From 3f07f2e4ed19c9253c32afaeef2b6e332635b38e Mon Sep 17 00:00:00 2001
From: Tudor Domnescu <tdomnesc@redhat.com>
Date: Fri, 5 Jun 2026 10:29:48 +0200
Subject: [PATCH] METAL-1845: shellcheck fixes part 4

---
 assisted_deployment.sh          | 14 ++++-----
 bootkube_log.sh                 |  2 +-
 bootstrap_bootkube_log.sh       |  2 +-
 bootstrap_ironic_log.sh         |  2 +-
 bootstrap_openshift_log.sh      |  2 +-
 build-base-image.sh             |  2 +-
 build-qemu-aarch64.sh           |  6 +++-
 cache_cleanup.sh                |  2 +-
 ci_logs.sh                      | 12 +++----
 demo/launch_demo_bmo.sh         |  8 +++--
 external_loadbalancer.sh        | 30 +++++++++---------
 hive_install.sh                 |  8 ++---
 host_cleanup.sh                 | 22 ++++++-------
 ironic_cleanup.sh               |  4 +--
 metal3-dev/local-bmo.sh         | 55 +++++++++++++++++----------------
 metal3-dev/local-capbm.sh       | 37 +++++++++++-----------
 metal3-dev/local-cbo.sh         | 10 +++---
 metal3-dev/mao-bmo.sh           |  6 ++--
 metal3-dev/mao-capbm.sh         |  6 ++--
 metallb/configure_metallb.sh    | 11 ++++---
 metallb/deploy_operator.sh      | 21 +++++++------
 metallb/metallb_common.sh       |  8 +++--
 metallb/run_e2e.sh              | 16 +++++-----
 must_gather.sh                  |  6 ++--
 oc_mirror_cleanup.sh            |  8 ++---
 ocp_cleanup.sh                  | 32 +++++++++----------
 registry_cleanup.sh             |  4 +--
 remote_nodes.sh                 | 31 +++++++++----------
 run-custom-mao.sh               | 26 ++++++++--------
 run_capi_e2e.sh                 |  2 +-
 scripts/periodics_pass_rates.sh | 18 ++++++-----
 show_bootstrap_log.sh           |  2 +-
 stop-cbo.sh                     |  4 +--
 stop-mao.sh                     |  4 +--
 workingdir_cleanup.sh           |  2 +-
 35 files changed, 220 insertions(+), 205 deletions(-)

diff --git a/assisted_deployment.sh b/assisted_deployment.sh
index 1af096ca4..6ed9d8326 100755
--- a/assisted_deployment.sh
+++ b/assisted_deployment.sh
@@ -283,12 +283,12 @@ function patch_extra_host_manifests() {
   if [ -f "${OCP_DIR}/extra_host_manifests.yaml" ]; then
     cp "${OCP_DIR}/extra_host_manifests.yaml" "${ASSETS_DIR}/06-extra-host-manifests.yaml"
 
-    yq -i -Y '. | select(."kind" == "BareMetalHost") | .metadata += {"namespace":'\"${ASSISTED_NAMESPACE}\"'}' "${ASSETS_DIR}/06-extra-host-manifests.yaml"
+    yq -i -Y '. | select(."kind" == "BareMetalHost") | .metadata += {"namespace":"'"${ASSISTED_NAMESPACE}"'"}' "${ASSETS_DIR}/06-extra-host-manifests.yaml"
     yq -i -Y '. | select(."kind" == "BareMetalHost") | .metadata.labels += {"infraenvs.agent-install.openshift.io":"myinfraenv"}' "${ASSETS_DIR}/06-extra-host-manifests.yaml"
     yq -i -Y '. | select(."kind" == "BareMetalHost") | .metadata.annotations += {"inspect.metal3.io":"disabled"}' "${ASSETS_DIR}/06-extra-host-manifests.yaml"
     yq -i -Y '. | select(."kind" == "BareMetalHost") | .spec += {"automatedCleaningMode":"disabled"}' "${ASSETS_DIR}/06-extra-host-manifests.yaml"
     echo "---" >> "${ASSETS_DIR}/06-extra-host-manifests.yaml"
-    yq -Y '. | select(."kind" == "Secret") | .metadata += {"namespace":'\"${ASSISTED_NAMESPACE}\"'}' "${OCP_DIR}/extra_host_manifests.yaml" >> "${ASSETS_DIR}/06-extra-host-manifests.yaml"
+    yq -Y '. | select(."kind" == "Secret") | .metadata += {"namespace":'\""${ASSISTED_NAMESPACE}"\"'}' "${OCP_DIR}/extra_host_manifests.yaml" >> "${ASSETS_DIR}/06-extra-host-manifests.yaml"
   fi
 }
 
