From dac566e75ebcfdc26636d243630fade41062ac30 Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Sat, 1 Jul 2023 04:21:46 -0400
Subject: [PATCH] refactor: move all shellcheck disable definitions to
 .shellcheckrc file

This makes standard use of shellcheck work without needing to provide extra configuration anywhere.

Also remove use of inline 'shellcheck disable' calls that are already defined in the .shellcheckrc and don't need to be set inline.
---
 .github/workflows/lint.yml                    |  3 --
 .shellcheckrc                                 | 34 ++++++++++++++++---
 bootstrap.sh                                  |  4 ---
 contrib/dokku-docker-bin.sh                   |  1 -
 contrib/dokku_client.sh                       |  1 -
 .../digitalocean/in_parts/100-image-check     |  8 -----
 contrib/release-dokku                         |  3 --
 contrib/release-plugin                        |  3 --
 debian/config                                 |  1 -
 debian/postinst                               |  2 --
 debian/postrm                                 |  1 -
 debian/preinst                                |  1 -
 dokku                                         |  4 ---
 plugins/20_events/install                     |  1 -
 plugins/builder-lambda/builder-build          |  1 -
 plugins/docker-options/docker-args-deploy     |  1 -
 plugins/docker-options/subcommands/remove     |  1 -
 plugins/domains/functions                     |  2 --
 plugins/git/git-from-directory                |  1 -
 plugins/nginx-vhosts/functions                |  1 -
 .../bin/scheduler-deploy-process              |  1 -
 plugins/scheduler-docker-local/check-deploy   |  3 --
 .../scheduler-docker-local/internal-functions |  1 -
 plugins/scheduler-docker-local/post-delete    |  1 -
 plugins/scheduler-docker-local/pre-deploy     |  1 -
 .../scheduler-docker-local/scheduler-deploy   |  1 -
 .../scheduler-docker-local/scheduler-enter    |  1 -
 .../scheduler-docker-local/scheduler-run-stop |  1 -
 plugins/scheduler-docker-local/scheduler-stop |  3 --
 plugins/shell/subcommands/default             |  1 -
 tests.mk                                      |  6 ++--
 tests/ci/setup.sh                             |  3 --
 tests/ci/unit_test_runner.sh                  |  1 -
 tests/shellcheck-exclude                      | 32 -----------------
 tests/test_deploy                             |  2 --
 tests/unit/test_helper.bash                   | 13 -------
 36 files changed, 32 insertions(+), 113 deletions(-)
 delete mode 100644 tests/shellcheck-exclude

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 84135ae54..0553e9a20 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -68,9 +68,6 @@ jobs:
       - name: Run shellcheck
         uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
         # 1.1.0 => 94e0aab03ca135d11a35e5bfc14e6746dc56e7e9
-        env:
-          # keep in sync with tests/shellcheck-exclude
-          SHELLCHECK_OPTS: -e SC1001 -e SC1003 -e SC1090 -e SC1091 -e SC1117 -e SC2029 -e SC2030 -e SC2031 -e SC2034 -e SC2046 -e SC2064 -e SC2068 -e SC2086 -e SC2119 -e SC2120 -e SC2128 -e SC2148 -e SC2153 -e SC2154 -e SC2155 -e SC2162 -e SC2174 -e SC2179 -e SC2191 -e SC2199 -e SC2207 -e SC2219 -e SC2220 -e SC2230 -e SC2231 -e SC2235 -e SC2267 -e SC2295
 
   shfmt:
     name: shfmt
diff --git a/.shellcheckrc b/.shellcheckrc
index eed21d662..dffeb4f39 100644
--- a/.shellcheckrc
+++ b/.shellcheckrc
@@ -1,9 +1,33 @@
+# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
+# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
+# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
 # SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-#        - used for sourcing function files throughout the codebase
+# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
+# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
+# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
+# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
 # SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-#        - used for declaring desc and deprecated function variables
+# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
 # SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-#        - used for traps
+# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
+# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
+# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
+# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
+# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
+# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
+# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
+# SC2154 - Var is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
 # SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-#        - used throughout the codebase
-disable=SC1091,SC2034,SC2064,SC2155
+# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
+# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
+# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
+# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
+# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
+# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
+# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
+# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
+# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
+# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
+# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
+# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
+disable=SC1001,SC1003,SC1090,SC1091,SC1117,SC2029,SC2030,SC2031,SC2034,SC2046,SC2064,SC2068,SC2086,SC2119,SC2120,SC2128,SC2148,SC2153,SC2154,SC2155,SC2162,SC2174,SC2179,SC2191,SC2199,SC2207,SC2219,SC2220,SC2231,SC2235,SC2267,SC2295
diff --git a/bootstrap.sh b/bootstrap.sh
index 8613cbf1d..04e4cd8cb 100755
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -220,19 +220,15 @@ install-dokku-from-deb-package() {
   [[ -n $DOKKU_NGINX_ENABLE ]] && echo "dokku dokku/nginx_enable string $DOKKU_NGINX_ENABLE" | sudo debconf-set-selections
 
