diff --git a/.github/workflows/ShellCheck.yml b/.github/workflows/ShellCheck.yml
deleted file mode 100644
index cd2486a..0000000
--- a/.github/workflows/ShellCheck.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: shellcheck
-
-on:
-  push:
-    branches:
-      - '*'
-    paths-ignore:
-      - '**/README.md'
-  pull_request:
-    branches:
-      - '*'
-  workflow_dispatch:
-
-jobs:
-  shellcheck:
-    name: Shellcheck
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        shell_type: [bash, ksh]
-    steps:
-      - name: "📥 Checkout Code"
-        uses: actions/checkout@v2
-      - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
-        with:
-          ignore: archlinux
-          severity: warning
-        env:
-          SHELLCHECK_OPTS: -s ${{ matrix.shell_type }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 89b5898..aae7dd5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -18,7 +18,18 @@ jobs:
     name: base
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - name: "Checkout Code"
+        uses: actions/checkout@v2.3.4
+        with:
+          submodules: 'recursive'
+          fetch-depth: 0
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@1.1.0
+        with:
+          ignore: archlinux
+          severity: warning
+        env:
+          SHELLCHECK_OPTS: -s ${{ matrix.shell_type }}
       - name: build
         run: make base
       - name: test
diff --git a/imagefiles/build-and-install-cmake.sh b/imagefiles/build-and-install-cmake.sh
index adb4e7a..121c24e 100755
--- a/imagefiles/build-and-install-cmake.sh
+++ b/imagefiles/build-and-install-cmake.sh
@@ -29,31 +29,31 @@ fi
 
 cd /usr/src
 
-git clone https://gitlab.kitware.com/cmake/cmake.git CMake -b v$CMAKE_VERSION --depth 1
+git clone https://gitlab.kitware.com/cmake/cmake.git CMake -b "v$CMAKE_VERSION" --depth 1
 
 mkdir /usr/src/CMake-build
 cd /usr/src/CMake-build
 
-${WRAPPER} /usr/src/CMake/bootstrap \
-  --parallel=$(nproc) \
+"${WRAPPER}" /usr/src/CMake/bootstrap \
+  --parallel="$(nproc)" \
   -- -DCMAKE_USE_OPENSSL=OFF
-${WRAPPER} make -j$(nproc)
+"${WRAPPER}" make -j"$(nproc)"
 
 
 mkdir /usr/src/CMake-ssl-build
 cd /usr/src/CMake-ssl-build
 
-${WRAPPER} /usr/src/CMake-build/bin/cmake \
+"${WRAPPER}" /usr/src/CMake-build/bin/cmake \
   -DCMAKE_BUILD_TYPE:STRING=Release \
   -DBUILD_TESTING:BOOL=OFF \
-  -DCMAKE_INSTALL_PREFIX:PATH=/usr/src/cmake-$CMAKE_VERSION \
+  -DCMAKE_INSTALL_PREFIX:PATH="/usr/src/cmake-$CMAKE_VERSION" \
   -DCMAKE_USE_OPENSSL:BOOL=ON \
   -DOPENSSL_ROOT_DIR:PATH=/usr/local/ssl \
   ../CMake
-${WRAPPER} make -j$(nproc) install
+"${WRAPPER}" make -j"$(nproc)" install
 
 # Cleanup install tree
-cd /usr/src/cmake-$CMAKE_VERSION
+cd "/usr/src/cmake-$CMAKE_VERSION"
 rm -rf doc man
 
 # Install files
diff --git a/imagefiles/build-and-install-curl.sh b/imagefiles/build-and-install-curl.sh
index bb347ad..34008fd 100755
--- a/imagefiles/build-and-install-curl.sh
+++ b/imagefiles/build-and-install-curl.sh
@@ -25,13 +25,13 @@ function do_curl_build {
 
 function build_curl {
     local curl_fname=$1
-    check_var ${curl_fname}
+    check_var "${curl_fname}"
     local curl_sha256=$2
-    check_var ${curl_sha256}
-    check_var ${CURL_DOWNLOAD_URL}
-    curl -fsSLO ${CURL_DOWNLOAD_URL}/${curl_fname}.tar.gz
-    check_sha256sum ${curl_fname}.tar.gz ${curl_sha256}
-    tar -zxf ${curl_fname}.tar.gz
+    check_var "${curl_sha256}"
+    check_var "${CURL_DOWNLOAD_URL}"
+    curl -fsSLO "${CURL_DOWNLOAD_URL}/${curl_fname}.tar.gz"
+    check_sha256sum "${curl_fname}.tar.gz ${curl_sha256}"
+    tar -zxf "${curl_fname}.tar.gz"
     (cd curl-*/ && do_curl_build)
     rm -rf curl-*
 }
diff --git a/imagefiles/build-and-install-git.sh b/imagefiles/build-and-install-git.sh
index 9d1f249..111cdf3 100755
--- a/imagefiles/build-and-install-git.sh
+++ b/imagefiles/build-and-install-git.sh
@@ -27,10 +27,10 @@ url="https://mirrors.edge.kernel.org/pub/software/scm/git/git-${GIT_VERSION}.tar
 echo "Downloading $url"
 curl -# -LO $url
 