@@ -320,12 +320,12 @@ function install_prerequisites_assisted_service() {
 # Deleting resources with `oc` is not asynchronous so we are adding a timeout in case the cluster
 # or the node is under load and can't handle requests fast enough.
 function delete_assisted() {
-  timeout 15 oc delete -n $ASSISTED_NAMESPACE agentserviceconfig --all
-  timeout 15 oc delete -n $ASSISTED_NAMESPACE csv --all
-  timeout 15 oc delete subscription -n $ASSISTED_NAMESPACE --all
-  timeout 15 oc delete -n $ASSISTED_NAMESPACE operatorgroup --all
+  timeout 15 oc delete -n "$ASSISTED_NAMESPACE" agentserviceconfig --all
+  timeout 15 oc delete -n "$ASSISTED_NAMESPACE" csv --all
+  timeout 15 oc delete subscription -n "$ASSISTED_NAMESPACE" --all
+  timeout 15 oc delete -n "$ASSISTED_NAMESPACE" operatorgroup --all
   timeout 15 oc delete -n openshift-marketplace catalogsource assisted-service-catalog
-  timeout 15 oc delete ns $ASSISTED_NAMESPACE
+  timeout 15 oc delete ns "$ASSISTED_NAMESPACE"
 }
 
 function delete_hive() {
diff --git a/bootkube_log.sh b/bootkube_log.sh
index 7144c6f30..56a68c67a 100755
--- a/bootkube_log.sh
+++ b/bootkube_log.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-$(dirname $0)/show_bootstrap_log.sh bootkube.service
+"$(dirname "$0")/show_bootstrap_log.sh" bootkube.service
diff --git a/bootstrap_bootkube_log.sh b/bootstrap_bootkube_log.sh
index 7144c6f30..56a68c67a 100755
--- a/bootstrap_bootkube_log.sh
+++ b/bootstrap_bootkube_log.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-$(dirname $0)/show_bootstrap_log.sh bootkube.service
+"$(dirname "$0")/show_bootstrap_log.sh" bootkube.service
diff --git a/bootstrap_ironic_log.sh b/bootstrap_ironic_log.sh
index d8ec30ff2..1272b9223 100755
--- a/bootstrap_ironic_log.sh
+++ b/bootstrap_ironic_log.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-$(dirname $0)/show_bootstrap_log.sh ironic.service
+"$(dirname "$0")/show_bootstrap_log.sh" ironic.service
diff --git a/bootstrap_openshift_log.sh b/bootstrap_openshift_log.sh
index e2b248f4d..1b4e722d7 100755
--- a/bootstrap_openshift_log.sh
+++ b/bootstrap_openshift_log.sh
@@ -1,3 +1,3 @@
 #!/bin/bash
 
-$(dirname $0)/show_bootstrap_log.sh openshift.service
+"$(dirname "$0")/show_bootstrap_log.sh" openshift.service
diff --git a/build-base-image.sh b/build-base-image.sh
index c3d4cdb39..e166f97fb 100755
--- a/build-base-image.sh
+++ b/build-base-image.sh
@@ -19,4 +19,4 @@ if [[ -n ${BASE_IMAGE_FROM:-} ]]; then
     BUILD_COMMAND_ARGS+=" --build-arg REMOVE_OLD_REPOS=no"
 fi
 
-sudo podman build --network host --tag ${BASE_IMAGE_DIR} ${BUILD_COMMAND_ARGS} -f "${BASE_IMAGE_DIR}/Dockerfile"
+sudo podman build --network host --tag "${BASE_IMAGE_DIR}" "${BUILD_COMMAND_ARGS}" -f "${BASE_IMAGE_DIR}/Dockerfile"
diff --git a/build-qemu-aarch64.sh b/build-qemu-aarch64.sh
index d380ebae5..ebd6ead92 100755
--- a/build-qemu-aarch64.sh
+++ b/build-qemu-aarch64.sh
@@ -4,6 +4,8 @@
 
 set -euo pipefail
 
+# FIXME: SCRIPT_DIR appears unused
+# shellcheck disable=SC2034
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 BUILD_DIR="${BUILD_DIR:-/tmp/qemu-build}"
 INSTALL_PREFIX="${INSTALL_PREFIX:-/usr/local}"
@@ -28,7 +30,7 @@ echo "Building QEMU version: $QEMU_VERSION"
 
 # Check if already installed
 if [ -x "$INSTALL_PREFIX/bin/qemu-system-aarch64" ]; then
-    INSTALLED_VERSION=$($INSTALL_PREFIX/bin/qemu-system-aarch64 --version | head -1 | grep -oP '\d+\.\d+\.\d+' || echo "unknown")
+    INSTALLED_VERSION=$("$INSTALL_PREFIX/bin/qemu-system-aarch64" --version | head -1 | grep -oP '\d+\.\d+\.\d+' || echo "unknown")
     if [ "$INSTALLED_VERSION" = "$QEMU_VERSION" ]; then
         echo "qemu-system-aarch64 version $QEMU_VERSION is already installed at $INSTALL_PREFIX/bin/qemu-system-aarch64"
         echo "Skipping build."
@@ -89,6 +91,8 @@ echo "    - $AAVMF_CODE"
 echo "    - $AAVMF_VARS"
 
