refactor: move all shellcheck disable definitions to .shellcheckrc file

This makes standard use of shellcheck work without needing to provide extra configuration anywhere. Also remove use of inline 'shellcheck disable' calls that are already defined in the .shellcheckrc and don't need to be set inline.
2025-12-14 19:17:41 +01:00 · 2023-07-01 04:21:46 -04:00
parent 4436bb2023
commit dac566e75e
36 changed files with 32 additions and 113 deletions
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -68,9 +68,6 @@ jobs:
      - name: Run shellcheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
        # 1.1.0 => 94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
-        env:
-          # keep in sync with tests/shellcheck-exclude
-          SHELLCHECK_OPTS: -e SC1001 -e SC1003 -e SC1090 -e SC1091 -e SC1117 -e SC2029 -e SC2030 -e SC2031 -e SC2034 -e SC2046 -e SC2064 -e SC2068 -e SC2086 -e SC2119 -e SC2120 -e SC2128 -e SC2148 -e SC2153 -e SC2154 -e SC2155 -e SC2162 -e SC2174 -e SC2179 -e SC2191 -e SC2199 -e SC2207 -e SC2219 -e SC2220 -e SC2230 -e SC2231 -e SC2235 -e SC2267 -e SC2295

  shfmt:
    name: shfmt
--- a/.shellcheckrc
+++ b/.shellcheckrc
@@ -1,9 +1,33 @@
+# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
+# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
+# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
 # SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-#        - used for sourcing function files throughout the codebase
+# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
+# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
+# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
+# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
 # SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-#        - used for declaring desc and deprecated function variables
+# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
 # SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-#        - used for traps
+# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
+# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
+# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
+# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
+# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
+# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
+# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
+# SC2154 - Var is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
 # SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-#        - used throughout the codebase
-disable=SC1091,SC2034,SC2064,SC2155
+# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
+# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
+# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
+# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
+# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
+# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
+# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
+# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
+# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
+# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
+# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
+# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
+disable=SC1001,SC1003,SC1090,SC1091,SC1117,SC2029,SC2030,SC2031,SC2034,SC2046,SC2064,SC2068,SC2086,SC2119,SC2120,SC2128,SC2148,SC2153,SC2154,SC2155,SC2162,SC2174,SC2179,SC2191,SC2199,SC2207,SC2219,SC2220,SC2231,SC2235,SC2267,SC2295
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -220,19 +220,15 @@ install-dokku-from-deb-package() {
  [[ -n $DOKKU_NGINX_ENABLE ]] && echo "dokku dokku/nginx_enable string $DOKKU_NGINX_ENABLE" | sudo debconf-set-selections

  if [[ -n $DOKKU_CHECKOUT ]]; then
-    # shellcheck disable=SC2086
    apt-get -qq -y $NO_INSTALL_RECOMMENDS install "dokku=$DOKKU_CHECKOUT"
  else
-    # shellcheck disable=SC2086
    apt-get -qq -y $NO_INSTALL_RECOMMENDS install dokku
  fi
 }

 main() {
  export DOKKU_DISTRO DOKKU_DISTRO_VERSION
-  # shellcheck disable=SC1091
  DOKKU_DISTRO=$(. /etc/os-release && echo "$ID")
-  # shellcheck disable=SC1091
  DOKKU_DISTRO_VERSION=$(. /etc/os-release && echo "$VERSION_ID")

  export DEBIAN_FRONTEND=noninteractive
--- a/contrib/dokku-docker-bin.sh
+++ b/contrib/dokku-docker-bin.sh
@@ -4,5 +4,4 @@ set -eo pipefail
 DOKKU_DOCKER_CONTAINER_NAME=${DOKKU_DOCKER_CONTAINER_NAME:=dokku}

