Add native support for "Code Climate" / "GitLab Code Quality" report
shellcheck can be used with GitLab, which is already documented here: https://github.com/koalaman/shellcheck/wiki/GitLab-CI
There exists several so-called "GitLab components" like https://gitlab.com/pipeline-components/shellcheck which make it very easy to run shellcheck as part of ones own pipeline.
What most of them currently lack is "Code Quality report" integration, showing shellchecks findings next to the lines changed by a "Merge Request" in GitLab. This is currently still supported by running shellcheck via "Code Climate" https://docs.codeclimate.com/docs/shellcheck, but that is deprecated: https://docs.gitlab.com/ci/testing/code_quality/#use-the-built-in-code-quality-cicd-template-deprecated
This is replaced by running linters directly: https://docs.gitlab.com/ci/testing/code_quality/#integrate-common-tools-with-code-quality
The JSON output of shellcheck can be converted to the required "Code Climate" JSON format: https://docs.gitlab.com/ci/testing/code_quality/#code-quality-report-format using jq, see attached shell script.
A GitLab pipeline fragment then might look like this:
$[[ inputs.job_name ]]: # e.g. "shellcheck"
stage: $[[ inputs.stage ]] # e.g. "lint"
image: $[[ inputs.image ]] # e.g. your variant of "koalaman/shellcheck:stable"
variables:
GIT_DEPTH: "1"
script: |
set -e -u -o pipefail
export severity="$[[ inputs.severity ]]" # one of "error", "warning", "info" or "style"
gl-shellcheck | tee gl-code-quality-report.json
artifacts:
reports:
codequality: gl-code-quality-report.json
when: always
interruptible: true
allow_failure:
exit_codes:
- 1
This has several drawbacks:
- You have to build a Docker image yourself, which both contains
shellcheckandjq(andbash). - You have to write the JSON into a file, but optionally also want a human readable output in the console output – see #2348 to add support for multiple outputs
- If you use
| teeto redirect the output to both a file and the console, you loose the exit code fromshellcheck
It would be good if shellcheck could directly generate a valid "Code Climate" JSON report.