   if [[ -n $DOKKU_CHECKOUT ]]; then
-    # shellcheck disable=SC2086
     apt-get -qq -y $NO_INSTALL_RECOMMENDS install "dokku=$DOKKU_CHECKOUT"
   else
-    # shellcheck disable=SC2086
     apt-get -qq -y $NO_INSTALL_RECOMMENDS install dokku
   fi
 }
 
 main() {
   export DOKKU_DISTRO DOKKU_DISTRO_VERSION
-  # shellcheck disable=SC1091
   DOKKU_DISTRO=$(. /etc/os-release && echo "$ID")
-  # shellcheck disable=SC1091
   DOKKU_DISTRO_VERSION=$(. /etc/os-release && echo "$VERSION_ID")
 
   export DEBIAN_FRONTEND=noninteractive
diff --git a/contrib/dokku-docker-bin.sh b/contrib/dokku-docker-bin.sh
index 3bc362322..9619f4651 100755
--- a/contrib/dokku-docker-bin.sh
+++ b/contrib/dokku-docker-bin.sh
@@ -4,5 +4,4 @@ set -eo pipefail
 DOKKU_DOCKER_CONTAINER_NAME=${DOKKU_DOCKER_CONTAINER_NAME:=dokku}
 
 # TODO: handle cases where we need a tty
-# shellcheck disable=SC2086
 docker exec $DOKKU_DOCKER_ENV -i "$DOKKU_DOCKER_CONTAINER_NAME" dokku "$@"
diff --git a/contrib/dokku_client.sh b/contrib/dokku_client.sh
index 32a3dde63..e0b3ffd4c 100755
--- a/contrib/dokku_client.sh
+++ b/contrib/dokku_client.sh
@@ -190,7 +190,6 @@ main() {
   [[ -n "$APP_ARG" ]] && [[ "$APP_ARG" == "--global" ]] && unset APP
   [[ -n "$@" ]] && [[ -n "$APP" ]] && app_arg="--app $APP"
   # echo "ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@"
-  # shellcheck disable=SC2068,SC2086
   ssh -o LogLevel=QUIET -p $DOKKU_PORT -t dokku@$DOKKU_REMOTE_HOST -- $app_arg $@ || {
     ssh_exit_code="$?"
     echo " !     Failed to execute dokku command over ssh: exit code $?" 1>&2
diff --git a/contrib/images/digitalocean/in_parts/100-image-check b/contrib/images/digitalocean/in_parts/100-image-check
index a14bb87c1..fde0fede7 100755
--- a/contrib/images/digitalocean/in_parts/100-image-check
+++ b/contrib/images/digitalocean/in_parts/100-image-check
@@ -31,7 +31,6 @@ cmdExists() {
 function getDistro {
   if [ -f /etc/os-release ]; then
     # freedesktop.org and systemd
-    # shellcheck disable=SC1091
     . /etc/os-release
     OS=$NAME
     VER=$VERSION_ID
@@ -41,7 +40,6 @@ function getDistro {
     VER=$(lsb_release -sr)
   elif [ -f /etc/lsb-release ]; then
     # For some versions of Debian/Ubuntu without lsb_release command
-    # shellcheck disable=SC1091
     . /etc/lsb-release
     OS=$DISTRIB_ID
     VER=$DISTRIB_RELEASE
@@ -255,11 +253,9 @@ function checkUsers {
         if [[ "${u[0]}" == "${user}" ]]; then
           if [[ ${u[1]} == "!" ]] || [[ ${u[1]} == "!!" ]] || [[ ${u[1]} == "*" ]]; then
             echo -en "\e[32m[PASS]\e[0m User ${user} has no password set.\n"
-            # shellcheck disable=SC2030
             ((PASS++))
           else
             echo -en "\e[41m[FAIL]\e[0m User ${user} has a password set on their account. Only system users are allowed on the image.\n"
-            # shellcheck disable=SC2030
             ((FAIL++))
             STATUS=2
           fi
@@ -292,7 +288,6 @@ function checkUsers {
                   STATUS=2
                 else
                   echo -en "\e[93m[WARN]\e[0m User \e[1m${user}\e[0m has empty private key file in \e[93m${key}\e[0m\n"
-                  # shellcheck disable=SC2030
                   ((WARN++))
                   if [[ $STATUS != 2 ]]; then
                     STATUS=1
@@ -352,11 +347,9 @@ function checkFirewall {
     ufwa=$(ufw status | head -1 | sed -e "s/^Status:\ //")
     if [[ $ufwa == "active" ]]; then
       FW_VER="\e[32m[PASS]\e[0m Firewall service (${fw}) is active\n"
-      # shellcheck disable=SC2031
       ((PASS++))
     else
       FW_VER="\e[93m[WARN]\e[0m No firewall is configured. Ensure ${fw} is installed and configured\n"
-      # shellcheck disable=SC2031
       ((WARN++))
     fi
   elif [[ $OS == "CentOS Linux" ]] || [[ $OS == "CentOS Stream" ]] || [[ $OS == "Rocky Linux" ]] || [[ $OS == "AlmaLinux" ]]; then
@@ -451,7 +444,6 @@ function checkUpdates {
       sleep 2
       apt-get --just-print upgrade | grep -i security | awk '{print $2}' | awk '!seen[$0]++'
       echo -en
-      # shellcheck disable=SC2031
       ((FAIL++))
       STATUS=2
     else
diff --git a/contrib/release-dokku b/contrib/release-dokku
index cff7282c0..ea5935bc6 100755
--- a/contrib/release-dokku
+++ b/contrib/release-dokku
@@ -9,19 +9,16 @@ readonly DOKKU_GIT_REV="$(git rev-parse HEAD)"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
 log-info() {
-  # shellcheck disable=SC2034
   declare desc="Log info formatter"
   echo "$*"
 }
 