 # TODO: handle cases where we need a tty
-# shellcheck disable=SC2086
 docker exec $DOKKU_DOCKER_ENV -i "$DOKKU_DOCKER_CONTAINER_NAME" dokku "$@"
--- a/contrib/dokku_client.sh
+++ b/contrib/dokku_client.sh
@@ -190,7 +190,6 @@ main() {
  [[ -n "$APP_ARG" ]] && [[ "$APP_ARG" == "--global" ]] && unset APP
  [[ -n "$@" ]] && [[ -n "$APP" ]] && app_arg="--app $APP"
  # echo "ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@"
-  # shellcheck disable=SC2068,SC2086
  ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@ || {
    ssh_exit_code="$?"
    echo " !     Failed to execute dokku command over ssh: exit code $?" 1>&2
--- a/contrib/images/digitalocean/in_parts/100-image-check
+++ b/contrib/images/digitalocean/in_parts/100-image-check
@@ -31,7 +31,6 @@ cmdExists() {
 function getDistro {
  if [ -f /etc/os-release ]; then
    # freedesktop.org and systemd
-    # shellcheck disable=SC1091
    . /etc/os-release
    OS=$NAME
    VER=$VERSION_ID
@@ -41,7 +40,6 @@ function getDistro {
    VER=$(lsb_release -sr)
  elif [ -f /etc/lsb-release ]; then
    # For some versions of Debian/Ubuntu without lsb_release command
-    # shellcheck disable=SC1091
    . /etc/lsb-release
    OS=$DISTRIB_ID
    VER=$DISTRIB_RELEASE
@@ -255,11 +253,9 @@ function checkUsers {
        if [[ "${u[0]}" == "${user}" ]]; then
          if [[ ${u[1]} == "!" ]] || [[ ${u[1]} == "!!" ]] || [[ ${u[1]} == "*" ]]; then
            echo -en "\e[32m[PASS]\e[0m User ${user} has no password set.\n"
-            # shellcheck disable=SC2030
            ((PASS++))
          else
            echo -en "\e[41m[FAIL]\e[0m User ${user} has a password set on their account. Only system users are allowed on the image.\n"
-            # shellcheck disable=SC2030
            ((FAIL++))
            STATUS=2
          fi
@@ -292,7 +288,6 @@ function checkUsers {
                  STATUS=2
                else
                  echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has empty private key file in \e[93m${key}\e[0m\n"
-                  # shellcheck disable=SC2030
                  ((WARN++))
                  if [[ $STATUS != 2 ]]; then
                    STATUS=1
@@ -352,11 +347,9 @@ function checkFirewall {
    ufwa=$(ufw status | head -1 | sed -e "s/^Status:\ //")
    if [[ $ufwa == "active" ]]; then
      FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
-      # shellcheck disable=SC2031
      ((PASS++))
    else
      FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
-      # shellcheck disable=SC2031
      ((WARN++))
    fi
  elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]]; then
@@ -451,7 +444,6 @@ function checkUpdates {
      sleep 2
      apt-get --just-print upgrade | grep -i security | awk '{print $2}' | awk '!seen[$0]++'
      echo -en
-      # shellcheck disable=SC2031
      ((FAIL++))
      STATUS=2
    else
--- a/contrib/release-dokku
+++ b/contrib/release-dokku
@@ -9,19 +9,16 @@ readonly DOKKU_GIT_REV="$(git rev-parse HEAD)"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT

 log-info() {
-  # shellcheck disable=SC2034
  declare desc="Log info formatter"
  echo "$*"
 }

 log-error() {
-  # shellcheck disable=SC2034
  declare desc="Log error formatter"
  echo "!   $*" 1>&2
 }

 log-fail() {
-  # shellcheck disable=SC2034
  declare desc="Log fail formatter"
  log-error "$*"
  exit 1
--- a/contrib/release-plugin
+++ b/contrib/release-plugin
@@ -7,19 +7,16 @@ readonly TMP_WORK_DIR="$(mktemp -d "/tmp/dokku-plugin-release.XXXXXX")"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT

 log-info() {
-  # shellcheck disable=SC2034
  declare desc="Log info formatter"
  echo "$*"
 }

 log-error() {
-  # shellcheck disable=SC2034
  declare desc="Log error formatter"
  echo "!   $*" 1>&2
 }

 log-fail() {
-  # shellcheck disable=SC2034
  declare desc="Log fail formatter"
  log-error "$*"
  exit 1
--- a/debian/config
+++ b/debian/config
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x

