PMD vs ShellCheck

PMD is a free, extensible static code analyzer that checks source code for programming flaws such as unused variables, empty catch blocks, and unnecessary object creation. It includes more than 400 built-in rules, and teams can write custom rules in Java or XPath. Its bundled CPD tool finds duplicated code across many programming languages. PMD checks source directories from the command line and can run as a Maven, Ant, Gradle, or bld build operation. Supported languages include Java, JavaScript, Salesforce Apex and Visualforce, Kotlin, Swift, Modelica, PL/SQL, Apache Velocity, JSP, WSDL, Maven POM, HTML, XML, and XSL; Scala is supported without Scala rules. It runs on Linux, macOS, and Windows and requires Java 8 or above. For CI, its GitHub Action can create SARIF reports and fail builds based on violation counts; documentation also covers GitLab, Jenkins, and Bamboo integrations. IDE integrations include Eclipse, IntelliJ IDEA, and Visual Studio Code, though some listed plugins are not actively maintained. Only the latest major version is actively developed.

ShellCheck is a free static analysis tool for Bash and sh scripts. It flags syntax problems, semantic issues, and subtle pitfalls that could make scripts fail in future circumstances, then offers warnings and suggestions. You can paste a script into ShellCheck.net or run it from a terminal with `shellcheck yourscript`.

The project lists integrations for Vim, Emacs, Sublime, Pulsar Edit, and VS Code, along with GCC-compatible warnings for other editors. It can also be added to builds or test suites, with support listed for services including Travis CI, Codacy, Code Climate, CodeFactor, CircleCI, GitHub Actions, and Trunk. Output options include JSON, CheckStyle-compatible XML, GCC-compatible warnings, and readable text with or without ANSI colors. Installation routes include package managers, precompiled binaries, Docker, and source compilation. ShellCheck is licensed under GPLv3; its wiki documents the tool, and bugs can be reported through GitHub issues. There are no official Apple Silicon binaries, and compiling from source requires 2 GB of RAM.