 log-error() {
-  # shellcheck disable=SC2034
   declare desc="Log error formatter"
   echo "!   $*" 1>&2
 }
 
 log-fail() {
-  # shellcheck disable=SC2034
   declare desc="Log fail formatter"
   log-error "$*"
   exit 1
diff --git a/contrib/release-plugin b/contrib/release-plugin
index e0cbc55f2..f034414b2 100755
--- a/contrib/release-plugin
+++ b/contrib/release-plugin
@@ -7,19 +7,16 @@ readonly TMP_WORK_DIR="$(mktemp -d "/tmp/dokku-plugin-release.XXXXXX")"
 trap "rm -rf '$TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
 log-info() {
-  # shellcheck disable=SC2034
   declare desc="Log info formatter"
   echo "$*"
 }
 
 log-error() {
-  # shellcheck disable=SC2034
   declare desc="Log error formatter"
   echo "!   $*" 1>&2
 }
 
 log-fail() {
-  # shellcheck disable=SC2034
   declare desc="Log fail formatter"
   log-error "$*"
   exit 1
diff --git a/debian/config b/debian/config
index e4bcc25be..99bba1b23 100755
--- a/debian/config
+++ b/debian/config
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
diff --git a/debian/postinst b/debian/postinst
index 0663ca651..1b755a173 100755
--- a/debian/postinst
+++ b/debian/postinst
@@ -3,12 +3,10 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
   source /etc/default/dokku
 fi
 
diff --git a/debian/postrm b/debian/postrm
index 6c15a4d09..78f3b83de 100755
--- a/debian/postrm
+++ b/debian/postrm
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
diff --git a/debian/preinst b/debian/preinst
index e4dfdef5e..fb7104341 100755
--- a/debian/preinst
+++ b/debian/preinst
@@ -3,7 +3,6 @@ set -eo pipefail
 [[ $TRACE ]] && set -x
 
 if [[ -e /usr/share/debconf/confmodule ]]; then
-  # shellcheck disable=SC1091
   . /usr/share/debconf/confmodule
 fi
 
diff --git a/dokku b/dokku
index 23570f28d..7e37af297 100755
--- a/dokku
+++ b/dokku
@@ -4,7 +4,6 @@ shopt -s nullglob
 
 export DOCKER_BIN=docker
 if [[ -r /etc/default/dokku ]]; then
-  # shellcheck disable=SC1091
   source /etc/default/dokku
 fi
 
@@ -31,7 +30,6 @@ fi
 export DOKKU_HOST_ROOT=${DOKKU_HOST_ROOT:=$DOKKU_ROOT}
 
 export DOKKU_DISTRO
-# shellcheck disable=SC1091
 DOKKU_DISTRO=$(
   . /etc/os-release >/dev/null 2>&1 || true
   echo "$ID"
@@ -109,12 +107,10 @@ fi
 if [[ -n "$SSH_ORIGINAL_COMMAND" ]]; then
   export -n SSH_ORIGINAL_COMMAND
   if [[ $1 =~ config-* ]] || [[ $1 =~ docker-options* ]]; then
-    # shellcheck disable=SC2086
     xargs $0 <<<$SSH_ORIGINAL_COMMAND
     exit $?
   else
     set -f
-    # shellcheck disable=SC2086
     $0 $SSH_ORIGINAL_COMMAND
     set +f
     exit $?
diff --git a/plugins/20_events/install b/plugins/20_events/install
index d1eea5198..003a1e89d 100755
--- a/plugins/20_events/install
+++ b/plugins/20_events/install
@@ -14,7 +14,6 @@ trigger-events-install() {
 
   # This can be done unconditionally as mkdir -p
   # exits gracefully if the path already exists
-  # shellcheck disable=SC2174
   mkdir -m 775 -p "$DOKKU_LOGS_DIR"
   case "$DOKKU_DISTRO" in
     arch | debian | raspbian)
diff --git a/plugins/builder-lambda/builder-build b/plugins/builder-lambda/builder-build
index eb13cd21b..2c1b7a107 100755
--- a/plugins/builder-lambda/builder-build
+++ b/plugins/builder-lambda/builder-build
@@ -20,7 +20,6 @@ trigger-builder-lambda-builder-build() {
 
   plugn trigger pre-build-lambda "$APP"
 
