feat: add no-variables-in-printf-format rule

[nzakas]

Adds shell/no-variables-in-printf-format, which mirrors ShellCheck SC2059: a variable in the printf format string is interpreted as a format, so % or \ in the data breaks output. Use printf '%s' "$var" instead.

Behavior

• Finds the format argument, skipping -v var, -vvar, or --. Reports it if it contains a parameter expansion or command substitution, quoted or not.
• Not reported: static formats, and variables in the data arguments after the format. Arithmetic expansions ($((...))) in the format aren't checked either.
• No autofix: rewriting the format needs to know what the data contains.
• Recommended config: "error".

Documentation

Adds docs/rules/no-variables-in-printf-format.md, following the format of the @eslint/json, @eslint/css, and @eslint/markdown rule docs: description, background, rule details with incorrect and correct examples, options, when not to use it, and the ShellCheck reference. The rule's meta.docs.url points at that file, and its README table entry links to it.

Testing

10 RuleTester cases and 5 documentation checks (322 total); build, lint, and format checks pass.

🤖 Generated with Claude Code

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

Summary by CodeRabbit

• New Features
  • Added a recommended rule that flags variable or command substitutions in printf format strings, helping prevent unexpected formatting or escape sequences.
  • Added documentation with examples, rule behavior, and guidance on disabling it.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 30 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 76c48559-292c-49e7-a661-07db992d7546

📥 Commits

Reviewing files that changed from the base of the PR and between afa74da and 034ef0f.

📒 Files selected for processing (6)

• README.md
• docs/rules/no-variables-in-printf-format.md
• src/index.spec.ts
• src/index.ts
• src/rules/no-variables-in-printf-format.spec.ts
• src/rules/no-variables-in-printf-format.ts

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: 5c2b3d81-4704-4543-b6ac-4c79c6c3bad7

📥 Commits

Reviewing files that changed from the base of the PR and between 8437b3a and a26459c.

📒 Files selected for processing (6)

• README.md
• docs/rules/no-variables-in-printf-format.md
• src/index.spec.ts
• src/index.ts
• src/rules/no-variables-in-printf-format.spec.ts
• src/rules/no-variables-in-printf-format.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

This change adds the no-variables-in-printf-format rule. It reports expansions in the printf format argument and is enabled as an error in the recommended configuration.

Changes

printf Format Expansion Rule

Layer / File(s)	Summary
Detect expansions in printf formats src/rules/no-variables-in-printf-format.ts, src/rules/no-variables-in-printf-format.spec.ts	The rule reports variable or command-substitution expansions in the format argument, including quoted expansions. It handles -v var, -vvar, and --; tests cover these cases and valid inputs.
Register and document the rule src/index.ts, src/index.spec.ts, README.md, docs/rules/no-variables-in-printf-format.md	The plugin registers the rule and enables it in the recommended configuration. The rule list and documentation describe SC2059 and the rule’s checked argument and excluded cases.

Estimated code review effort: 2 (Simple) | ~15 minutes

Architecture Summary

Architecture risk: 🔵 Low · up to a2645

The change affects 3 systems.

Changed systems: src, docs, README.md

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — src (service) was modified; 4 changed files map to changed impact.
• observed — docs (service) was modified; 1 changed file maps to changed impact.
• observed — README.md (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in README.md: Added the no-variables-in-printf-format entry to the Rules table, identifying SC2059 and marking the rule as recommended at error severity.
• observed — Modified behavior in docs/rules/no-variables-in-printf-format.md: Adds documentation describing the rule’s checked format-argument position and expansion types, excluded cases, examples, lack of options, and a case for disabling the rule.
• observed — Modified behavior in src/index.spec.ts: The expected rule ID list now includes no-variables-in-printf-format.
• observed — Modified behavior in src/index.ts: Imports the noVariablesInPrintfFormat rule implementation.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟡 Changes recommended

Option parsing misses dynamic formats when -- follows either form of the -v option.

Review effort: Balanced
Findings: 1

Open (1)

• Handle optional -- after printf -v during option parsing · New

What changed in this PR

Adds a ShellCheck SC2059-inspired rule preventing dynamic printf format strings.

Changes:

• Implements and registers the recommended rule.
• Adds rule and plugin tests.
• Documents usage, examples, and configuration.

File	Description
src/​rules/​no-variables-in-printf-format.ts	Implements format-string detection.
src/​rules/​no-variables-in-printf-format.spec.ts	Tests rule behavior.
src/​index.ts	Registers and enables the rule.
src/​index.spec.ts	Verifies rule exposure.
README.md	Adds the rule to the catalog.
docs/​rules/​no-variables-in-printf-format.md	Documents the rule.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nzakas]

@copilot address the review comments. Be sure to add tests.

[Copilot]

@copilot address the review comments. Be sure to add tests.

Fixed in a26459c: the rule now skips an optional -- after both -v name and -vname. Added regression tests for dynamic and static formats; all 296 tests, build, lint, and format checks pass.