# SPDX-License-Identifier: Apache-2.0
# SPDX-FileCopyrightText: 2025,2026 ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG, Cologne
# .shellcheckrc — ndaal linting configuration

# Treat everything at least as warnings, and security‑critical issues as errors.
severity=warning

# Enable all checks, then selectively disable only noisy non‑security ones if needed.
enable=all

# Always assume modern Bash; override per‑file with: # shellcheck shell=bash
shell=bash

# Prefer double quoting even when ShellCheck thinks it is safe (SC2248).
# This nudges you toward always writing "${var}" instead of $var.
enable=SC2248

# Warn on unquoted variables (word splitting, globbing).
enable=SC2086

# Warn on unquoted variables in tests and conditionals.
enable=SC2078
enable=SC2154
enable=SC2155

# Refuse unsafe rm patterns: ensure use of "${var:?}" and no accidental "/".
enable=SC2115
enable=SC2116

# Strengthen parameter expansion and brace usage.
# These help push you toward idiomatic ${var...} forms instead of external tools.
enable=SC2295   # Prefer parameter expansion for dirname/basename where possible.
enable=SC2296   # Prefer parameter expansion instead of sed/expr for simple substitutions.

# Forbid legacy or unsafe constructs that often correlate with sloppy quoting.
enable=SC2034   # Unused variables (helps keep code clean and reviewable).
enable=SC2164   # `cd` without checking exit status.
enable=SC3045   # Use safer mktemp patterns.
enable=SC2028   # Backslash in echo (prefer printf).

# Force POSIX‑safe test style and robust conditionals.
enable=SC2039   # Non‑POSIX features (you can disable for pure Bash-only projects).
enable=SC2268   # Using test with single `[` when `[[` is safer in bash.

# Enforce robust shebangs and shell declaration.
enable=SC2148   # Script without shebang.
enable=SC2096   # Shebang without `exec`.

# Security‑related rules (injection, untrusted input, etc.).
enable=SC2046   # Quote command substitutions.
enable=SC2016   # Variables in single quotes (often a bug in e.g. eval).
enable=SC2044   # For loops over find output.
enable=SC2162   # read without -r.
enable=SC2181   # Check `$?` properly (use `if cmd; then` instead).
enable=SC2015   # Confusing `cmd && cmd || cmd` flow.

# Default color output for interactive use (optional).
color=auto