-  # shellcheck disable=SC2086
   lambda-builder build --generate-image --write-procfile --image-env=DOCKER_LAMBDA_STAY_OPEN=1 --label=org.label-schema.schema-version=1.0 --label=org.label-schema.vendor=dokku --label=com.dokku.image-stage=build --label=com.dokku.builder-type=lambda "--label=com.dokku.app-name=$APP" $DOKKU_GLOBAL_BUILD_ARGS --port 5000 --tag "$IMAGE" --working-directory "$SOURCECODE_WORK_DIR"
   if [[ ! -f "$SOURCECODE_WORK_DIR/lambda.zip" ]]; then
     dokku_log_warn "Compressed lambda.zip not detected, failed to build lambda function"
diff --git a/plugins/docker-options/docker-args-deploy b/plugins/docker-options/docker-args-deploy
index 9bc2ec673..9c4d8c2ec 100755
--- a/plugins/docker-options/docker-args-deploy
+++ b/plugins/docker-options/docker-args-deploy
@@ -33,7 +33,6 @@ trigger-docker-options-docker-args() {
 
       [[ -z "$line" ]] && continue
 
-      # shellcheck disable=SC1001
       case "$line" in
         \#*)
           continue
diff --git a/plugins/docker-options/subcommands/remove b/plugins/docker-options/subcommands/remove
index f258a0b34..bddbbcdbd 100755
--- a/plugins/docker-options/subcommands/remove
+++ b/plugins/docker-options/subcommands/remove
@@ -13,7 +13,6 @@ cmd-docker-options-remove() {
   verify_app_name "$APP"
   read -ra passed_phases <<<"$(get_phases "$2")"
   shift 2 # everything else passed is the docker option
-  # shellcheck disable=SC2154
   [[ -z ${passed_docker_option="$@"} ]] && dokku_log_fail "Please specify docker options to remove from the phase"
   remove_passed_docker_option passed_phases[@] "${passed_docker_option[@]}"
 }
diff --git a/plugins/domains/functions b/plugins/domains/functions
index 17c59c7aa..9b6e481ee 100755
--- a/plugins/domains/functions
+++ b/plugins/domains/functions
@@ -16,7 +16,6 @@ disable_app_vhost() {
   fi
 
   [[ "$RESTART_APP" == "--no-restart" ]] && local CONFIG_SET_ARGS=$RESTART_APP
-  # shellcheck disable=SC2086
   DOKKU_QUIET_OUTPUT=1 config_set $CONFIG_SET_ARGS $APP NO_VHOST=1
 }
 
@@ -196,7 +195,6 @@ enable_app_vhost() {
 
   plugn trigger pre-enable-vhost "$APP"
   [[ "$RESTART_APP" == "--no-restart" ]] && local CONFIG_SET_ARGS=$RESTART_APP
-  # shellcheck disable=SC2086
   DOKKU_QUIET_OUTPUT=1 config_set $CONFIG_SET_ARGS "$APP" NO_VHOST=0
 }
 
diff --git a/plugins/git/git-from-directory b/plugins/git/git-from-directory
index 9f94568c5..03e7058de 100755
--- a/plugins/git/git-from-directory
+++ b/plugins/git/git-from-directory
@@ -15,7 +15,6 @@ trigger-git-git-from-directory() {
   local REV
   local TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
   local TMP_WORK_DIR_2=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
-  # shellcheck disable=SC2086
   trap "rm -rf '$TMP_WORK_DIR' '$TMP_WORK_DIR_2' >/dev/null" RETURN INT TERM EXIT
 
   local has_code=true
diff --git a/plugins/nginx-vhosts/functions b/plugins/nginx-vhosts/functions
index 25ccdd4e7..299e84aab 100755
--- a/plugins/nginx-vhosts/functions
+++ b/plugins/nginx-vhosts/functions
@@ -406,7 +406,6 @@ nginx_build_config() {
       local NGINX_BUILD_CONFIG_TMP_WORK_DIR=$(mktemp -d "/tmp/dokku-${DOKKU_PID}-${FUNCNAME[0]}.XXXXXX")
       local NGINX_CONF=$(mktemp --tmpdir="${NGINX_BUILD_CONFIG_TMP_WORK_DIR}" "nginx.conf.XXXXXX")
       local CUSTOM_NGINX_TEMPLATE="$NGINX_BUILD_CONFIG_TMP_WORK_DIR/$NGINX_TEMPLATE_NAME"
-      # shellcheck disable=SC2086
       trap "rm -rf '$NGINX_CONF' '$NGINX_BUILD_CONFIG_TMP_WORK_DIR' >/dev/null" RETURN INT TERM EXIT
 
       get_custom_nginx_template "$APP" "$CUSTOM_NGINX_TEMPLATE" 2>/dev/null
diff --git a/plugins/scheduler-docker-local/bin/scheduler-deploy-process b/plugins/scheduler-docker-local/bin/scheduler-deploy-process
index 27d59889e..a088ee9df 100755
--- a/plugins/scheduler-docker-local/bin/scheduler-deploy-process
+++ b/plugins/scheduler-docker-local/bin/scheduler-deploy-process
@@ -24,7 +24,6 @@ main() {
       # Disable the container restart policy
       "$DOCKER_BIN" container update --restart=no "$cid" &>/dev/null || true
 