 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
  . /usr/share/debconf/confmodule
 fi

--- a/debian/postinst
+++ b/debian/postinst
@@ -3,12 +3,10 @@ set -eo pipefail
 [[ $TRACE ]] && set -x

 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
  . /usr/share/debconf/confmodule
 fi

 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
  source /etc/default/dokku
 fi

--- a/debian/postrm
+++ b/debian/postrm
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x

 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
  . /usr/share/debconf/confmodule
 fi

--- a/debian/preinst
+++ b/debian/preinst
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x

 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
  . /usr/share/debconf/confmodule
 fi

--- a/4
+++ b/4
@@ -4,7 +4,6 @@ shopt -s nullglob

 export DOCKER_BIN=docker
 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
  source /etc/default/dokku
 fi

@@ -31,7 +30,6 @@ fi
 export DOKKU_HOST_ROOT=${DOKKU_HOST_ROOT:=$DOKKU_ROOT}

 export DOKKU_DISTRO
-# shellcheck disable=SC1091
 DOKKU_DISTRO=$(
  . /etc/os-release >/dev/null 2>&1 || true
  echo "$ID"
@@ -109,12 +107,10 @@ fi
 if [[ -n "$SSH_ORIGINAL_COMMAND" ]]; then
  export -n SSH_ORIGINAL_COMMAND
  if [[ $1 =~ config-* ]] || [[ $1 =~ docker-options* ]]; then
-    # shellcheck disable=SC2086
    xargs $0 <<<$SSH_ORIGINAL_COMMAND
    exit $?
  else
    set -f
-    # shellcheck disable=SC2086
    $0 $SSH_ORIGINAL_COMMAND
    set +f
    exit $?
--- a/plugins/20_events/install
+++ b/plugins/20_events/install
@@ -14,7 +14,6 @@ trigger-events-install() {

  # This can be done unconditionally as mkdir -p
  # exits gracefully if the path already exists
-  # shellcheck disable=SC2174
  mkdir -m 775 -p "$DOKKU_LOGS_DIR"
  case "$DOKKU_DISTRO" in
    arch | debian | raspbian)
--- a/plugins/builder-lambda/builder-build
+++ b/plugins/builder-lambda/builder-build
@@ -20,7 +20,6 @@ trigger-builder-lambda-builder-build() {

  plugn trigger pre-build-lambda "$APP"

-  # shellcheck disable=SC2086
  lambda-builder build --generate-image --write-procfile --image-env=DOCKER_LAMBDA_STAY_OPEN=1 --label=org.label-schema.schema-version=1.0 --label=org.label-schema.vendor=dokku --label=com.dokku.image-stage=build --label=com.dokku.builder-type=lambda "--label=com.dokku.app-name=$APP" $DOKKU_GLOBAL_BUILD_ARGS --port 5000 --tag "$IMAGE" --working-directory "$SOURCECODE_WORK_DIR"
  if [[ ! -f "$SOURCECODE_WORK_DIR/lambda.zip" ]]; then
    dokku_log_warn "Compressed lambda.zip not detected, failed to build lambda function"
--- a/plugins/docker-options/docker-args-deploy
+++ b/plugins/docker-options/docker-args-deploy
@@ -33,7 +33,6 @@ trigger-docker-options-docker-args() {

