I seriously doubt that there can be any static code analysis performed in shell scripts, especially because shell scripts must call external programs and rely on what these external programs return, and there are a myriad of external programs and states the external environment. It looks like a static code analysis problem that relies heavily on the eval like mechanism, but shell scripts are all about eval-style programming.
However, there are some general pointers that may be useful for "checking" correctly, covering code, and documenting shell scripts, as the main languages ββdo:
You can always run the script with the -x option (AKA xtrace ) - it will output a trace similar to stderr:
+ log_end_msg 0 + [ -z 0 ] + retval=0 + log_end_msg_pre 0 + : + log_use_fancy_output + TPUT=/usr/bin/tput + EXPR=/usr/bin/expr + [ -t 1 ] + [ xxterm != x ] + [ xxterm != xdumb ]
Bash allows you to redirect this stream to an external FD (using BASH_XTRACEFD ) - it is much easier to parse in practice.
This is not trivial, but you can write a program that finds the appropriate code fragments executed using the xxtrace output and gives you a fancy report on the code coverage - like what was called, how many times, which parts of the code didn't execute at all and therefore did not have testing coverage.
Actually there is a wonderful tool called shcov that uses this process, although it is somewhat simplified and doesnβt work "handle all possible cases perfectly (especially when we are talking about long and complex lines)
And last but not least, there is a minimalistic shelldoc project (akin to javadoc ) that helps to generate documentation based on comments in shell scripts. Yes, this is a shameless plugin :)
source share