 # Install meson if not available or too old
+# FIXME: MESON_MIN_VERSION appears unused
+# shellcheck disable=SC2034
 MESON_MIN_VERSION="0.63.0"
 if command -v meson &> /dev/null; then
     MESON_VERSION=$(meson --version)
diff --git a/cache_cleanup.sh b/cache_cleanup.sh
index 9b5b1bf1e..1fdc67a13 100755
--- a/cache_cleanup.sh
+++ b/cache_cleanup.sh
@@ -7,4 +7,4 @@ source validation.sh
 
 early_cleanup_validation
 
-rm -rf $HOME/.cache/openshift-installer
+rm -rf "$HOME/.cache/openshift-installer"
diff --git a/ci_logs.sh b/ci_logs.sh
index 427e88c31..c0901f239 100755
--- a/ci_logs.sh
+++ b/ci_logs.sh
@@ -2,7 +2,7 @@
 
 set -e
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-SCRIPTNAME="$(basename ${BASH_SOURCE[0]})"
+SCRIPTNAME="$(basename "${BASH_SOURCE[0]}")"
 CI_URL="http://10.8.144.11:8080/job/dev-tools"
 
 if (( $# != 1 )); then
@@ -10,16 +10,16 @@ if (( $# != 1 )); then
   exit 1
 fi
 
-if ! curl --fail ${CI_URL}/$1; then
+if ! curl --fail "${CI_URL}/$1"; then
   echo "Error job $1 not found at ${CI_URL}"
   exit 1
 fi
 
 LOGDIR="${SCRIPTDIR}/logs/ci/$1"
-if [ ! -d  ${LOGDIR} ]; then
-  mkdir -p ${LOGDIR}
-  pushd ${LOGDIR}
-  wget ${CI_URL}/${1}/artifact/logs.tgz
+if [ ! -d  "${LOGDIR}" ]; then
+  mkdir -p "${LOGDIR}"
+  pushd "${LOGDIR}"
+  wget "${CI_URL}/${1}/artifact/logs.tgz"
   tar -xvzf logs.tgz
   popd
   echo "Done, see ${LOGDIR}"
diff --git a/demo/launch_demo_bmo.sh b/demo/launch_demo_bmo.sh
index 1bff70338..4ca0e811d 100755
--- a/demo/launch_demo_bmo.sh
+++ b/demo/launch_demo_bmo.sh
@@ -9,7 +9,9 @@
 set -xe
 
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-source ${SCRIPTDIR}/../common.sh
+# shellcheck source=/dev/null
+source "${SCRIPTDIR}"/../common.sh
+# shellcheck disable=SC2046
 eval $(go env)
 
 # Set the project
@@ -22,12 +24,12 @@ then
     oc delete deployment metalkube-baremetal-operator
 fi
 
-cd $GOPATH/src/github.com/metalkube/baremetal-operator
+cd "$GOPATH/src/github.com/metalkube/baremetal-operator"
 
 oc apply -f deploy/crds/demo-hosts.yaml
 
 export OPERATOR_NAME=baremetal-operator
 
-${GOPATH}/bin/operator-sdk up local \
+"${GOPATH}/bin/operator-sdk" up local \
     --namespace=openshift-machine-api \
 	--operator-flags="-dev -demo-mode"
diff --git a/external_loadbalancer.sh b/external_loadbalancer.sh
index 384d5b130..80646ba88 100755
--- a/external_loadbalancer.sh
+++ b/external_loadbalancer.sh
@@ -12,25 +12,25 @@ sudo firewall-cmd --zone=libvirt --add-port=8080/tcp
 sudo firewall-cmd --zone=libvirt --add-port=22623/tcp
 
 haproxy_config="${WORKING_DIR}/haproxy.cfg"
-echo $haproxy_config
+echo "$haproxy_config"
 
 
 if [ "$IP_STACK" = "v6" ]
 then
-     master0=$(nth_ip $EXTERNAL_SUBNET_V6 20)
-     master1=$(nth_ip $EXTERNAL_SUBNET_V6 21)
-     master2=$(nth_ip $EXTERNAL_SUBNET_V6 22)
-     worker0=$(nth_ip $EXTERNAL_SUBNET_V6 23)
-     worker1=$(nth_ip $EXTERNAL_SUBNET_V6 24)
-     bootstrap=$(nth_ip $EXTERNAL_SUBNET_V6 9)
+     master0=$(nth_ip "$EXTERNAL_SUBNET_V6" 20)
+     master1=$(nth_ip "$EXTERNAL_SUBNET_V6" 21)
+     master2=$(nth_ip "$EXTERNAL_SUBNET_V6" 22)
+     worker0=$(nth_ip "$EXTERNAL_SUBNET_V6" 23)
+     worker1=$(nth_ip "$EXTERNAL_SUBNET_V6" 24)
+     bootstrap=$(nth_ip "$EXTERNAL_SUBNET_V6" 9)
 else
 
-     master0=$(nth_ip $EXTERNAL_SUBNET_V4 20)
-     master1=$(nth_ip $EXTERNAL_SUBNET_V4 21)
-     master2=$(nth_ip $EXTERNAL_SUBNET_V4 22)
-     worker0=$(nth_ip $EXTERNAL_SUBNET_V4 23)
-     worker1=$(nth_ip $EXTERNAL_SUBNET_V4 24)
-     bootstrap=$(nth_ip $EXTERNAL_SUBNET_V4 9)
+     master0=$(nth_ip "$EXTERNAL_SUBNET_V4" 20)
+     master1=$(nth_ip "$EXTERNAL_SUBNET_V4" 21)
+     master2=$(nth_ip "$EXTERNAL_SUBNET_V4" 22)
+     worker0=$(nth_ip "$EXTERNAL_SUBNET_V4" 23)
+     worker1=$(nth_ip "$EXTERNAL_SUBNET_V4" 24)
+     bootstrap=$(nth_ip "$EXTERNAL_SUBNET_V4" 9)
 fi
 