      [[ -z "$line" ]] && continue

-      # shellcheck disable=SC1001
      case "$line" in
        \#*)
          continue
--- a/plugins/docker-options/subcommands/remove
+++ b/plugins/docker-options/subcommands/remove
@@ -13,7 +13,6 @@ cmd-docker-options-remove() {
  verify_app_name "$APP"
  read -ra passed_phases <<<"$(get_phases "$2")"
  shift 2 # everything else passed is the docker option
-  # shellcheck disable=SC2154
  [[ -z ${passed_docker_option="$@"} ]] && dokku_log_fail "Please specify docker options to remove from the phase"
  remove_passed_docker_option passed_phases[@] "${passed_docker_option[@]}"
 }
--- a/plugins/domains/functions
+++ b/plugins/domains/functions
@@ -16,7 +16,6 @@ disable_app_vhost() {
  fi

  [[ "$RESTART_APP" == "--no-restart" ]] && local CONFIG_SET_ARGS=$RESTART_APP
-  # shellcheck disable=SC2086
  DOKKU_QUIET_OUTPUT=1 config_set $CONFIG_SET_ARGS $APP NO_VHOST=1
 }

@@ -196,7 +195,6 @@ enable_app_vhost() {

  plugn trigger pre-enable-vhost "$APP"
  [[ "$RESTART_APP" == "--no-restart" ]] && local CONFIG_SET_ARGS=$RESTART_APP
-  # shellcheck disable=SC2086
  DOKKU_QUIET_OUTPUT=1 config_set $CONFIG_SET_ARGS "$APP" NO_VHOST=0
 }

--- a/plugins/git/git-from-directory
+++ b/plugins/git/git-from-directory
@@ -15,7 +15,6 @@ trigger-git-git-from-directory() {
  local REV
  local TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
  local TMP_WORK_DIR_2=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
-  # shellcheck disable=SC2086
  trap "rm -rf '$TMP_WORK_DIR' '$TMP_WORK_DIR_2' >/dev/null" RETURN INT TERM EXIT

  local has_code=true
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -406,7 +406,6 @@ nginx_build_config() {
      local NGINX_BUILD_CONFIG_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
      local NGINX_CONF=$(mktemp --tmpdir="${NGINX_BUILD_CONFIG_TMP_WORK_DIR}" "nginx.conf.XXXXXX")
      local CUSTOM_NGINX_TEMPLATE="$NGINX_BUILD_CONFIG_TMP_WORK_DIR/$NGINX_TEMPLATE_NAME"
-      # shellcheck disable=SC2086
      trap "rm -rf '$NGINX_CONF' '$NGINX_BUILD_CONFIG_TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT

      get_custom_nginx_template "$APP" "$CUSTOM_NGINX_TEMPLATE" 2>/dev/null
--- a/plugins/scheduler-docker-local/bin/scheduler-deploy-process
+++ b/plugins/scheduler-docker-local/bin/scheduler-deploy-process
@@ -24,7 +24,6 @@ main() {
      # Disable the container restart policy
      "$DOCKER_BIN" container update --restart=no "$cid" &>/dev/null || true

-      # shellcheck disable=SC2086
      "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$cid" &>/dev/null
    done
  fi
--- a/plugins/scheduler-docker-local/check-deploy
+++ b/plugins/scheduler-docker-local/check-deploy
@@ -147,10 +147,8 @@ trigger-scheduler-docker-local-check-deploy() {
  local FAILEDCHECKS=0
  while read -r CHECK_URL EXPECTED; do
    # Ignore empty lines and lines starting with #
-    # shellcheck disable=SC1001
    [[ -z "$CHECK_URL" || "$CHECK_URL" =~ ^\# ]] && continue
    # Ignore if it's not a URL in a supported format
-    # shellcheck disable=SC1001
    ! [[ "$CHECK_URL" =~ ^(http(s)?:)?\/.* ]] && continue

    if [[ "$CHECK_URL" =~ ^https?: ]]; then
@@ -204,7 +202,6 @@ trigger-scheduler-docker-local-check-deploy() {
      sleep "$WAIT"