-tar xvzf git-${GIT_VERSION}.tar.gz  --no-same-owner
-rm -f git-${GIT_VERSION}.tar.gz
+tar xvzf "git-${GIT_VERSION}.tar.gz" --no-same-owner
+rm -f "git-${GIT_VERSION}.tar.gz"
 
-pushd git-${GIT_VERSION}
+pushd "git-${GIT_VERSION}"
 ./configure --prefix=/usr/local --with-curl
 make -j$(nproc)
 make install
@@ -38,7 +38,7 @@ popd
 
 ldconfig
 
-rm -rf git-${GIT_VERSION}
+rm -rf "git-${GIT_VERSION}"
 
 # turn the detached message off
 git config --global advice.detachedHead false
diff --git a/imagefiles/build-and-install-python.sh b/imagefiles/build-and-install-python.sh
index 887ac5a..ac370ff 100755
--- a/imagefiles/build-and-install-python.sh
+++ b/imagefiles/build-and-install-python.sh
@@ -25,10 +25,10 @@ while [ $# -gt 0 ]; do
 done
 
 # Download
-wget https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz
-tar xvf Python-${PYTHON_VERSION}.tgz
+wget "https://www.python.org/ftp/python/${PYTHON_VERSION}/Python-${PYTHON_VERSION}.tgz"
+tar xvf "Python-${PYTHON_VERSION}.tgz"
 # Configure, build and install
-cd Python-${PYTHON_VERSION}
+cd "Python-${PYTHON_VERSION}"
 # Disable --enable-shared --enable-optimizations --prefix=/usr/local/python-${PYTHON_VERSION}
 ./configure --with-ensurepip=install
 make -j$(nproc) 
@@ -39,4 +39,4 @@ ln -s /usr/local/bin/pip3 /usr/local/bin/pip
 
 # Clean
 cd ..
-rm -rf Python-${PYTHON_VERSION}
+rm -rf "Python-${PYTHON_VERSION}"
diff --git a/imagefiles/ccmake.sh b/imagefiles/ccmake.sh
index 4677d0b..557accb 100755
--- a/imagefiles/ccmake.sh
+++ b/imagefiles/ccmake.sh
@@ -4,4 +4,4 @@
 # dockcross environment -- the CMAKE_TOOLCHAIN_FILE environmental variable is
 # always set in this context
 
-exec /usr/bin/ccmake -DCMAKE_TOOLCHAIN_FILE:FILEPATH=${CMAKE_TOOLCHAIN_FILE} "$@"
+exec /usr/bin/ccmake -DCMAKE_TOOLCHAIN_FILE:FILEPATH="${CMAKE_TOOLCHAIN_FILE}" "$@"
diff --git a/imagefiles/cmake.sh b/imagefiles/cmake.sh
index fb21172..e5f6f56 100755
--- a/imagefiles/cmake.sh
+++ b/imagefiles/cmake.sh
@@ -19,4 +19,4 @@ case $1 in
 
 esac
 
-exec /usr/bin/cmake -DCMAKE_TOOLCHAIN_FILE:FILEPATH=${CMAKE_TOOLCHAIN_FILE} "$@"
+exec /usr/bin/cmake -DCMAKE_TOOLCHAIN_FILE:FILEPATH="${CMAKE_TOOLCHAIN_FILE}" "$@"
diff --git a/imagefiles/dockcross b/imagefiles/dockcross
index a6dc199..7034feb 100755
--- a/imagefiles/dockcross
+++ b/imagefiles/dockcross
@@ -37,24 +37,24 @@ fi
 # Command handlers
 #
 command:update-image() {
-    $OCI_EXE pull $FINAL_IMAGE
+    $OCI_EXE pull "$FINAL_IMAGE"
 }
 
 help:update-image() {
-    echo Pull the latest $FINAL_IMAGE .
+    echo Pull the latest "$FINAL_IMAGE" .
 }
 
