IMP: new tag in file to tell that the script should pass shellcheck

The `# run-shellchek` tag must be placed in the first 10 lines of the
file

shellcheck/docker_build_and_run_shellcheck.sh

@@ -1,4 +1,7 @@
 #!/bin/bash
+# run-shellcheck
+# usage : $0 [shell script to check]
+# called without arguments, il will shellcheck any *.sh file found in the project
 set -e
 
 dockerfile="$(dirname "$0")/Dockerfile.shellcheck"

shellcheck/launch_shellcheck.sh

@@ -1,7 +1,9 @@
 #!/bin/bash
-
+# run-shellcheck
+# please do not run this script directly but `docker_build_and_run_shellcheck.sh`
 
 files=""
+retval=0
 
 if [ $# -eq 0 ]; then
     files=$(find . -name "*.sh")
@@ -10,6 +12,11 @@ else
 fi
 
 for f in $files; do
-    printf "\e[1;36mRunning shellcheck on: %s  \e[0m\n" "$f"
-    /usr/bin/shellcheck --color=always --external-sources --shell=bash "$f"
+    if head "$f" | grep -qE "^# run-shellcheck$"; then
+        printf "\e[1;36mRunning shellcheck on: %s  \e[0m\n" "$f"
+        if ! /usr/bin/shellcheck --color=always --external-sources --shell=bash "$f"; then
+            retval=$((retval + 1))
+        fi
+    fi
 done
+exit "$retval"

tests/docker_build_and_run_tests.sh

@@ -1,5 +1,6 @@
 #! /bin/bash
 # This file builds a docker image for testing the targeted debian version
+# run-shellcheck
 set -e
 
 target=""

tests/hardening/12.10_find_suid_files.sh

@@ -1,7 +1,9 @@
+# run-shellcheck
 test_audit() {
     describe Running void to generate the conf file that will later be edited
     # shellcheck disable=2154
     /opt/debian-cis/bin/hardening/"${script}".sh || true
+    # shellcheck disable=2016
     echo 'EXCEPTIONS="$EXCEPTIONS /usr/lib/dbus-1.0/dbus-daemon-launch-helper"' >> /opt/debian-cis/etc/conf.d/"${script}".cfg
 
     describe Running on blank host

tests/hardening/12.11_find_sgid_files.sh

@@ -1,3 +1,4 @@
+# run-shellcheck
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0

tests/hardening/12.7_find_world_writable_file.sh

@@ -1,3 +1,4 @@
+# run-shellcheck
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0

tests/hardening/12.8_find_unowned_files.sh

@@ -1,3 +1,4 @@
+# run-shellcheck
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0

tests/hardening/12.9_find_ungrouped_files.sh

@@ -1,3 +1,4 @@
+# run-shellcheck
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0

tests/hardening/2.17_sticky_bit_world_writable_folder.sh

@@ -1,3 +1,4 @@
+# run-shellcheck
 test_audit() {
     describe Running on blank host
     register_test retvalshouldbe 0

tests/launch_tests.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# run-shellcheck
 # stop on any error
 set -e
 # stop on undefined variable

tests/lib.sh

@@ -1,4 +1,5 @@
 # shellcheck shell=bash
+# run-shellcheck
 ###########################################
 # Assertion functions for funcional tests #
 ###########################################

tests/run_all_targets.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# run-shellcheck
 # usage : $0 [--nodel|--nowait] [1.1_script-to-test.sh...]
 # --nodel will keep logs
 # --nowait will not wait for you to see logs