 cat << EOF > "$haproxy_config"
@@ -108,14 +108,14 @@ sudo podman run -d  --net host -v "${WORKING_DIR}":/etc/haproxy/:z --entrypoint
 
 sleep 5
 
-if [ "$(curl  --fail  https://$(wrap_if_ipv6 ${PROVISIONING_HOST_EXTERNAL_IP}):6443/version --insecure)" ]; then
+if [ "$(curl  --fail  "https://$(wrap_if_ipv6 "${PROVISIONING_HOST_EXTERNAL_IP}"):6443/version" --insecure)" ]; then
     echo " API is available through LB"
 else
     echo " Can't access API through  LB"
 fi
 
 
-if [ "$(curl  --fail  --header "Host: console-openshift-console.apps.ostest.test.metalkube.org" http://$(wrap_if_ipv6 ${PROVISIONING_HOST_EXTERNAL_IP}):8080  -I -L --insecure)" ]; then
+if [ "$(curl  --fail  --header "Host: console-openshift-console.apps.ostest.test.metalkube.org" "http://$(wrap_if_ipv6 "${PROVISIONING_HOST_EXTERNAL_IP}"):8080"  -I -L --insecure)" ]; then
     echo " Ingress is available through LB"
 else
     echo " Can't access Ingress through LB"
diff --git a/hive_install.sh b/hive_install.sh
index 9ad8e9e3a..b80e626d6 100755
--- a/hive_install.sh
+++ b/hive_install.sh
@@ -14,9 +14,9 @@ if [[ ! -z "${MIRROR_IMAGES}" && "${MIRROR_IMAGES,,}" != "false" ]]; then
     # Mirror hive itself
     DEPLOY_IMAGE="${LOCAL_REGISTRY_DNS_NAME}:${LOCAL_REGISTRY_PORT}/localimages/hive:latest"
     oc image mirror \
-       -a ${REGISTRY_CREDS} \
-       ${HIVE_DEPLOY_IMAGE} \
-       ${DEPLOY_IMAGE}
+       -a "${REGISTRY_CREDS}" \
+       "${HIVE_DEPLOY_IMAGE}" \
+       "${DEPLOY_IMAGE}"
 fi
 
 # Check out hive and install it. This has to be done in the GOPATH
@@ -25,7 +25,7 @@ fi
 if [[ ! -d $GOPATH/src/github.com/openshift/hive ]]; then
     sync_repo_and_patch go/src/github.com/openshift/hive https://github.com/openshift/hive.git
 fi
-pushd $HOME/go/src/github.com/openshift/hive
+pushd "$HOME/go/src/github.com/openshift/hive"
 
 make deploy
 
diff --git a/host_cleanup.sh b/host_cleanup.sh
index 48bca385c..7963c5318 100755
--- a/host_cleanup.sh
+++ b/host_cleanup.sh
@@ -29,10 +29,10 @@ ansible-playbook \
     -e "virthost=$HOSTNAME" \
     -e "manage_baremetal=$MANAGE_BR_BRIDGE" \
     -e "nodes_file=$NODES_FILE" \
-    -i ${VM_SETUP_PATH}/inventory.ini \
-    -b -vvv ${VM_SETUP_PATH}/teardown-playbook.yml
+    -i "${VM_SETUP_PATH}/inventory.ini" \
+    -b -vvv "${VM_SETUP_PATH}/teardown-playbook.yml"
 
-sudo rm -rf /etc/NetworkManager/dnsmasq.d/openshift-${CLUSTER_NAME}.conf /etc/yum.repos.d/delorean*
+sudo rm -rf "/etc/NetworkManager/dnsmasq.d/openshift-${CLUSTER_NAME}.conf" /etc/yum.repos.d/delorean*
 sudo rm -rf /etc/NetworkManager/conf.d/dnsmasq.conf
 sudo rm -rf /etc/NetworkManager/dnsmasq.d/upstream.conf
 if systemctl is-active --quiet NetworkManager; then
@@ -44,8 +44,8 @@ fi
 # handle upgrade from legacy network scripts
 for interface in ${PROVISIONING_NETWORK_NAME} ${BAREMETAL_NETWORK_NAME} ${PRO_IF} ${INT_IF}; do
   interface_config=/etc/sysconfig/network-scripts/ifcfg-${interface}
-  if [ -e $interface_config ]; then
-    sudo rm -f $interface_config
+  if [ -e "$interface_config" ]; then
+    sudo rm -f "$interface_config"
     IF_FOUND=true
   fi
 done
@@ -57,22 +57,22 @@ fi
 # There was a bug in this file, it may need to be recreated.
 # delete the interface as it can cause issues when not rebooting
 if [ "$MANAGE_PRO_BRIDGE" == "y" ]; then
-    sudo nmcli con del ${PROVISIONING_NETWORK_NAME} || true
-    sudo ip link delete ${PROVISIONING_NETWORK_NAME} || true
+    sudo nmcli con del "${PROVISIONING_NETWORK_NAME}" || true
+    sudo ip link delete "${PROVISIONING_NETWORK_NAME}" || true
     if [[ -d /sys/class/net/pro-ipv6-dummy ]]; then
        sudo ip link delete pro-ipv6-dummy || true
     fi
-    sudo rm -f /etc/NetworkManager/system-connections/${PROVISIONING_NETWORK_NAME}.nmconnection
+    sudo rm -f "/etc/NetworkManager/system-connections/${PROVISIONING_NETWORK_NAME}.nmconnection"
 fi
 # Leaving this around causes issues when the host is rebooted
 # delete the interface as it can cause issues when not rebooting
 if [ "$MANAGE_BR_BRIDGE" == "y" ]; then
-    sudo nmcli con del ${BAREMETAL_NETWORK_NAME} || true
-    sudo ip link delete ${BAREMETAL_NETWORK_NAME} || true
+    sudo nmcli con del "${BAREMETAL_NETWORK_NAME}" || true
+    sudo ip link delete "${BAREMETAL_NETWORK_NAME}" || true
     if [[ -d /sys/class/net/bm-ipv6-dummy ]]; then
        sudo ip link delete bm-ipv6-dummy || true
     fi
-    sudo rm -f /etc/NetworkManager/system-connections/${BAREMETAL_NETWORK_NAME}.nmconnection
+    sudo rm -f "/etc/NetworkManager/system-connections/${BAREMETAL_NETWORK_NAME}.nmconnection"
 fi
 