-      # shellcheck disable=SC2086
       "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$cid" &>/dev/null
     done
   fi
diff --git a/plugins/scheduler-docker-local/check-deploy b/plugins/scheduler-docker-local/check-deploy
index 310b5c9a3..363b0c168 100755
--- a/plugins/scheduler-docker-local/check-deploy
+++ b/plugins/scheduler-docker-local/check-deploy
@@ -147,10 +147,8 @@ trigger-scheduler-docker-local-check-deploy() {
   local FAILEDCHECKS=0
   while read -r CHECK_URL EXPECTED; do
     # Ignore empty lines and lines starting with #
-    # shellcheck disable=SC1001
     [[ -z "$CHECK_URL" || "$CHECK_URL" =~ ^\# ]] && continue
     # Ignore if it's not a URL in a supported format
-    # shellcheck disable=SC1001
     ! [[ "$CHECK_URL" =~ ^(http(s)?:)?\/.* ]] && continue
 
     if [[ "$CHECK_URL" =~ ^https?: ]]; then
@@ -204,7 +202,6 @@ trigger-scheduler-docker-local-check-deploy() {
       sleep "$WAIT"
 
       # Capture HTTP response or CURL error message
-      # shellcheck disable=SC2086
       if OUTPUT=$(curl -# $CURL_ARGS 2>&1); then
         # OUTPUT contains the HTTP response
         # shellcheck disable=SC2076
diff --git a/plugins/scheduler-docker-local/internal-functions b/plugins/scheduler-docker-local/internal-functions
index 1a44deae9..de854b4f9 100755
--- a/plugins/scheduler-docker-local/internal-functions
+++ b/plugins/scheduler-docker-local/internal-functions
@@ -88,7 +88,6 @@ fn-scheduler-docker-local-retire-container() {
     # Attempt to stop, if that fails, then force a kill as docker seems
     # to not send SIGKILL as the docs would indicate. If that fails, move
     # on to the next.
-    # shellcheck disable=SC2086
     "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$CID" \
       || "$DOCKER_BIN" container kill "$CID" \
       || dokku_log_warn "Unable to kill container ${CID}"
diff --git a/plugins/scheduler-docker-local/post-delete b/plugins/scheduler-docker-local/post-delete
index 26c631ec1..109b07748 100755
--- a/plugins/scheduler-docker-local/post-delete
+++ b/plugins/scheduler-docker-local/post-delete
@@ -13,7 +13,6 @@ trigger-scheduler-docker-local-post-delete() {
   rm -rf "${DOKKU_LIB_ROOT}/data/scheduler-docker-local/$APP"
 
   # remove all application containers
-  # shellcheck disable=SC2046
   "$DOCKER_BIN" container ls --filter "label=com.dokku.app-name=${APP}" -q | xargs -n1 -I {} "$DOCKER_BIN" container rm --force {} &>/dev/null || true
 }
 
diff --git a/plugins/scheduler-docker-local/pre-deploy b/plugins/scheduler-docker-local/pre-deploy
index 6dcd94fae..b6d1bb197 100755
--- a/plugins/scheduler-docker-local/pre-deploy
+++ b/plugins/scheduler-docker-local/pre-deploy
@@ -58,7 +58,6 @@ scheduler-docker-local-pre-deploy-chown-app() {
     return
   fi
 
-  # shellcheck disable=SC2086
   "$DOCKER_BIN" container run --rm "${DOCKER_RUN_LABEL_ARGS[@]}" $DOKKU_GLOBAL_RUN_ARGS "${ARG_ARRAY[@]}" $IMAGE /bin/bash -c "find $CONTAINER_PATHS -not -user $DOKKU_APP_USER -print0 | xargs -0 -r chown -R $DOKKU_APP_USER" || true
 }
 
diff --git a/plugins/scheduler-docker-local/scheduler-deploy b/plugins/scheduler-docker-local/scheduler-deploy
index b9fbdae7b..3f742a01b 100755
--- a/plugins/scheduler-docker-local/scheduler-deploy
+++ b/plugins/scheduler-docker-local/scheduler-deploy
@@ -88,7 +88,6 @@ trigger-scheduler-docker-local-scheduler-deploy() {
         # Attempt to stop, if that fails, then force a kill as docker seems
         # to not send SIGKILL as the docs would indicate. If that fails, move
         # on to the next.
-        # shellcheck disable=SC2086
         "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$oldid" \
           || "$DOCKER_BIN" container kill "$oldid" \
           || plugn trigger retire-container-failed "$APP" "$oldid" # plugin trigger for event logging
diff --git a/plugins/scheduler-docker-local/scheduler-enter b/plugins/scheduler-docker-local/scheduler-enter
index b6b2a024d..35cc65ff7 100755
--- a/plugins/scheduler-docker-local/scheduler-enter
+++ b/plugins/scheduler-docker-local/scheduler-enter
@@ -74,7 +74,6 @@ trigger-scheduler-docker-local-scheduler-enter() {
   local IMAGE="$("$DOCKER_BIN" container inspect --format '{{ .Config.Image }}' "$CONTAINER_ID")"
   is_image_herokuish_based "$IMAGE" "$APP" && EXEC_CMD="/exec"
   is_image_cnb_based "$IMAGE" && EXEC_CMD="" && DOKKU_RUN_OPTS+=" -w /workspace"
-  # shellcheck disable=SC2086
   "$DOCKER_BIN" container exec $DOKKU_RUN_OPTS "$CONTAINER_ID" $EXEC_CMD "${@:-$DOKKU_APP_SHELL}"
 }
 
