False positives: SC2154/SC2140 for sourced variables and heredoc expansion

[noahgift]

Summary

bashrs reports false positive warnings for two common patterns that are intentional and correct.

Reproduction

Script 1: ground_truth_config.sh (sourced config)

#!/bin/bash
set -euo pipefail
MODEL_SIZE="${1:-tiny}"

case "$MODEL_SIZE" in
  tiny)
    WAPR_MODEL='models/whisper-tiny.apr'
    ;;
esac

export WAPR_MODEL

Script 2: ground_truth_test.sh (sources config, uses heredoc)

#!/bin/bash
set -euo pipefail
source "$(dirname "$0")/ground_truth_config.sh" "$MODEL_SIZE"

# Uses sourced variable - triggers SC2154
echo "Model: $WAPR_MODEL"

# Heredoc with intentional variable expansion - triggers SC2140
uv run --with torch - <<PYTHON
model = whisper.load_model("${MODEL_SIZE}")
PYTHON

Expected Behavior

1. SC2154: No warning for variables set by source command
2. SC2140: No warning for heredoc variable expansion when quotes are intentional

Actual Behavior

SC2154: WAPR_MODEL is referenced but not assigned
SC2140: Word is of the form "A"B"C" (B indicated). Did you mean "ABC" or "A\"B\"C"?

Suggested Solutions

1. SC2154: Track variables through source/. commands (complex) OR provide directive to suppress
2. SC2140: Recognize heredoc context where shell expansion is intentional

Workaround

Added comments documenting expected warnings:

# bashrs lint: SC2154 warnings expected (vars from sourced config)
# bashrs lint: SC2140 warnings expected (heredoc var expansion is intentional)

Environment

• bashrs version: latest
• OS: Linux

[noahgift]

Technical Analysis

This issue requires cross-file analysis and context tracking, which the current single-file linter doesn't support.

SC2154 (sourced variables):

• Requires tracking source and . commands
• Need to parse sourced files and track their exports
• Cross-file dependency analysis

SC2140 (heredoc):

• Requires understanding heredoc context for variable expansion
• Parser needs heredoc-aware variable tracking

Required Work:

1. Multi-file analysis infrastructure
2. Source/dot command tracking
3. Heredoc context awareness
4. Variable scope across files

Complexity: Very High (architectural enhancement)

This is a significant feature enhancement requiring multi-file analysis capabilities.

[noahgift]

Verified fixed. Tests pass:

• SC2154: Skips uppercase variables when script contains source/. commands (issue_95 tests)
• Variables from sourced files are assumed defined
• SC2140: Heredoc context handling improved separately

All issue_95 tests pass. Fixed in v6.55.0.