 # Drop all ebtables rules
diff --git a/ironic_cleanup.sh b/ironic_cleanup.sh
index 947a4f9bf..0ab40a5bf 100755
--- a/ironic_cleanup.sh
+++ b/ironic_cleanup.sh
@@ -9,8 +9,8 @@ early_cleanup_validation
 
 # Kill and remove the running ironic containers
 for name in ironic ironic-api ironic-conductor ironic-inspector dnsmasq httpd-${PROVISIONING_NETWORK_NAME} mariadb vbmc sushy-tools; do
-    sudo podman ps | grep -w "$name$" && sudo podman kill $name
-    sudo podman ps --all | grep -w "$name$" && sudo podman rm $name -f
+    sudo podman ps | grep -w "$name$" && sudo podman kill "$name"
+    sudo podman ps --all | grep -w "$name$" && sudo podman rm "$name" -f
 done
 
 # Remove existing pod
diff --git a/metal3-dev/local-bmo.sh b/metal3-dev/local-bmo.sh
index 16d4ae369..5d50da925 100755
--- a/metal3-dev/local-bmo.sh
+++ b/metal3-dev/local-bmo.sh
@@ -3,37 +3,37 @@
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
 
 LOGDIR=${SCRIPTDIR}/logs
-source $SCRIPTDIR/logging.sh
+source "$SCRIPTDIR/logging.sh"
 
-source $SCRIPTDIR/common.sh
-source $SCRIPTDIR/utils.sh
-source $SCRIPTDIR/network.sh
+source "$SCRIPTDIR/common.sh"
+source "$SCRIPTDIR/utils.sh"
+source "$SCRIPTDIR/network.sh"
 
-if ! which yq 2>&1 >/dev/null ; then
+if ! which yq >/dev/null 2>&1; then
     echo "Did not find yq" 1>&2
     echo "Install with: pip3 install --user yq" 1>&2
     exit 1
 fi
 
 BMO_PATH=${BAREMETAL_OPERATOR_PATH:-$GOPATH/src/github.com/metal3-io/baremetal-operator}
-if [ ! -d $BMO_PATH ]; then
+if [ ! -d "$BMO_PATH" ]; then
     echo "Did not find $BMO_PATH" 1>&2
     exit 1
 fi
 
 # Stop the cluster-baremetal-operator so it does not try to fix the
 # deployment we are going to change.
-cd $SCRIPTDIR
-$SCRIPTDIR/stop-cbo.sh
+cd "$SCRIPTDIR"
+"$SCRIPTDIR/stop-cbo.sh"
 
 OUTDIR=${OCP_DIR}/metal3-dev
-mkdir -p $OUTDIR
+mkdir -p "$OUTDIR"
 
 # Scale the existing deployment down.
 oc scale deployment -n openshift-machine-api --replicas=0 metal3
 if oc get pod -o name -n openshift-machine-api | grep -E -v 'metal3-(development|image-cache)' | grep -q metal3; then
     metal3pods=$(oc get pod -o name -n openshift-machine-api | grep -E -v 'metal3-(development|image-cache)' | grep metal3)
-    oc wait --for=delete -n openshift-machine-api $metal3pods || true
+    oc wait --for=delete -n openshift-machine-api "$metal3pods" || true
 fi
 
 # Delete validatingwebhookconfiguration if exist. Because on local runs,
@@ -41,41 +41,42 @@ fi
 oc delete validatingwebhookconfiguration/baremetal-operator-validating-webhook-configuration --ignore-not-found=true
 
 # Save a copy of the full deployment as input
-oc get deployment -n openshift-machine-api -o yaml metal3 > $OUTDIR/bmo-deployment-full.yaml
+oc get deployment -n openshift-machine-api -o yaml metal3 > "$OUTDIR/bmo-deployment-full.yaml"
 
