[release-1.8] 🌱 Use shellcheck binary instead of self-built docker image

Makefile

@@ -129,6 +129,8 @@ GO_APIDIFF_BIN := go-apidiff
 GO_APIDIFF := $(abspath $(TOOLS_BIN_DIR)/$(GO_APIDIFF_BIN)-$(GO_APIDIFF_VER))
 GO_APIDIFF_PKG := github.com/joelanford/go-apidiff
 
+SHELLCHECK_VER := v0.9.0
+
 KPROMO_VER := v4.0.4
 KPROMO_BIN := kpromo
 KPROMO :=  $(abspath $(TOOLS_BIN_DIR)/$(KPROMO_BIN)-$(KPROMO_VER))
@@ -315,7 +317,6 @@ generate-e2e-templates: ## Generate e2e cluster templates
 lint: $(GOLANGCI_LINT) ## Lint the codebase
 	$(MAKE) lint-go-full
 	$(MAKE) lint-markdown
-	$(MAKE) lint-shell
 
 GOLANGCI_LINT_EXTRA_ARGS ?= --fast=true
 .PHONY: lint-go
@@ -330,10 +331,6 @@ lint-go-full: lint-go ## Run slower linters to detect possible issues
 lint-markdown: ## Lint the project's markdown
 	docker run --rm -v "$$(pwd)":/build$(DOCKER_VOL_OPTS) gcr.io/cluster-api-provider-vsphere/extra/mdlint:0.17.0 -- /md/lint -i _releasenotes .
 
-.PHONY: lint-shell
-lint-shell: ## Lint the project's shell scripts
-	docker run --rm -t -v "$$(pwd)":/build:ro gcr.io/cluster-api-provider-vsphere/extra/shellcheck
-
 .PHONY: lint-fix
 lint-fix: $(GOLANGCI_LINT) ## Lint the codebase and run auto-fixers if supported by the linter
 	GOLANGCI_LINT_EXTRA_ARGS="--fast=false --fix" $(MAKE) lint-go
@@ -344,10 +341,10 @@ APIDIFF_OLD_COMMIT ?= $(shell git rev-parse origin/main)
 apidiff: $(GO_APIDIFF) ## Check for API differences
 	$(GO_APIDIFF) $(APIDIFF_OLD_COMMIT) --print-compatible
 
-ALL_VERIFY_CHECKS = boilerplate modules gen conversions doctoc flavors
+ALL_VERIFY_CHECKS = boilerplate shellcheck modules gen conversions doctoc flavors
 
 .PHONY: verify
-verify: $(addprefix verify-,$(ALL_VERIFY_CHECKS)) lint-markdown lint-shell ## Run all verify-* targets
+verify: $(addprefix verify-,$(ALL_VERIFY_CHECKS)) lint-markdown ## Run all verify-* targets
 
 .PHONY: verify-modules
 verify-modules: generate-modules  ## Verify go modules are up to date
@@ -382,6 +379,10 @@ verify-doctoc: generate-doctoc
 verify-boilerplate: ## Verify boilerplate text exists in each file
 	TRACE=$(TRACE) ./hack/verify-boilerplate.sh
 
+.PHONY: verify-shellcheck
+verify-shellcheck: ## Verify shell files
+	TRACE=$(TRACE) ./hack/verify-shellcheck.sh $(SHELLCHECK_VER)
+
 .PHONY: verify-container-images
 verify-container-images: ## Verify container images
 	TRACE=$(TRACE) ./hack/verify-container-images.sh

hack/tools/shellcheck/shellcheck.sh → hack/utils.sh

@@ -1,5 +1,4 @@
-#!/bin/bash
-
+#!/usr/bin/env bash
 # Copyright 2019 The Kubernetes Authors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -14,8 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-set -o errexit
-set -o nounset
-set -o pipefail
-
-find . -path ./vendor -prune -o -name "*.*sh" -type f -print0 | xargs -0 shellcheck "${@}"
+# get_root_path returns the root path of the project source tree
+get_root_path() {
+    git rev-parse --show-toplevel
+}

hack/verify-shellcheck.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# Copyright 2019 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+if [[ "${TRACE-0}" == "1" ]]; then
+    set -o xtrace
+fi
+
+if [ $# -ne 1 ]; then
+  echo 1>&2 "$0: usage: ./verify-shellcheck.sh <version>"
+  exit 2
+fi
+
+VERSION=${1}
+
+OS="unknown"
+if [[ "${OSTYPE}" == "linux"* ]]; then
+  OS="linux"
+elif [[ "${OSTYPE}" == "darwin"* ]]; then
+  OS="darwin"
+fi
+
+# shellcheck source=./hack/utils.sh
+source "$(dirname "$0")/utils.sh"
+ROOT_PATH=$(get_root_path)
+
+# create a temporary directory
+TMP_DIR=$(mktemp -d)
+OUT="${TMP_DIR}/out.log"
+
+# cleanup on exit
+cleanup() {
+  ret=0
+  if [[ -s "${OUT}" ]]; then
+    echo "Found errors:"
+    cat "${OUT}"
+    ret=1
+  fi
+  echo "Cleaning up..."
+  rm -rf "${TMP_DIR}"
+  exit ${ret}
+}
+trap cleanup EXIT
+
+
+SHELLCHECK="./$(dirname "$0")/tools/bin/shellcheck/${VERSION}/shellcheck"
+
+if [ ! -f "$SHELLCHECK" ]; then
+  # install buildifier
+  cd "${TMP_DIR}" || exit
+  DOWNLOAD_FILE="shellcheck-${VERSION}.${OS}.x86_64.tar.xz"
+  curl -L "https://github.com/koalaman/shellcheck/releases/download/${VERSION}/${DOWNLOAD_FILE}" -o "${TMP_DIR}/shellcheck.tar.xz"
+  tar xf "${TMP_DIR}/shellcheck.tar.xz"
+  cd "${ROOT_PATH}"
+  mkdir -p "$(dirname "$0")/tools/bin/shellcheck/${VERSION}"
+  mv "${TMP_DIR}/shellcheck-${VERSION}/shellcheck" "$SHELLCHECK"
+fi
+
+echo "Running shellcheck..."
+cd "${ROOT_PATH}" || exit
+FILES=$(find . -name "*.sh")
+while read -r file; do
+    "$SHELLCHECK" -x "$file" >> "${OUT}" 2>&1
+done <<< "$FILES"