diff --git a/plugins/scheduler-docker-local/scheduler-run-stop b/plugins/scheduler-docker-local/scheduler-run-stop
index 3b9f730d4..d46f9ad72 100755
--- a/plugins/scheduler-docker-local/scheduler-run-stop
+++ b/plugins/scheduler-docker-local/scheduler-run-stop
@@ -13,7 +13,6 @@ fn-scheduler-docker-local-stop-container() {
   fi
 
   [[ $DOKKU_DOCKER_STOP_TIMEOUT ]] && DOCKER_STOP_TIME_ARG="--time=${DOKKU_DOCKER_STOP_TIMEOUT}"
-  # shellcheck disable=SC2086
   if "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG "$CONTAINER_ID_OR_NAME"; then
     return
   fi
diff --git a/plugins/scheduler-docker-local/scheduler-stop b/plugins/scheduler-docker-local/scheduler-stop
index 32ab1e5ed..a6f2bafd9 100755
--- a/plugins/scheduler-docker-local/scheduler-stop
+++ b/plugins/scheduler-docker-local/scheduler-stop
@@ -20,10 +20,8 @@ trigger-scheduler-docker-local-scheduler-stop() {
 
   if [[ -n "$DOKKU_APP_RUNNING_CONTAINER_IDS" ]]; then
     # Disable the container restart policy
-    # shellcheck disable=SC2086
     "$DOCKER_BIN" container update --restart=no $DOKKU_APP_RUNNING_CONTAINER_IDS &>/dev/null || true
 
-    # shellcheck disable=SC2086
     "$DOCKER_BIN" container stop $DOCKER_STOP_TIME_ARG $DOKKU_APP_RUNNING_CONTAINER_IDS >/dev/null || true
   fi
 
@@ -35,7 +33,6 @@ trigger-scheduler-docker-local-scheduler-stop() {
         plugn trigger scheduler-register-retired "$APP" "$CID"
       done
 
-      # shellcheck disable=SC2086
       "$DOCKER_BIN" container rm --force $DOKKU_APP_CIDS >/dev/null 2>&1 || true
     fi
   fi
diff --git a/plugins/shell/subcommands/default b/plugins/shell/subcommands/default
index 2a8b13abf..00602e160 100755
--- a/plugins/shell/subcommands/default
+++ b/plugins/shell/subcommands/default
@@ -44,7 +44,6 @@ cmd-shell-default() {
 
       # Not a built-in, run as regular dokku command
       *)
-        # shellcheck disable=SC2086
         dokku $line || true
         ;;
     esac
diff --git a/tests.mk b/tests.mk
index 495d5c80f..a1cd915d3 100644
--- a/tests.mk
+++ b/tests.mk
@@ -113,13 +113,13 @@ prime-ssh-known-hosts:
 lint-setup:
 	@mkdir -p test-results/shellcheck tmp/shellcheck
 	@find . -not -path '*/\.*' -not -path './debian/*' -not -path './docs/*' -not -path './tests/*' -not -path './vendor/*' -type f | xargs file | grep text | awk -F ':' '{ print $$1 }' | xargs head -n1 | grep -B1 "bash" | grep "==>" | awk '{ print $$2 }' > tmp/shellcheck/test-files
-	@cat tests/shellcheck-exclude | sed -n -e '/^# SC/p' | cut -d' ' -f2 | paste -d, -s > tmp/shellcheck/exclude
+	@cat .shellcheckrc | sed -n -e '/^# SC/p' | cut -d' ' -f2 | paste -d, -s > tmp/shellcheck/exclude
 
 lint-ci: lint-setup
 	# these are disabled due to their expansive existence in the codebase. we should clean it up though
-	@cat tests/shellcheck-exclude | sed -n -e '/^# SC/p'
+	@cat .shellcheckrc | sed -n -e '/^# SC/p'
 	@echo linting...
-	@cat tmp/shellcheck/test-files | xargs shellcheck -e $(shell cat tmp/shellcheck/exclude) | tests/shellcheck-to-junit --output test-results/shellcheck/results.xml --files tmp/shellcheck/test-files --exclude $(shell cat tmp/shellcheck/exclude)
+	@cat tmp/shellcheck/test-files | xargs shellcheck | tests/shellcheck-to-junit --output test-results/shellcheck/results.xml --files tmp/shellcheck/test-files --exclude $(shell cat tmp/shellcheck/exclude)
 
 lint-shfmt: shfmt
 	# verifying via shfmt
diff --git a/tests/ci/setup.sh b/tests/ci/setup.sh
index a8ebd8448..46f2a490e 100755
--- a/tests/ci/setup.sh
+++ b/tests/ci/setup.sh
@@ -159,7 +159,6 @@ create_package() {
   build_dokku
 }
 