 # Extract the containers list, skipping the bmo
-cat $OUTDIR/bmo-deployment-full.yaml \
+cat "$OUTDIR/bmo-deployment-full.yaml" \
     | yq -Y '.spec.template.spec.containers | map(select( .command[0] != "/baremetal-operator"))' \
-         > $OUTDIR/bmo-deployment-dev-containers.yaml
+         > "$OUTDIR/bmo-deployment-dev-containers.yaml"
 
 # Get a stripped down version of the deployment
-cat $OUTDIR/bmo-deployment-full.yaml \
+cat "$OUTDIR/bmo-deployment-full.yaml" \
     | yq -Y 'del(.spec.template.spec.containers) | del(.status) | del(.metadata.annotations) | del(.metadata.selfLink) | del(.metadata.uid) | del(.metadata.resourceVersion) | del(.metadata.creationTimestamp) | del(.metadata.generation)' \
-         > $OUTDIR/bmo-deployment-dev-without-containers.yaml
+         > "$OUTDIR/bmo-deployment-dev-without-containers.yaml"
 
 # Combine the stripped down deployment with the container list
-containers=$(cat $OUTDIR/bmo-deployment-dev-containers.yaml | yq '.')
-cat $OUTDIR/bmo-deployment-dev-without-containers.yaml \
+containers=$(cat "$OUTDIR/bmo-deployment-dev-containers.yaml" | yq '.')
+# shellcheck disable=SC2016
+cat "$OUTDIR/bmo-deployment-dev-without-containers.yaml" \
     | yq -Y --argjson containers "$containers" \
          'setpath(["spec", "template", "spec", "containers"]; $containers) | setpath(["metadata", "name"]; "metal3-development")' \
          | yq -Y 'setpath(["spec", "replicas"]; 1)' \
-         > $OUTDIR/bmo-deployment-dev.yaml
+         > "$OUTDIR/bmo-deployment-dev.yaml"
 
 # Modify the image pull policy to always pull, in case we're using
 # local images.
-sed -i 's/imagePullPolicy: IfNotPresent/imagePullPolicy: Always/g' $OUTDIR/bmo-deployment-dev.yaml
+sed -i 's/imagePullPolicy: IfNotPresent/imagePullPolicy: Always/g' "$OUTDIR/bmo-deployment-dev.yaml"
 
 # Launch the deployment with the support services and ensure it is scaled up
-oc apply -f $OUTDIR/bmo-deployment-dev.yaml -n openshift-machine-api
+oc apply -f "$OUTDIR/bmo-deployment-dev.yaml" -n openshift-machine-api
 
 # Set some variables the operator expects to have in order to work
 export OPERATOR_NAME=baremetal-operator
 
 oc wait -n openshift-machine-api --for=condition=Ready pod -l baremetal.openshift.io/cluster-baremetal-operator=metal3-state --timeout=180s
 CLUSTER_IRONIC_IP=$(oc get pods -n openshift-machine-api -l baremetal.openshift.io/cluster-baremetal-operator=metal3-state -o jsonpath="{.items[0].status.hostIP}")
-CLUSTER_IP=$(wrap_if_ipv6 ${CLUSTER_IRONIC_IP})
+CLUSTER_IP=$(wrap_if_ipv6 "${CLUSTER_IRONIC_IP}")
 for var in IRONIC_ENDPOINT IRONIC_INSPECTOR_ENDPOINT DEPLOY_KERNEL_URL DEPLOY_RAMDISK_URL IRONIC_INSECURE; do
-    export "$var"=$(cat $OUTDIR/bmo-deployment-full.yaml | yq -r ".spec.template.spec.containers[] | select(.name == \"metal3-baremetal-operator\").env[] | select(.name == \"${var}\").value" | sed "s/localhost/${CLUSTER_IP}/g")
+    export "$var"="$(cat "$OUTDIR/bmo-deployment-full.yaml" | yq -r ".spec.template.spec.containers[] | select(.name == \"metal3-baremetal-operator\").env[] | select(.name == \"${var}\").value" | sed "s/localhost/${CLUSTER_IP}/g")"
 done
 
 auth_dir=/opt/metal3/auth
@@ -83,16 +84,16 @@ get_creds() {
     local svc=$1
     local cred_dir="${auth_dir}/${svc}"
     local secret="metal3-${svc}-password"
-    if oc get -n openshift-machine-api secret ${secret} -o name >/dev/null; then
+    if oc get -n openshift-machine-api secret "${secret}" -o name >/dev/null; then
         if [ ! -d ${auth_dir} ]; then
             sudo mkdir -p "${auth_dir}"
-            sudo chown -R $USER:$GROUP "${auth_dir}/.."
+            sudo chown -R "$USER:$GROUP" "${auth_dir}/.."
         fi
-        if [ ! -d ${cred_dir} ]; then
+        if [ ! -d "${cred_dir}" ]; then
             mkdir "${cred_dir}"
         fi
         for field in username password; do
-            oc get -n openshift-machine-api secret ${secret} -o jsonpath="{.data.${field}}" | base64 -d >${cred_dir}/${field}
+            oc get -n openshift-machine-api secret "${secret}" -o jsonpath="{.data.${field}}" | base64 -d > "${cred_dir}/${field}"
         done
     fi
 }
@@ -101,7 +102,7 @@ get_creds ironic
 get_creds ironic-inspector
 
