fix(ci): resolve all ShellCheck warnings and errors

- fix(gc-cleanup): SC1128 move shebang to line 1 (was after comment)
- fix(auto-deployment): SC2181 check git pull exit code directly in if
- fix(rsync-backup): SC2181 inline rsync into if condition
- fix(backup): SC2086 quote variables; convert backup_files to array
- fix(backup-size-trend): SC2038 use -print0/-0 for non-alphanumeric filenames
- fix(check-ssl-expiry): SC2004 remove unnecessary $/{} in arithmetic
- fix(disk-inode-monitor): SC2034 remove unused ALERT variable in subshell
- fix(disk-usage-monitor): SC2162 add -r to read; SC2086 quote $output
- fix(file-integrity-snapshot): SC2094 write to tempfile then mv to manifest
- fix(git-repo-stats): SC2006 replace backticks with $(); SC2126 use grep -c
- fix(k8s-pod-restart-report): SC2054 quote custom-columns arg; SC2034 remove unused findings
- fix(kubectl-namespace-cleanup): SC2162 add -r to read -p
- fix(system-resource-reporter): SC2155 declare then assign all local vars
- fix(ci): set --severity=warning so warnings and errors fail the build
- fix(shellcheckrc): align severity with CI (warning)

Author: wesleyscholl

.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Lint all scripts
         run: |
           echo "Running ShellCheck on all scripts..."
-          find scripts/ -name "*.sh" -type f | sort | xargs shellcheck
+          find scripts/ -name "*.sh" -type f | sort | xargs shellcheck --severity=warning
 
   test:
     name: BATS Test Suite

.shellcheckrc

@@ -4,8 +4,8 @@
 # All scripts in this repo target bash
 shell=bash
 
-# Only fail on actual errors (not style warnings) — tighten to 'warning' over time
-severity=error
+# Only fail on warnings and above (not style/info notes) — tighten to 'style' over time
+severity=warning
 
 # SC1091: Not following source — external files can't be statically analysed
 disable=SC1091

scripts/auto-deployment.sh

@@ -9,10 +9,9 @@ cd "$REPO_DIR" || { echo "Repository directory not found."; exit 1; }
 
 # Pull the latest code
 echo "Pulling latest code from repository."
-git pull origin main
 
 # Check if the pull was successful
-if [ $? -eq 0 ]; then
+if git pull origin main; then
     echo "Code updated successfully."
     # Restart the application service
     echo "Restarting $SERVICE service."

scripts/backup-size-trend.sh

@@ -29,4 +29,4 @@ if [[ ! -d "$BACKUP_DIR" ]]; then
 fi
 
 echo "Largest backup files in $BACKUP_DIR"
-find "$BACKUP_DIR" -maxdepth 1 -type f | xargs -r du -h 2>/dev/null | sort -hr | head -n "$TOP_N"
+find "$BACKUP_DIR" -maxdepth 1 -type f -print0 | xargs -r0 du -h 2>/dev/null | sort -hr | head -n "$TOP_N"

scripts/backup.sh

@@ -3,23 +3,23 @@
 
 # Set backup directories and files 
 backup_dir="/var/backups"
-backup_files="/etc /var/www /home /var/lib /var/mail /opt"
+backup_files=(/etc /var/www /home /var/lib /var/mail /opt)
 
 # Set the date and time for the backup
 day=$(date +%Y-%m-%d)
 hostname=$(hostname -s)
 archive_file="$hostname-$day.tgz"
 
 # Create the backup directory if it does not exist
-if [ ! -d $backup_dir ]; then
-  mkdir -p $backup_dir
+if [ ! -d "$backup_dir" ]; then
+  mkdir -p "$backup_dir"
 fi
 
 # Create the backup archive
-tar czf $backup_dir/$archive_file $backup_files
+tar czf "$backup_dir/$archive_file" "${backup_files[@]}"
 
 # Print the backup status
-echo "Backup of $backup_files completed! Details about the output backup file:"
-ls -lh $backup_dir/$archive_file
+echo "Backup of ${backup_files[*]} completed! Details about the output backup file:"
+ls -lh "$backup_dir/$archive_file"
 echo "Backup completed on $(date)"
 echo "Backup script completed"

scripts/check-ssl-expiry.sh

@@ -32,7 +32,7 @@ EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s 2>/dev/null || date -j -f "%b %d %T %Y
 CURRENT_EPOCH=$(date +%s)
 
 # Calculate days until expiration
-DAYS_UNTIL_EXPIRY=$(( ($EXPIRY_EPOCH - $CURRENT_EPOCH) / 86400 ))
+DAYS_UNTIL_EXPIRY=$(( (EXPIRY_EPOCH - CURRENT_EPOCH) / 86400 ))
 
 # Display results
 echo "Certificate expiration date: $EXPIRY_DATE"

scripts/disk-inode-monitor.sh

@@ -38,7 +38,6 @@ df -Pi | awk 'NR>1 {print $1, $5, $6}' | while read -r fs usage mount; do
     used_percent=${usage%%%}
     if (( used_percent >= THRESHOLD )); then
         echo "ALERT: $fs at $mount inode usage ${usage}"
-        ALERT=1
     else
         echo "OK: $fs at $mount inode usage ${usage}"
     fi

scripts/disk-usage-monitor.sh

@@ -5,9 +5,9 @@ THRESHOLD=80
 ALERT_EMAIL="admin@example.com"
 
 # Check disk usage for each mounted file system
-df -h | awk '{if(NR>1) print $5 " " $6}' | while read output; do
-    usage=$(echo $output | awk '{print $1}' | sed 's/%//')
-    mount_point=$(echo $output | awk '{print $2}')
+df -h | awk '{if(NR>1) print $5 " " $6}' | while read -r output; do
+    usage=$(echo "$output" | awk '{print $1}' | sed 's/%//')
+    mount_point=$(echo "$output" | awk '{print $2}')
     if [ "$usage" -ge "$THRESHOLD" ]; then
         echo "Disk usage on $mount_point has reached $usage%." | mail -s "Disk Usage Alert" "$ALERT_EMAIL"
     fi

scripts/file-integrity-snapshot.sh

@@ -41,7 +41,9 @@ if [[ "$MODE" == "create" ]]; then
     fi
 
     if [[ -d "$TARGET_PATH" ]]; then
-        find "$TARGET_PATH" -type f ! -name "$(basename "$MANIFEST_FILE")" -print0 | sort -z | xargs -0 sha256sum > "$MANIFEST_FILE"
+        _tmpfile=$(mktemp)
+        find "$TARGET_PATH" -type f ! -name "$(basename "$MANIFEST_FILE")" -print0 | sort -z | xargs -0 sha256sum > "$_tmpfile"
+        mv "$_tmpfile" "$MANIFEST_FILE"
     else
         sha256sum "$TARGET_PATH" > "$MANIFEST_FILE"
     fi

scripts/gc-cleanup.sh

@@ -1,5 +1,5 @@
-# Script run garbage collection 
 #!/bin/bash
+# Script run garbage collection
 
 # Run git gc prune - remove objects that are no longer pointed to by any object
 git gc --prune=now