-# shellcheck disable=SC2120
 setup_circle() {
   install_dependencies
   install_dokku
@@ -188,12 +187,10 @@ case "$1" in
     run_dokku_container
     ;;
   build)
-    # shellcheck disable=SC2119
     create_package
     exit $?
     ;;
   *)
-    # shellcheck disable=SC2119
     setup_circle
     exit $?
     ;;
diff --git a/tests/ci/unit_test_runner.sh b/tests/ci/unit_test_runner.sh
index 53f18d6d2..4d39c10c8 100755
--- a/tests/ci/unit_test_runner.sh
+++ b/tests/ci/unit_test_runner.sh
@@ -21,7 +21,6 @@ is_number "$BATCH_NUM" || usage
 TESTS=$(find "$(dirname "$0")/../unit" -maxdepth 1 -name "${BATCH_NUM}0*.bats" | sort -n | xargs)
 echo "running the following tests $TESTS"
 
-# shellcheck disable=SC2086
 for test in $TESTS; do
   echo $test
   starttest=$(date +%s)
diff --git a/tests/shellcheck-exclude b/tests/shellcheck-exclude
deleted file mode 100644
index 2049f4b80..000000000
--- a/tests/shellcheck-exclude
+++ /dev/null
@@ -1,32 +0,0 @@
-# SC1001 - This \/ will be a regular '/' in this context - https://github.com/koalaman/shellcheck/wiki/SC1001
-# SC1003 - Want to escape a single quote? echo 'This is how it'\''s done' - https://github.com/koalaman/shellcheck/wiki/SC1003
-# SC1090 - Can't follow non-constant source. Use a directive to specify location - https://github.com/koalaman/shellcheck/wiki/SC1090
-# SC1091 - Not following: FILE: does not exist (No such file or directory) - https://github.com/koalaman/shellcheck/wiki/SC1091
-# SC1117 - Backslash is literal in "\n". Prefer explicit escaping: "\\n" - https://github.com/koalaman/shellcheck/wiki/SC1117
-# SC2029 - Note that, unescaped, this expands on the client side - https://github.com/koalaman/shellcheck/wiki/SC2029
-# SC2030 - Modification of var is local (to subshell caused by pipeline). - https://github.com/koalaman/shellcheck/wiki/SC2030
-# SC2031 - var was modified in a subshell. That change might be lost. - https://github.com/koalaman/shellcheck/wiki/SC2031
-# SC2034 - VAR appears unused - https://github.com/koalaman/shellcheck/wiki/SC2034
-# SC2046 - Quote this to prevent word splitting - https://github.com/koalaman/shellcheck/wiki/SC2046
-# SC2064 - Use single quotes, otherwise this expands now rather than when signalled. - https://github.com/koalaman/shellcheck/wiki/SC2064
-# SC2068 - Double quote array expansions to avoid re-splitting elements - https://github.com/koalaman/shellcheck/wiki/SC2068
-# SC2086 - Double quote to prevent globbing and word splitting - https://github.com/koalaman/shellcheck/wiki/SC2086
-# SC2119 - Use 'function "$@"' if function's $1 should mean script's $1 - https://github.com/koalaman/shellcheck/wiki/SC2119
-# SC2120 - Function references arguments, but none are ever passed - https://github.com/koalaman/shellcheck/wiki/SC2120
-# SC2128 - Expanding an array without an index only gives the first element - https://github.com/koalaman/shellcheck/wiki/SC2128
-# SC2148 - Tips depend on target shell and yours is unknown. Add a shebang - https://github.com/koalaman/shellcheck/wiki/SC2148
-# SC2153 - Possible misspelling: DOKKU_ROOT may not be assigned, but DOKKU_PORT is - https://github.com/koalaman/shellcheck/wiki/SC2153
-# SC2154 - passed_docker_option is referenced but not assigned - https://github.com/koalaman/shellcheck/wiki/SC2154
-# SC2155 - Declare and assign separately to avoid masking return values - https://github.com/koalaman/shellcheck/wiki/SC2155
-# SC2162 - read without -r will mangle backslashes - https://github.com/koalaman/shellcheck/wiki/SC2162
-# SC2174 - When used with -p, -m only applies to the deepest directory - https://github.com/koalaman/shellcheck/wiki/SC2174
-# SC2179 - Use array+=("item") to append items to an array - https://github.com/koalaman/shellcheck/wiki/SC2179
-# SC2191 - The = here is literal. To assign by index, use ( [index]=value ) with no spaces. To keep as literal, quote it - https://github.com/koalaman/shellcheck/wiki/SC2191
-# SC2199 - Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @) - https://github.com/koalaman/shellcheck/wiki/SC2199
-# SC2207 - Prefer mapfile or read -a to split command output (or quote to avoid splitting) - https://github.com/koalaman/shellcheck/wiki/SC2207
-# SC2219 - Instead of 'let expr', prefer (( expr ))  - https://github.com/koalaman/shellcheck/wiki/SC2219
-# SC2220 - Invalid flags are not handled. Add a *) case - https://github.com/koalaman/shellcheck/wiki/SC2220
-# SC2231 - Quote expansions in this for loop glob to prevent wordsplitting, e.g. "$dir"/*.txt  - https://github.com/koalaman/shellcheck/wiki/SC2231
-# SC2235 - Use { ..; } instead of (..) to avoid subshell overhead - https://github.com/koalaman/shellcheck/wiki/SC2235
-# SC2267 - GNU xargs -i is deprecated in favor of -I{} - https://github.com/koalaman/shellcheck/wiki/SC2267
-# SC2295 - Expansions inside ${..} need to be quoted separately, otherwise they match as patterns - https://github.com/koalaman/shellcheck/wiki/SC2295
diff --git a/tests/test_deploy b/tests/test_deploy
index fdc67866d..01ecbda18 100755
--- a/tests/test_deploy
+++ b/tests/test_deploy
@@ -13,7 +13,6 @@ REPO="test-$(basename "$APP")-$RANDOM"
 ssh "$REMOTE" events:on
 