      # Capture HTTP response or CURL error message
-      # shellcheck disable=SC2086
      if OUTPUT=$(curl -# $CURL_ARGS 2>&1); then
        # OUTPUT contains the HTTP response
        # shellcheck disable=SC2076
--- a/plugins/scheduler-docker-local/internal-functions
+++ b/plugins/scheduler-docker-local/internal-functions
@@ -88,7 +88,6 @@ fn-scheduler-docker-local-retire-container() {
    # Attempt to stop, if that fails, then force a kill as docker seems
    # to not send SIGKILL as the docs would indicate. If that fails, move
    # on to the next.
-    # shellcheck disable=SC2086
    "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$CID" \
      || "$DOCKER_BIN" container kill "$CID" \
      || dokku_log_warn "Unable to kill container ${CID}"
--- a/plugins/scheduler-docker-local/post-delete
+++ b/plugins/scheduler-docker-local/post-delete
@@ -13,7 +13,6 @@ trigger-scheduler-docker-local-post-delete() {
  rm -rf "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"

  # remove all application containers
-  # shellcheck disable=SC2046
  "$DOCKER_BIN" container ls --filter "label=com.dokku.app-name=${APP}" -q | xargs -n1 -I {} "$DOCKER_BIN" container rm --force {} &>/dev/null || true
 }

--- a/plugins/scheduler-docker-local/pre-deploy
+++ b/plugins/scheduler-docker-local/pre-deploy
@@ -58,7 +58,6 @@ scheduler-docker-local-pre-deploy-chown-app() {
    return
  fi

-  # shellcheck disable=SC2086
  "$DOCKER_BIN" container run --rm "${DOCKER_RUN_LABEL_ARGS[@]}" $DOKKU_GLOBAL_RUN_ARGS "${ARG_ARRAY[@]}" $IMAGE /bin/bash -c "find $CONTAINER_PATHS -not -user $DOKKU_APP_USER -print0 | xargs -0 -r chown -R $DOKKU_APP_USER" || true
 }

--- a/plugins/scheduler-docker-local/scheduler-deploy
+++ b/plugins/scheduler-docker-local/scheduler-deploy
@@ -88,7 +88,6 @@ trigger-scheduler-docker-local-scheduler-deploy() {
        # Attempt to stop, if that fails, then force a kill as docker seems
        # to not send SIGKILL as the docs would indicate. If that fails, move
        # on to the next.
-        # shellcheck disable=SC2086
        "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$oldid" \
          || "$DOCKER_BIN" container kill "$oldid" \
          || plugn trigger retire-container-failed "$APP" "$oldid" # plugin trigger for event logging
--- a/plugins/scheduler-docker-local/scheduler-enter
+++ b/plugins/scheduler-docker-local/scheduler-enter
@@ -74,7 +74,6 @@ trigger-scheduler-docker-local-scheduler-enter() {
  local IMAGE="$("$DOCKER_BIN" container inspect --format '{{ .Config.Image }}' "$CONTAINER_ID")"
  is_image_herokuish_based "$IMAGE" "$APP" && EXEC_CMD="/exec"
  is_image_cnb_based "$IMAGE" && EXEC_CMD="" && DOKKU_RUN_OPTS+=" -w /workspace"
-  # shellcheck disable=SC2086
  "$DOCKER_BIN" container exec $DOKKU_RUN_OPTS "$CONTAINER_ID" $EXEC_CMD "${@:-$DOKKU_APP_SHELL}"
 }

--- a/plugins/scheduler-docker-local/scheduler-run-stop
+++ b/plugins/scheduler-docker-local/scheduler-run-stop
@@ -13,7 +13,6 @@ fn-scheduler-docker-local-stop-container() {
  fi

