shellcheck SC2086 warning: double quote to prevent globbing error in PR

TL;DR

Quote the variable: rm -rf "$BUILD_DIR" instead of rm -rf $BUILD_DIR. SC2086 fires because an unquoted expansion undergoes word splitting and pathname expansion, so a value containing spaces (or glob characters) becomes multiple arguments or matches files. Quoting makes the value exactly one word, which is what you want in nearly every case.

The error

In deploy.sh line 12:
rm -rf $BUILD_DIR
     ^-- SC2086 (info): Double quote to prevent globbing and word splitting.

Fix it

1. Reproduce. Run shellcheck deploy.sh (or the flagged script). Expected: one SC2086 line per unquoted expansion, with a caret pointing at it.

2. Quote the expansion. Change $BUILD_DIR to "$BUILD_DIR", $file to "$file", and so on. Expected: re-running shellcheck reports no SC2086 for those lines.

3. If the splitting is genuinely intentional (for example extra flags stored in a string), do not just leave it unquoted - use an array:

   flags=(--verbose --output "$out")
   mycmd "${flags[@]}"

   Expected: each flag stays a separate word, shellcheck stays quiet, and values with spaces still work.

4. As a last resort for a line where you truly want the old behavior, add a targeted directive on that line: # shellcheck disable=SC2086. Expected: shellcheck skips only that line; everything else is still checked.

Use this when

• shellcheck reports SC2086 in CI and blocks the PR
• A review script breaks on paths with spaces
• You see "Double quote to prevent globbing and word splitting" in a lint log

Not for this skill when

• The unquoted variable is a symptom of a deeper logic bug - fix the logic too, not just the quoting
• The script intentionally relies on glob expansion and an array does not fit - use the disable directive and move on
• The failure is a shellcheck parse error on the script itself (syntax problem, not a quoting warning)

Variant phrasings

• shellcheck double quote to prevent globbing
• SC2086 how to fix
• shellcheck warning unquoted variable
• shellcheck info word splitting

Why it happens

The shell expands $var in two extra passes before running the command: word splitting (on spaces, tabs, newlines) and pathname expansion (globbing). Quoting with double quotes disables both passes while still expanding the variable. Almost every SC2086 is a latent bug waiting for a filename with a space.

Edge cases

• "$@" preserves each argument separately; $* joins them - use "$@" when forwarding arguments
• Quoting inside [[ ... ]] tests is harmless but unnecessary - the test construct does not split
• Arrays are the correct fix for multi-word flags; a disable comment is the correct fix for a deliberate glob like for f in *.log
• The same rule applies inside Dockerfile RUN lines that shellcheck (via hadolint) inspects
• set -f disables globbing globally but hides bugs instead of fixing them - prefer quoting

Provenance

Resolved from the public thread: https://vectle.com/posts/pstwUZ38v7dvSbFGEA8pSOhA