 destroy_app() {
-  # shellcheck disable=SC2029
   ssh "$REMOTE" apps:destroy "$REPO" --force
   ssh "$REMOTE" events:off
 }
@@ -63,7 +62,6 @@ fi
 
 ssh "$REMOTE" events
 ssh "$REMOTE" apps:list
-# shellcheck disable=SC2029
 URL=$(ssh "$REMOTE" url "$REPO")$FORWARDED_PORT
 sleep 2
 if (./check_deploy "$URL"); then
diff --git a/tests/unit/test_helper.bash b/tests/unit/test_helper.bash
index 7d39ec012..c3c242807 100644
--- a/tests/unit/test_helper.bash
+++ b/tests/unit/test_helper.bash
@@ -57,8 +57,6 @@ flunk() {
 }
 
 # ShellCheck doesn't know about $status from Bats
-# shellcheck disable=SC2154
-# shellcheck disable=SC2120
 assert_success() {
   if [[ "$status" -ne 0 ]]; then
     flunk "command failed with exit status $status"
@@ -68,8 +66,6 @@ assert_success() {
 }
 
 # ShellCheck doesn't know about $status from Bats
-# shellcheck disable=SC2154
-# shellcheck disable=SC2120
 assert_failure() {
   if [[ "$status" -eq 0 ]]; then
     flunk "expected failed exit status"
@@ -97,7 +93,6 @@ assert_not_equal() {
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output() {
   local expected
   if [[ $# -eq 0 ]]; then
@@ -109,7 +104,6 @@ assert_output() {
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_not_output() {
   local expected
   if [[ $# -eq 0 ]]; then
@@ -121,19 +115,16 @@ assert_not_output() {
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_exists() {
   [[ -n "$output" ]] || flunk "expected output, found none"
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_not_exists() {
   [[ -z "$output" ]] || flunk "expected no output, found some"
 }
 
 # ShellCheck doesn't know about $output from Bats
-# shellcheck disable=SC2154
 assert_output_contains() {
   local input="$output"
   local expected="$1"
@@ -147,7 +138,6 @@ assert_output_contains() {
 }
 
 # ShellCheck doesn't know about $lines from Bats
-# shellcheck disable=SC2154
 assert_line() {
   if [[ "$1" -ge 0 ]] 2>/dev/null; then
     assert_equal "$2" "${lines[$1]}"
@@ -161,7 +151,6 @@ assert_line() {
 }
 
 # ShellCheck doesn't know about $lines from Bats
-# shellcheck disable=SC2154
 assert_line_count() {
   declare EXPECTED="$1"
   local num_lines="${#lines[@]}"
@@ -218,7 +207,6 @@ destroy_key() {
   rm -f /tmp/testkey* &>/dev/null || true
 }
 
-# shellcheck disable=SC2119
 check_urls() {
   local PATTERN="$1"
   run /bin/bash -c "dokku urls $TEST_APP | grep -E \"${PATTERN}\""
@@ -320,7 +308,6 @@ deploy_app() {
 
   rmdir "$TMP" && cp -r "${BATS_TEST_DIRNAME}/../../tests/apps/$APP_TYPE" "$TMP"
 
-  # shellcheck disable=SC2086
   [[ -n "$CUSTOM_TEMPLATE" ]] && $CUSTOM_TEMPLATE $TEST_APP $TMP/$CUSTOM_PATH
 
   pushd "$TMP" &>/dev/null || exit 1