  [[ $DOKKU_DOCKER_STOP_TIMEOUT ]] && DOCKER_STOP_TIME_ARG="--time=${DOKKU_DOCKER_STOP_TIMEOUT}"
-  # shellcheck disable=SC2086
  if "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$CONTAINER_ID_OR_NAME"; then
    return
  fi
--- a/plugins/scheduler-docker-local/scheduler-stop
+++ b/plugins/scheduler-docker-local/scheduler-stop
@@ -20,10 +20,8 @@ trigger-scheduler-docker-local-scheduler-stop() {

  if [[ -n "$DOKKU_APP_RUNNING_CONTAINER_IDS" ]]; then
    # Disable the container restart policy
-    # shellcheck disable=SC2086
    "$DOCKER_BIN" container update --restart=no $DOKKU_APP_RUNNING_CONTAINER_IDS &>/dev/null || true

-    # shellcheck disable=SC2086
    "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG $DOKKU_APP_RUNNING_CONTAINER_IDS >/dev/null || true
  fi

@@ -35,7 +33,6 @@ trigger-scheduler-docker-local-scheduler-stop() {
        plugn trigger scheduler-register-retired "$APP" "$CID"
      done

-      # shellcheck disable=SC2086
      "$DOCKER_BIN" container rm --force $DOKKU_APP_CIDS >/dev/null 2>&1 || true
    fi
  fi
--- a/plugins/shell/subcommands/default
+++ b/plugins/shell/subcommands/default
@@ -44,7 +44,6 @@ cmd-shell-default() {

      # Not a built-in, run as regular dokku command
      *)
-        # shellcheck disable=SC2086
        dokku $line || true
        ;;
    esac
--- a/tests.mk
+++ b/tests.mk
@@ -113,13 +113,13 @@ prime-ssh-known-hosts:
 lint-setup:
 	@mkdir -p test-results/shellcheck tmp/shellcheck
 	@find . -not -path '*/\.*' -not -path './debian/*' -not -path './docs/*' -not -path './tests/*' -not -path './vendor/*' -type f | xargs file | grep text | awk -F ':' '{ print $$1 }' | xargs head -n1 | grep -B1 "bash" | grep "==>" | awk '{ print $$2 }' > tmp/shellcheck/test-files
-	@cat tests/shellcheck-exclude | sed -n -e '/^# SC/p' | cut -d' ' -f2 | paste -d, -s > tmp/shellcheck/exclude
+	@cat .shellcheckrc | sed -n -e '/^# SC/p' | cut -d' ' -f2 | paste -d, -s > tmp/shellcheck/exclude

 lint-ci: lint-setup
 	# these are disabled due to their expansive existence in the codebase. we should clean it up though
-	@cat tests/shellcheck-exclude | sed -n -e '/^# SC/p'
+	@cat .shellcheckrc | sed -n -e '/^# SC/p'
 	@echo linting...
-	@cat tmp/shellcheck/test-files | xargs shellcheck -e $(shell cat tmp/shellcheck/exclude) | tests/shellcheck-to-junit --output test-results/shellcheck/results.xml --files tmp/shellcheck/test-files --exclude $(shell cat tmp/shellcheck/exclude)
+	@cat tmp/shellcheck/test-files | xargs shellcheck | tests/shellcheck-to-junit --output test-results/shellcheck/results.xml --files tmp/shellcheck/test-files --exclude $(shell cat tmp/shellcheck/exclude)

 lint-shfmt: shfmt
 	# verifying via shfmt
--- a/tests/ci/setup.sh
+++ b/tests/ci/setup.sh
@@ -159,7 +159,6 @@ create_package() {
  build_dokku
 }

-# shellcheck disable=SC2120
 setup_circle() {
  install_dependencies
  install_dokku
@@ -188,12 +187,10 @@ case "$1" in
    run_dokku_container
    ;;
  build)
-    # shellcheck disable=SC2119
    create_package
    exit $?
    ;;
  *)
-    # shellcheck disable=SC2119
    setup_circle
    exit $?
    ;;
--- a/tests/ci/unit_test_runner.sh
+++ b/tests/ci/unit_test_runner.sh
@@ -21,7 +21,6 @@ is_number "$BATCH_NUM" || usage
 TESTS=$(find "$(dirname "$0")/../unit" -maxdepth 1 -name "${BATCH_NUM}0*.bats" | sort -n | xargs)
 echo "running the following tests $TESTS"

