Fix SC2329 false positive for functions in prompt variables and command substitutions

Correctly recognize function references in:
- Command substitutions $() and backticks
- Prompt variables (PS1, PS2, PS3, PS4, PROMPT_COMMAND)

Functions referenced in these contexts are considered invoked even if the function definition appears unreachable in the CFG.

Co-authored-by: dotysan <5060170+dotysan@users.noreply.github.com>

Author: Copilot

src/ShellCheck/Analytics.hs

@@ -5053,8 +5053,8 @@ prop_checkCommandIsUnreachable6 = verifyNot checkCommandIsUnreachable "return ||
 prop_checkCommandIsUnreachable7 = verifyNot checkCommandIsUnreachable "return 2>/dev/null ||:"
 prop_checkCommandIsUnreachable8 = verifyNot checkCommandIsUnreachable "return; echo 'reachable when not in function'"
 prop_checkCommandIsUnreachable9 = verify checkCommandIsUnreachable "f() { return; echo unreachable; }"
-prop_checkCommandIsUnreachable10 = verifyNot checkCommandIsUnreachable "f; f() { :; }; exit $?"
-prop_checkCommandIsUnreachable11 = verifyNot checkCommandIsUnreachable "PS4func; PS4func() { echo test; }; exit $?"
+prop_checkCommandIsUnreachable10 = verifyNot checkCommandIsUnreachable "PS4func() { :; }; PS4='$(PS4func)'; exit"
+prop_checkCommandIsUnreachable11 = verifyNot checkCommandIsUnreachable "f() { :; }; var=`f`; exit"
 checkCommandIsUnreachable params t =
     case t of
         T_Pipeline {} -> sequence_ $ do
@@ -5068,7 +5068,7 @@ checkCommandIsUnreachable params t =
             when (isUnreachableFunction t
                     && (not . any isUnreachableFunction . NE.drop 1 $ getPath (parentMap params) t)
                     && (not $ isSourced params t)
-                    && (not $ isFunctionInvokedInReachableCode name)) $
+                    && (not $ isFunctionReferencedInCommandSubstitution name)) $
                 info id 2329 "This function is never invoked. Check usage (or ignored if invoked indirectly)."
         _ -> return ()
   where
@@ -5082,17 +5082,43 @@ checkCommandIsUnreachable params t =
         state <- CF.getIncomingState cfga (getId t)
         return . not $ CF.stateIsReachable state
 
-    -- Check if a function is invoked anywhere in reachable code
-    isFunctionInvokedInReachableCode :: String -> Bool
-    isFunctionInvokedInReachableCode name =
-        any isFunctionCall $ analyse findCalls (rootNode params)
+    -- Check if a function is referenced in command substitution or prompt variables
+    isFunctionReferencedInCommandSubstitution :: String -> Bool
+    isFunctionReferencedInCommandSubstitution name =
+        not . null $ analyse findReferences (rootNode params)
       where
-        findCalls token = when (isFunctionCall token) $ modify (token:)
-        isFunctionCall token =
+        findReferences token =
+            case token of
+                -- Check in $() command substitutions  
+                T_DollarExpansion _ _ ->
+                    when (hasFunctionCall token) $ modify (token:)
+                -- Check in backtick command substitutions
+                T_Backticked _ _ ->
+                    when (hasFunctionCall token) $ modify (token:)
+                -- Check in assignments to prompt variables (PS1, PS2, PS3, PS4, PROMPT_COMMAND)
+                -- These variables are evaluated by bash even in single quotes
+                T_Assignment _ _ varname _ value ->
+                    when (varname `elem` promptVars && hasFunctionReference value) $ modify (token:)
+                _ -> return ()
+        promptVars = ["PS1", "PS2", "PS3", "PS4", "PROMPT_COMMAND"]
+        hasFunctionCall token =
+            not . null $ analyse findFunctionCalls token
+        hasFunctionReference token =
+            -- Check if function name appears in the value
+            -- For prompt variables, they can contain:
+            -- 1. Direct command names (PROMPT_COMMAND='funcname')
+            -- 2. Command substitutions with $(...) or `...`
+            case getLiteralString token of
+                Just str -> 
+                    name == str  -- Direct function name
+                    || ("$(" ++ name) `isInfixOf` str  -- $(funcname)
+                    || ("`" ++ name) `isInfixOf` str   -- `funcname`
+                Nothing -> hasFunctionCall token
+        findFunctionCalls token =
             case token of
                 T_SimpleCommand _ _ (cmd:_) ->
-                    getUnquotedLiteral cmd == Just name && not (isUnreachable token)
-                _ -> False
+                    when (getUnquotedLiteral cmd == Just name) $ modify (token:)
+                _ -> return ()
 
 
 prop_checkOverwrittenExitCode1 = verify checkOverwrittenExitCode "x; [ $? -eq 1 ] || [ $? -eq 2 ]"