 command:update-script() {
-    if cmp -s <( $OCI_EXE run --rm $FINAL_IMAGE ) $0; then
+    if cmp -s <( "$OCI_EXE" run --rm "$FINAL_IMAGE" ) "$0"; then
         echo $0 is up to date
     else
         echo -n Updating $0 '... '
-        $OCI_EXE run --rm $FINAL_IMAGE > $0 && echo ok
+        "$OCI_EXE" run --rm "$FINAL_IMAGE" > "$0" && echo ok
     fi
 }
 
 help:update-image() {
-    echo Update $0 from $FINAL_IMAGE .
+    echo Update "$0" from "$FINAL_IMAGE" .
 }
 
 command:update() {
@@ -63,12 +63,12 @@ command:update() {
 }
 
 help:update() {
-    echo Pull the latest $FINAL_IMAGE, and then update $0 from that.
+    echo "Pull the latest $FINAL_IMAGE, and then update $0 from that."
 }
 
 command:help() {
     if [[ $# != 0 ]]; then
-        if ! has command $1; then
+        if ! has command "$1"; then
             err \"$1\" is not an dockcross command
             command:help
         elif ! has help $1; then
@@ -250,7 +250,7 @@ if [[ $rm_exit_code != 0 ]]; then
   fi
 fi
 
-exit $run_exit_code
+exit "$run_exit_code"
 
 ################################################################################
 #
diff --git a/imagefiles/install-cmake-binary.sh b/imagefiles/install-cmake-binary.sh
index 9c34087..52395c4 100755
--- a/imagefiles/install-cmake-binary.sh
+++ b/imagefiles/install-cmake-binary.sh
@@ -35,15 +35,15 @@ fi
 
 cd /usr/src
 
-CMAKE_ROOT=cmake-${CMAKE_VERSION}-Centos5-${ARCH}
-url=https://github.com/dockbuild/CMake/releases/download/v${CMAKE_VERSION}/${CMAKE_ROOT}.tar.gz
+CMAKE_ROOT="cmake-${CMAKE_VERSION}-Centos5-${ARCH}"
+url="https://github.com/dockbuild/CMake/releases/download/v${CMAKE_VERSION}/${CMAKE_ROOT}.tar.gz"
 echo "Downloading $url"
-curl -# -LO $url
+curl -# -LO "$url"
 
-tar -xzvf ${CMAKE_ROOT}.tar.gz
-rm -f ${CMAKE_ROOT}.tar.gz
+tar -xzvf "${CMAKE_ROOT}.tar.gz"
+rm -f "${CMAKE_ROOT}.tar.gz"
 
-cd ${CMAKE_ROOT}
+cd "${CMAKE_ROOT}"
 
 rm -rf doc man
 rm -rf bin/cmake-gui
diff --git a/imagefiles/install-python-packages.sh b/imagefiles/install-python-packages.sh
index 2c7b3e0..838823d 100755
--- a/imagefiles/install-python-packages.sh
+++ b/imagefiles/install-python-packages.sh
@@ -24,10 +24,10 @@ cd /tmp
 # 3.6 or later
 curl -# -LO https://bootstrap.pypa.io/pip/get-pip.py
 #curl -# -LO https://bootstrap.pypa.io/pip/2.7/get-pip.py
-${PYTHON} get-pip.py --ignore-installed
+"${PYTHON}" get-pip.py --ignore-installed
 rm get-pip.py
 
-${PYTHON} -m pip install --upgrade --ignore-installed setuptools
-${PYTHON} -m pip install --ignore-installed conan
+"${PYTHON}" -m pip install --upgrade --ignore-installed setuptools
+"${PYTHON}" -m pip install --ignore-installed conan
 # Purge cache to save space: https://stackoverflow.com/questions/37513597/is-it-safe-to-delete-cache-pip-directory
-${PYTHON} -m pip cache purge
+"${PYTHON}" -m pip cache purge
diff --git a/imagefiles/utils.sh b/imagefiles/utils.sh
index 52fa08e..7f16ecb 100644
--- a/imagefiles/utils.sh
+++ b/imagefiles/utils.sh
@@ -13,12 +13,12 @@ function check_var {
 # Copied from https://github.com/pypa/manylinux/blob/master/docker/build_scripts/build_utils.sh
 function check_sha256sum {
     local fname=$1
-    check_var ${fname}
+    check_var "${fname}"
     local sha256=$2
-    check_var ${sha256}
+    check_var "${sha256}"
 
-    echo "${sha256}  ${fname}" > ${fname}.sha256
-    sha256sum -c ${fname}.sha256
-    rm -f ${fname}.sha256
+    echo "${sha256}  ${fname}" > "${fname}.sha256"
+    sha256sum -c "${fname}.sha256"
+    rm -f "${fname}.sha256"
 }