-# shellcheck disable=SC2086
 for test in $TESTS; do
  echo $test
  starttest=$(date +%s)
--- a/tests/shellcheck-exclude
+++ b/tests/shellcheck-exclude
@@ -1,32 +0,0 @@
-# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
-# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
-# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
-# SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
-# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
-# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
-# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
-# SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
-# SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
-# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
-# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
-# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
-# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
-# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
-# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
-# SC2154 - passed_docker_option is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
-# SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
-# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
-# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
-# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
-# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
-# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
-# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
-# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
-# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
-# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
-# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
-# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
--- a/tests/test_deploy
+++ b/tests/test_deploy
@@ -13,7 +13,6 @@ REPO="test-$(basename "$APP")-$RANDOM"
 ssh "$REMOTE" events:on

 destroy_app() {
-  # shellcheck disable=SC2029
  ssh "$REMOTE" apps:destroy "$REPO" --force
  ssh "$REMOTE" events:off
 }
@@ -63,7 +62,6 @@ fi

 ssh "$REMOTE" events
 ssh "$REMOTE" apps:list
-# shellcheck disable=SC2029
 URL=$(ssh "$REMOTE" url "$REPO")$FORWARDED_PORT
 sleep 2
 if (./check_deploy "$URL"); then
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -57,8 +57,6 @@ flunk() {
 }

 # ShellCheck doesn't know about $status from Bats
-# shellcheck disable=SC2154
-# shellcheck disable=SC2120
 assert_success() {
  if [[ "$status" -ne 0 ]]; then
    flunk "command failed with exit status $status"
@@ -68,8 +66,6 @@ assert_success() {
 }

 # ShellCheck doesn't know about $status from Bats
-# shellcheck disable=SC2154
-# shellcheck disable=SC2120
 assert_failure() {
  if [[ "$status" -eq 0 ]]; then
    flunk "expected failed exit status"
@@ -97,7 +93,6 @@ assert_not_equal() {
 }

 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output() {
  local expected
  if [[ $# -eq 0 ]]; then
@@ -109,7 +104,6 @@ assert_output() {
 }

 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_not_output() {
  local expected
  if [[ $# -eq 0 ]]; then
@@ -121,19 +115,16 @@ assert_not_output() {
 }

 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_exists() {
  [[ -n "$output" ]] || flunk "expected output, found none"
 }

 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_not_exists() {
  [[ -z "$output" ]] || flunk "expected no output, found some"
 }

 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_contains() {
  local input="$output"
  local expected="$1"
@@ -147,7 +138,6 @@ assert_output_contains() {
 }

 # ShellCheck doesn't know about $lines from Bats
-# shellcheck disable=SC2154
 assert_line() {
  if [[ "$1" -ge 0 ]] 2>/dev/null; then
    assert_equal "$2" "${lines[$1]}"
@@ -161,7 +151,6 @@ assert_line() {
 }

 # ShellCheck doesn't know about $lines from Bats
-# shellcheck disable=SC2154
 assert_line_count() {
  declare EXPECTED="$1"
  local num_lines="${#lines[@]}"
@@ -218,7 +207,6 @@ destroy_key() {
  rm -f /tmp/testkey* &>/dev/null || true
 }

-# shellcheck disable=SC2119
 check_urls() {
  local PATTERN="$1"
  run /bin/bash -c "dokku urls $TEST_APP | grep -E \"${PATTERN}\""
@@ -320,7 +308,6 @@ deploy_app() {

  rmdir "$TMP" && cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/$APP_TYPE" "$TMP"

-  # shellcheck disable=SC2086
  [[ -n "$CUSTOM_TEMPLATE" ]] && $CUSTOM_TEMPLATE $TEST_APP $TMP/$CUSTOM_PATH

  pushd "$TMP" &>/dev/null || exit 1