 # Run the operator
-cd $BMO_PATH
+cd "$BMO_PATH"
 
 # Use our local verison of the CRDs, in case they are newer than the ones
 # in the cluster now.
diff --git a/metal3-dev/local-capbm.sh b/metal3-dev/local-capbm.sh
index d410d2ce7..d53fc182e 100755
--- a/metal3-dev/local-capbm.sh
+++ b/metal3-dev/local-capbm.sh
@@ -3,62 +3,63 @@
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
 
 LOGDIR=${SCRIPTDIR}/logs
-source $SCRIPTDIR/logging.sh
+source "$SCRIPTDIR/logging.sh"
 
-source $SCRIPTDIR/common.sh
-source $SCRIPTDIR/utils.sh
+source "$SCRIPTDIR/common.sh"
+source "$SCRIPTDIR/utils.sh"
 
-if ! which yq 2>&1 >/dev/null ; then
+if ! which yq >/dev/null 2>&1; then
     echo "Did not find yq" 1>&2
     echo "Install with: pip3 install --user yq" 1>&2
     exit 1
 fi
 
 CAPBM_PATH=${CLUSTER_API_PROVIDER_BAREMETAL_PATH:-$GOPATH/src/github.com/openshift/cluster-api-provider-baremetal}
-if [ ! -d $CAPBM_PATH ]; then
+if [ ! -d "$CAPBM_PATH" ]; then
     echo "Did not find $CAPBM_PATH" 1>&2
     exit 1
 fi
 
 # Stop the machine-api-operator so it does not try to fix the
 # deployment we are going to change.
-$SCRIPTDIR/stop-mao.sh
+"$SCRIPTDIR/stop-mao.sh"
 
 OUTDIR=${OCP_DIR}/metal3-dev
-mkdir -p $OUTDIR
+mkdir -p "$OUTDIR"
 
 # Scale the existing deployment down.
 oc scale deployment -n openshift-machine-api --replicas=0 machine-api-controllers
 if oc get pod -o name -n openshift-machine-api | grep -q machine-api-controllers; then
     pods=$(oc get pod -o name -n openshift-machine-api | grep machine-api-controllers)
-    oc wait --for=delete -n openshift-machine-api $pods || true
+    oc wait --for=delete -n openshift-machine-api "$pods" || true
 fi
 
 # Save a copy of the full deployment as input
-oc get deployment -n openshift-machine-api -o yaml machine-api-controllers > $OUTDIR/capbm-deployment-full.yaml
+oc get deployment -n openshift-machine-api -o yaml machine-api-controllers > "$OUTDIR/capbm-deployment-full.yaml"
 
 # Extract the containers list, skipping the capbm
-cat $OUTDIR/capbm-deployment-full.yaml \
+cat "$OUTDIR/capbm-deployment-full.yaml" \
     | yq -Y '.spec.template.spec.containers | map(select( .command[0] != "/machine-controller-manager"))' \
-         > $OUTDIR/capbm-deployment-dev-containers.yaml
+         > "$OUTDIR/capbm-deployment-dev-containers.yaml"
 
 # Get a stripped down version of the deployment
-cat $OUTDIR/capbm-deployment-full.yaml \
+cat "$OUTDIR/capbm-deployment-full.yaml" \
     | yq -Y 'del(.spec.template.spec.containers) | del(.status) | del(.metadata.annotations) | del(.metadata.selfLink) | del(.metadata.uid) | del(.metadata.resourceVersion) | del(.metadata.creationTimestamp) | del(.metadata.generation)' \
-         > $OUTDIR/capbm-deployment-dev-without-containers.yaml
+         > "$OUTDIR/capbm-deployment-dev-without-containers.yaml"
 
 # Combine the stripped down deployment with the container list
-containers=$(cat $OUTDIR/capbm-deployment-dev-containers.yaml | yq '.')
-cat $OUTDIR/capbm-deployment-dev-without-containers.yaml \
+containers=$(cat "$OUTDIR/capbm-deployment-dev-containers.yaml" | yq '.')
+# shellcheck disable=SC2016
+cat "$OUTDIR/capbm-deployment-dev-without-containers.yaml" \
     | yq -Y --argjson containers "$containers" \
          'setpath(["spec", "template", "spec", "containers"]; $containers) | setpath(["metadata", "name"]; "capbm-development")' \
          | yq -Y 'setpath(["spec", "replicas"]; 1)' \
-         > $OUTDIR/capbm-deployment-dev.yaml
+         > "$OUTDIR/capbm-deployment-dev.yaml"
 
 # Launch the deployment with the support services and ensure it is scaled up
-oc apply -f $OUTDIR/capbm-deployment-dev.yaml -n openshift-machine-api
+oc apply -f "$OUTDIR/capbm-deployment-dev.yaml" -n openshift-machine-api
 
 # Run the local capbm
-cd $CAPBM_PATH
+cd "$CAPBM_PATH"
 
 make build && ./bin/machine-controller-manager --logtostderr=true --v=3 --namespace=openshift-machine-api --health-addr ":9441"
diff --git a/metal3-dev/local-cbo.sh b/metal3-dev/local-cbo.sh
index 9bd900fa3..e28987779 100755
--- a/metal3-dev/local-cbo.sh
+++ b/metal3-dev/local-cbo.sh
@@ -3,13 +3,13 @@
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
 
