs, which propagates failures; -P 4 keeps it ~6s. The excludes mirror CI's SHELLCHECK_OPTS so both gates check the same thing. One file per invocation also sidesteps a shellcheck 0.11.0 crash (GHC pattern-match failure) on multi-file batches with -x. --- Makefile | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 7e03be2c..9896844f 100644 --- a/Makefile +++ b/Makefile @@ -89,11 +89,18 @@ pre_commit/run: test/parallel: $(TEST_SCRIPTS) @bash ./bashunit --parallel --simple $(TEST_SCRIPTS) +# sa: xargs (unlike `find -exec {} \;`) propagates shellcheck's exit code, so +# findings actually fail the target; the excludes mirror the CI workflow's +# SHELLCHECK_OPTS for local/CI parity. One file per invocation (like CI's +# action) because shellcheck 0.11.0 can crash on multi-file batches with -x; +# -P 4 keeps the wall time reasonable. sa: ifndef STATIC_ANALYSIS_CHECKER @printf "\e[1m\e[31m%s\e[0m\n" "Shellcheck not installed: Static analysis not performed!" && exit 1 else - @find . -name "*.sh" -not -path "./local/*" -exec shellcheck -xC {} \; && printf "\e[1m\e[32m%s\e[0m\n" "ShellCheck: OK!" + @find . -name "*.sh" -not -path "./local/*" -print0 \ + | xargs -0 -n 1 -P 4 shellcheck -xC -e SC1091 -e SC2155 -e SC2016 \ + && printf "\e[1m\e[32m%s\e[0m\n" "ShellCheck: OK!" endif lint: