ci: Add shellcheck step to lint job

.github/workflows/ci.yml

@@ -26,7 +26,12 @@ jobs:
           version: v1.54
           working-directory: .
           args: --timeout 10m
-
+      - name: Install shellcheck (lint for shell scripts)
+        shell: bash
+        run: apt install shellcheck
+      - name: Run shellcheck
+        shell: bash
+        run: scripts/shellcheck.sh
   unit_test:
     name: Golang Unit Tests
     runs-on: ubuntu-20.04

cmd/evm/transition-test.sh

@@ -4,7 +4,7 @@ ticks="\`\`\`"
 function showjson(){
   echo "\`$1\`:"
   echo "${ticks}json"
-  cat $1
+  cat "$1"
   echo ""
   echo "$ticks"
 }
@@ -256,7 +256,7 @@ echo ""
 echo "We can make them spit out the data to e.g. \`stdout\` like this:"
 cmd="./evm t8n --input.alloc=./testdata/1/alloc.json --input.txs=./testdata/1/txs.json --input.env=./testdata/1/env.json --output.result=stdout --output.alloc=stdout --state.fork=Berlin"
 tick;echo "$cmd"; tick
-output=`$cmd 2>/dev/null`
+output=$($cmd 2>/dev/null)
 echo "Output:"
 echo "${ticks}json"
 echo "$output"
@@ -294,7 +294,7 @@ showjson ./testdata/5/env.json
 
 echo "When applying this, using a reward of \`0x08\`"
 cmd="./evm t8n --input.alloc=./testdata/5/alloc.json -input.txs=./testdata/5/txs.json --input.env=./testdata/5/env.json  --output.alloc=stdout --state.reward=0x80 --state.fork=Berlin"
-output=`$cmd 2>/dev/null`
+output=$($cmd 2>/dev/null)
 echo "Output:"
 echo "${ticks}json"
 echo "$output"
@@ -314,16 +314,16 @@ echo "The \`BLOCKHASH\` opcode requires blockhashes to be provided by the caller
 echo "If a required blockhash is not provided, the exit code should be \`4\`:"
 echo "Example where blockhashes are provided: "
 demo "./evm t8n --input.alloc=./testdata/3/alloc.json --input.txs=./testdata/3/txs.json --input.env=./testdata/3/env.json  --trace --state.fork=Berlin"
-cmd="cat trace-0-0x72fadbef39cd251a437eea619cfeda752271a5faaaa2147df012e112159ffb81.jsonl | grep BLOCKHASH -C2"
-tick && echo $cmd && tick
+cmd="grep BLOCKHASH -C2 < trace-0-0x72fadbef39cd251a437eea619cfeda752271a5faaaa2147df012e112159ffb81.jsonl"
+tick && echo "$cmd" && tick
 echo "$ticks"
-cat trace-0-0x72fadbef39cd251a437eea619cfeda752271a5faaaa2147df012e112159ffb81.jsonl | grep BLOCKHASH -C2
+$cmd
 echo "$ticks"
 echo ""
 
 echo "In this example, the caller has not provided the required blockhash:"
 cmd="./evm t8n --input.alloc=./testdata/4/alloc.json --input.txs=./testdata/4/txs.json --input.env=./testdata/4/env.json  --trace --state.fork=Berlin"
-tick && echo $cmd && $cmd 2>&1
+tick && echo "$cmd" && "$cmd" 2>&1
 errc=$?
 tick
 echo "Error code: $errc"
@@ -337,7 +337,7 @@ cmd2="./evm t8n --input.alloc=stdin --input.env=./testdata/1/env.json --input.tx
 echo "$ticks"
 echo "$cmd1 | $cmd2"
 output=$($cmd1 | $cmd2 )
-echo $output
+echo "$output"
 echo "$ticks"
 echo "What happened here, is that we first applied two identical transactions, so the second one was rejected. "
 echo "Then, taking the poststate alloc as the input for the next state, we tried again to include"
@@ -356,28 +356,31 @@ echo ""
 echo "The following command takes **json** the transactions in \`./testdata/13/txs.json\` and signs them. After execution, they are output to \`signed_txs.rlp\`.:"
 cmd="./evm t8n --state.fork=London --input.alloc=./testdata/13/alloc.json --input.txs=./testdata/13/txs.json --input.env=./testdata/13/env.json --output.result=alloc_jsontx.json --output.body=signed_txs.rlp"
 echo "$ticks"
-echo $cmd
+echo "$cmd"
 $cmd 2>&1
 echo "$ticks"
 echo ""
 echo "The \`output.body\` is the rlp-list of transactions, encoded in hex and placed in a string a'la \`json\` encoding rules:"
 demo "cat signed_txs.rlp"
 echo "We can use \`rlpdump\` to check what the contents are: "
 echo "$ticks"
-echo "rlpdump -hex \$(cat signed_txs.rlp | jq -r )"
-rlpdump -hex $(cat signed_txs.rlp | jq -r )
+# TODO(marun) Maybe use a set -x in a subshell to ensure the command is printed e.g. (set -x; <cmd>)
+cmd="rlpdump -hex \$(jq -r < signed_txs.rlp)"
+echo "$cmd"
+$cmd
 echo "$ticks"
 echo "Now, we can now use those (or any other already signed transactions), as input, like so: "
 cmd="./evm t8n --state.fork=London --input.alloc=./testdata/13/alloc.json --input.txs=./signed_txs.rlp --input.env=./testdata/13/env.json --output.result=alloc_rlptx.json"
 echo "$ticks"
-echo $cmd
+echo "$cmd"
 $cmd 2>&1
 echo "$ticks"
 echo "You might have noticed that the results from these two invocations were stored in two separate files. "
 echo "And we can now finally check that they match."
 echo "$ticks"
-echo "cat alloc_jsontx.json | jq .stateRoot && cat alloc_rlptx.json | jq .stateRoot"
-cat alloc_jsontx.json | jq .stateRoot && cat alloc_rlptx.json | jq .stateRoot
+cmd="jq .stateRoot < alloc_jsontx.json && jq .stateRoot < alloc_rlptx.json"
+echo "$cmd"
+$cmd
 echo "$ticks"
 
 cat << "EOF"

metrics/validate.sh

@@ -3,8 +3,8 @@
 set -e
 
 # check there are no formatting issues
-GOFMT_LINES=`gofmt -l . | wc -l | xargs`
-test $GOFMT_LINES -eq 0 || echo "gofmt needs to be run, ${GOFMT_LINES} files have issues"
+GOFMT_LINES=$(gofmt -l . | wc -l | xargs)
+test "$GOFMT_LINES" -eq 0 || echo "gofmt needs to be run, ${GOFMT_LINES} files have issues"
 
 # run the tests for the root package
 go test -race .

scripts/build_bench_precompiles.sh

@@ -16,4 +16,4 @@ source "$SUBNET_EVM_PATH"/scripts/versions.sh
 # Load the constants
 source "$SUBNET_EVM_PATH"/scripts/constants.sh
 
-go test ./precompile/contracts/... -bench=./... -timeout="10m" $@
+go test ./precompile/contracts/... -bench=./... -timeout="10m" "$@"

scripts/build_image.sh

@@ -25,5 +25,5 @@ docker build -t "$DOCKERHUB_REPO:$BUILD_IMAGE_ID" "$SUBNET_EVM_PATH" -f "$SUBNET
   --build-arg CURRENT_BRANCH="$CURRENT_BRANCH"
 
 if [[ ${PUSH_DOCKER_IMAGE:-""} == "true" ]]; then
-  docker push $DOCKERHUB_REPO:$BUILD_IMAGE_ID
+  docker push "$DOCKERHUB_REPO:$BUILD_IMAGE_ID"
 fi

scripts/build_test.sh

@@ -6,6 +6,8 @@ set -o pipefail
 
 export GOGC=25
 
+# TODO(marun) Ensure the working directory is the repository root or a non-canonical set of tests may be executed
+
 # Root directory
 SUBNET_EVM_PATH=$(
     cd "$(dirname "${BASH_SOURCE[0]}")"
@@ -21,4 +23,5 @@ source "$SUBNET_EVM_PATH"/scripts/constants.sh
 # We pass in the arguments to this script directly to enable easily passing parameters such as enabling race detection,
 # parallelism, and test coverage.
 # DO NOT RUN tests from the top level "tests" directory since they are run by ginkgo
-go test -coverprofile=coverage.out -covermode=atomic -timeout="30m" $@ $(go list ./... | grep -v github.com/ava-labs/subnet-evm/tests)
+# shellcheck disable=SC2046
+go test -coverprofile=coverage.out -covermode=atomic -timeout="30m" "$@" $(go list ./... | grep -v github.com/ava-labs/subnet-evm/tests)

scripts/constants.sh

@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
+# Ignore warnings about variables appearing unused since this file is not the consumer of the variables it defines.
+# shellcheck disable=SC2034
+
+set -euo pipefail
+
 # Set the PATHS
 GOPATH="$(go env GOPATH)"
 

scripts/coverage.sh

@@ -9,7 +9,7 @@ if [ ! -f "coverage.out" ]; then
   exit 0
 fi
 
-totalCoverage=`go tool cover -func=coverage.out | grep total | grep -Eo '[0-9]+\.[0-9]+'`
+totalCoverage=$(go tool cover -func=coverage.out | grep total | grep -Eo '[0-9]+\.[0-9]+')
 echo "Current test coverage : $totalCoverage %"
 echo "========================================"
 

scripts/generate_precompile.sh

@@ -18,4 +18,4 @@ SUBNET_EVM_PATH=$(
 # Load the constants
 source "$SUBNET_EVM_PATH"/scripts/constants.sh
 
-go run ./cmd/precompilegen/main.go $@
+go run ./cmd/precompilegen/main.go "$@"

scripts/install_avalanchego_release.sh

@@ -19,7 +19,7 @@ GOOS=$(go env GOOS)
 BASEDIR=${BASEDIR:-"/tmp/avalanchego-release"}
 AVALANCHEGO_BUILD_PATH=${AVALANCHEGO_BUILD_PATH:-${BASEDIR}/avalanchego}
 
-mkdir -p ${BASEDIR}
+mkdir -p "${BASEDIR}"
 
 AVAGO_DOWNLOAD_URL=https://github.com/ava-labs/avalanchego/releases/download/${AVALANCHE_VERSION}/avalanchego-linux-${GOARCH}-${AVALANCHE_VERSION}.tar.gz
 AVAGO_DOWNLOAD_PATH=${BASEDIR}/avalanchego-linux-${GOARCH}-${AVALANCHE_VERSION}.tar.gz
@@ -32,14 +32,14 @@ fi
 BUILD_DIR=${AVALANCHEGO_BUILD_PATH}-${AVALANCHE_VERSION}
 
 extract_archive() {
-  mkdir -p ${BUILD_DIR}
+  mkdir -p "${BUILD_DIR}"
 
   if [[ ${AVAGO_DOWNLOAD_PATH} == *.tar.gz ]]; then
-    tar xzvf ${AVAGO_DOWNLOAD_PATH} --directory ${BUILD_DIR} --strip-components 1
+    tar xzvf "${AVAGO_DOWNLOAD_PATH}" --directory "${BUILD_DIR}" --strip-components 1
   elif [[ ${AVAGO_DOWNLOAD_PATH} == *.zip ]]; then
-    unzip ${AVAGO_DOWNLOAD_PATH} -d ${BUILD_DIR}
-    mv ${BUILD_DIR}/build/* ${BUILD_DIR}
-    rm -rf ${BUILD_DIR}/build/
+    unzip "${AVAGO_DOWNLOAD_PATH}" -d "${BUILD_DIR}"
+    mv "${BUILD_DIR}"/build/* "${BUILD_DIR}"
+    rm -rf "${BUILD_DIR}"/build/
   fi
 }
 
@@ -51,10 +51,10 @@ if [[ -f ${AVAGO_DOWNLOAD_PATH} ]]; then
   extract_archive
 else
   # try to download the archive if it exists
-  if curl -s --head --request GET ${AVAGO_DOWNLOAD_URL} | grep "302" > /dev/null; then
+  if curl -s --head --request GET "${AVAGO_DOWNLOAD_URL}" | grep "302" > /dev/null; then
     echo "${AVAGO_DOWNLOAD_URL} found"
     echo "downloading to ${AVAGO_DOWNLOAD_PATH}"
-    curl -L ${AVAGO_DOWNLOAD_URL} -o ${AVAGO_DOWNLOAD_PATH}
+    curl -L "${AVAGO_DOWNLOAD_URL}" -o "${AVAGO_DOWNLOAD_PATH}"
 
     extract_archive
   else
@@ -65,28 +65,28 @@ else
     # check to see if the repo already exists, if not clone it
     if [[ ! -d ${GIT_CLONE_PATH} ]]; then
       echo "cloning ${GIT_CLONE_URL} to ${GIT_CLONE_PATH}"
-      git clone --no-checkout ${GIT_CLONE_URL} ${GIT_CLONE_PATH}
+      git clone --no-checkout ${GIT_CLONE_URL} "${GIT_CLONE_PATH}"
     fi
 
     # check to see if the commitish exists in the repo
     WORKDIR=$(pwd)
 
-    cd ${GIT_CLONE_PATH}
+    cd "${GIT_CLONE_PATH}"
 
     git fetch
 
     echo "checking out ${AVALANCHE_VERSION}"
 
     set +e
     # try to checkout the branch
-    git checkout origin/${AVALANCHE_VERSION} > /dev/null 2>&1
+    git checkout origin/"${AVALANCHE_VERSION}" > /dev/null 2>&1
     CHECKOUT_STATUS=$?
     set -e
 
     # if it's not a branch, try to checkout the commit
     if [[ $CHECKOUT_STATUS -ne 0 ]]; then
       set +e
-      git checkout ${AVALANCHE_VERSION} > /dev/null 2>&1
+      git checkout "${AVALANCHE_VERSION}" > /dev/null 2>&1
       CHECKOUT_STATUS=$?
       set -e
 
@@ -106,21 +106,21 @@ else
     if [[ ! -d ${BUILD_DIR} ]]; then
       echo "building avalanchego ${COMMIT} to ${BUILD_DIR}"
       ./scripts/build.sh
-      mkdir -p ${BUILD_DIR}
+      mkdir -p "${BUILD_DIR}"
 
-      mv ${GIT_CLONE_PATH}/build/* ${BUILD_DIR}/
+      mv "${GIT_CLONE_PATH}"/build/* "${BUILD_DIR}"/
     fi
 
-    cd $WORKDIR
+    cd "$WORKDIR"
   fi
 fi
 
 AVALANCHEGO_PATH=${AVALANCHEGO_BUILD_PATH}/avalanchego
 AVALANCHEGO_PLUGIN_DIR=${AVALANCHEGO_BUILD_PATH}/plugins
 
-mkdir -p ${AVALANCHEGO_BUILD_PATH}
+mkdir -p "${AVALANCHEGO_BUILD_PATH}"
 
-cp ${BUILD_DIR}/avalanchego ${AVALANCHEGO_PATH}
+cp "${BUILD_DIR}"/avalanchego "${AVALANCHEGO_PATH}"
 
 
 echo "Installed AvalancheGo release ${AVALANCHE_VERSION}"

scripts/lint_allowed_geth_imports.sh

@@ -9,14 +9,14 @@ set -o pipefail
 # 2. Sort the unique results
 # #. Print out the difference between the search results and the list of specified allowed package imports from geth.
 extra_imports=$(grep -r --include='*.go' --exclude-dir='simulator' '"github.com/ethereum/go-ethereum/.*"' -o -h | sort -u | comm -23 - ./scripts/geth-allowed-packages.txt)
-if [ ! -z "${extra_imports}" ]; then
+if [ -n "${extra_imports}" ]; then
     echo "new go-ethereum imports should be added to ./scripts/geth-allowed-packages.txt to prevent accidental imports:"
     echo "${extra_imports}"
     exit 1
 fi
 
 extra_imports=$(grep -r --include='*.go' '"github.com/ava-labs/coreth/.*"' -o -h || true | sort -u)
-if [ ! -z "${extra_imports}" ]; then
+if [ -n "${extra_imports}" ]; then
     echo "subnet-evm should not import packages from coreth:"
     echo "${extra_imports}"
     exit 1

scripts/mock.gen.sh

@@ -28,10 +28,10 @@ source "$SUBNET_EVM_PATH"/scripts/constants.sh
 # tuples of (source interface import path, comma-separated interface names, output file path)
 input="scripts/mocks.mockgen.txt"
 while IFS= read -r line; do
-  IFS='=' read src_import_path interface_name output_path <<<"${line}"
-  package_name=$(basename $(dirname $output_path))
+  IFS='=' read -r src_import_path interface_name output_path <<<"${line}"
+  package_name=$(basename "$(dirname "$output_path")")
   echo "Generating ${output_path}..."
-  mockgen -package=${package_name} -destination=${output_path} ${src_import_path} ${interface_name}
+  mockgen -package="${package_name}" -destination="${output_path}" "${src_import_path}" "${interface_name}"
 
   go-license \
     --config=./header.yml \

scripts/run.sh

@@ -24,11 +24,11 @@ AVALANCHEGO_PATH=${AVALANCHEGO_PATH:-"$AVALANCHEGO_BUILD_PATH/avalanchego"}
 AVALANCHEGO_PLUGIN_DIR=${AVALANCHEGO_PLUGIN_DIR:-"$AVALANCHEGO_BUILD_PATH/plugins"}
 DATA_DIR=${DATA_DIR:-/tmp/subnet-evm-start-node/$(date "+%Y-%m-%d%:%H:%M:%S")}
 
-mkdir -p $DATA_DIR
+mkdir -p "$DATA_DIR"
 
 # Set the config file contents for the path passed in as the first argument
 function _set_config(){
-  cat <<EOF >$1
+  cat <<EOF >"$1"
   {
     "network-id": "local",
     "sybil-protection-enabled": false,
@@ -39,17 +39,17 @@ EOF
 }
 
 function execute_cmd() {
-  echo "Executing command: $@"
-  $@
+  echo "Executing command:" "$@"
+  "$@"
 }
 
 NODE_NAME="node1"
 NODE_DATA_DIR="$DATA_DIR/$NODE_NAME"
 echo "Creating data directory: $NODE_DATA_DIR"
-mkdir -p $NODE_DATA_DIR
+mkdir -p "$NODE_DATA_DIR"
 NODE_CONFIG_FILE_PATH="$NODE_DATA_DIR/config.json"
-_set_config $NODE_CONFIG_FILE_PATH
+_set_config "$NODE_CONFIG_FILE_PATH"
 
 CMD="$AVALANCHEGO_PATH --data-dir=$NODE_DATA_DIR --config-file=$NODE_CONFIG_FILE_PATH"
 
-execute_cmd $CMD
+execute_cmd "$CMD"

scripts/run_ginkgo_load.sh

@@ -17,12 +17,10 @@ source "$SUBNET_EVM_PATH"/scripts/versions.sh
 
 # Build ginkgo
 # to install the ginkgo binary (required for test build and run)
-go install -v github.com/onsi/ginkgo/v2/ginkgo@${GINKGO_VERSION}
-
-TEST_SOURCE_ROOT=$(pwd)
+go install -v github.com/onsi/ginkgo/v2/ginkgo@"${GINKGO_VERSION}"
 
 ACK_GINKGO_RC=true ginkgo build ./tests/load
 
 ./tests/load/load.test \
   --ginkgo.vv \
-  --ginkgo.label-filter=${GINKGO_LABEL_FILTER:-""}
+  --ginkgo.label-filter="${GINKGO_LABEL_FILTER:-""}"

scripts/run_ginkgo_precompile.sh

@@ -17,7 +17,7 @@ source "$SUBNET_EVM_PATH"/scripts/versions.sh
 
 # Build ginkgo
 # to install the ginkgo binary (required for test build and run)
-go install -v github.com/onsi/ginkgo/v2/ginkgo@${GINKGO_VERSION}
+go install -v github.com/onsi/ginkgo/v2/ginkgo@"${GINKGO_VERSION}"
 
 TEST_SOURCE_ROOT=$(pwd)
 
@@ -26,4 +26,4 @@ TEST_SOURCE_ROOT=$(pwd)
 # Use "--ginkgo.focus" to select tests.
 TEST_SOURCE_ROOT="$TEST_SOURCE_ROOT" ginkgo run -procs=5 tests/precompile \
   --ginkgo.vv \
-  --ginkgo.label-filter=${GINKGO_LABEL_FILTER:-""}
+  --ginkgo.label-filter="${GINKGO_LABEL_FILTER:-""}"

scripts/run_ginkgo_simulator.sh

@@ -17,12 +17,10 @@ source "$SUBNET_EVM_PATH"/scripts/versions.sh
 
 # Build ginkgo
 # to install the ginkgo binary (required for test build and run)
-go install -v github.com/onsi/ginkgo/v2/ginkgo@${GINKGO_VERSION}
-
-TEST_SOURCE_ROOT=$(pwd)
+go install -v github.com/onsi/ginkgo/v2/ginkgo@"${GINKGO_VERSION}"
 
 ACK_GINKGO_RC=true ginkgo build ./tests/load
 
 ./tests/load/load.test \
   --ginkgo.vv \
-  --ginkgo.label-filter=${GINKGO_LABEL_FILTER:-""}
+  --ginkgo.label-filter="${GINKGO_LABEL_FILTER:-""}"