 LOGDIR=${SCRIPTDIR}/logs
-source $SCRIPTDIR/logging.sh
+source "$SCRIPTDIR/logging.sh"
 
-source $SCRIPTDIR/common.sh
-source $SCRIPTDIR/utils.sh
+source "$SCRIPTDIR/common.sh"
+source "$SCRIPTDIR/utils.sh"
 
 CBO_PATH=${CBO_PATH:-$GOPATH/src/github.com/openshift/cluster-baremetal-operator}
-if [ ! -d $CBO_PATH ]; then
+if [ ! -d "$CBO_PATH" ]; then
     echo "Did not find $CBO_PATH" 1>&2
     exit 1
 fi
@@ -26,7 +26,7 @@ oc get secret -n openshift-machine-api cluster-baremetal-operator-tls -o json \
     | base64 -d > /etc/cluster-baremetal-operator/tls/tls.key
 
 # Run the operator
-cd $CBO_PATH
+cd "$CBO_PATH"
 
 export IMAGES_JSON=${SCRIPTDIR}/${OCP_DIR}/cbo-images.json
 export RUN_NAMESPACE=openshift-machine-api
diff --git a/metal3-dev/mao-bmo.sh b/metal3-dev/mao-bmo.sh
index ceb14837e..7f348c9cf 100755
--- a/metal3-dev/mao-bmo.sh
+++ b/metal3-dev/mao-bmo.sh
@@ -3,15 +3,15 @@
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
 
 LOGDIR=${SCRIPTDIR}/logs
-source $SCRIPTDIR/logging.sh
+source "$SCRIPTDIR/logging.sh"
 
-source $SCRIPTDIR/common.sh
+source "$SCRIPTDIR/common.sh"
 
 # Scale down dev deployment
 oc scale deployment -n openshift-machine-api --replicas=0 metal3-development
 if oc get pod -o name -n openshift-machine-api | grep -q metal3-development; then
     metal3pods=$(oc get pod -o name -n openshift-machine-api | grep metal3-development)
-    oc wait --for=delete -n openshift-machine-api $metal3pods || true
+    oc wait --for=delete -n openshift-machine-api "$metal3pods" || true
 fi
 
 # Scale up regular deployment
diff --git a/metal3-dev/mao-capbm.sh b/metal3-dev/mao-capbm.sh
index 1e74b6db4..d6318296d 100755
--- a/metal3-dev/mao-capbm.sh
+++ b/metal3-dev/mao-capbm.sh
@@ -3,15 +3,15 @@
 SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/.." && pwd )"
 
 LOGDIR=${SCRIPTDIR}/logs
-source $SCRIPTDIR/logging.sh
+source "$SCRIPTDIR/logging.sh"
 
-source $SCRIPTDIR/common.sh
+source "$SCRIPTDIR/common.sh"
 
 # Scale down dev deployment
 oc scale deployment -n openshift-machine-api --replicas=0 capbm-development
 if oc get pod -o name -n openshift-machine-api | grep -q capbm-development; then
     pods=$(oc get pod -o name -n openshift-machine-api | grep capbm-development)
-    oc wait --for=delete -n openshift-machine-api $pods || true
+    oc wait --for=delete -n openshift-machine-api "$pods" || true
 fi
 
 # Scale up regular deployment
diff --git a/metallb/configure_metallb.sh b/metallb/configure_metallb.sh
index 1622d8b26..b9fcddceb 100755
--- a/metallb/configure_metallb.sh
+++ b/metallb/configure_metallb.sh
@@ -1,11 +1,12 @@
 #!/usr/bin/bash
 
-metallb_dir="$(dirname $(readlink -f $0))"
-source ${metallb_dir}/metallb_common.sh
+metallb_dir="$(dirname "$(readlink -f "$0")")"
+# shellcheck source=/dev/null
+source "${metallb_dir}/metallb_common.sh"
 
 # configure metallb through metallb-operator
-${metallb_dir}/deploy_operator.sh
-oc apply -f ${metallb_dir}/metallb.yaml
+"${metallb_dir}/deploy_operator.sh"
+oc apply -f "${metallb_dir}/metallb.yaml"
 oc adm policy add-scc-to-user privileged -n metallb-system -z speaker
 
-sudo ip route add 192.168.10.0/24 dev ${BAREMETAL_NETWORK_NAME}
+sudo ip route add 192.168.10.0/24 dev "${BAREMETAL_NETWORK_NAME}"
diff --git a/metallb/deploy_operator.sh b/metallb/deploy_operator.sh
index 6402c6d9d..f80643f66 100755
--- a/metallb/deploy_operator.sh
+++ b/metallb/deploy_operator.sh
@@ -1,7 +1,8 @@
 #!/usr/bin/bash
 
-metallb_dir="$(dirname $(readlink -f $0))"
-source ${metallb_dir}/metallb_common.sh
+metallb_dir="$(dirname "$(readlink -f "$0")")"
+# shellcheck source=/dev/null
+source "${metallb_dir}/metallb_common.sh"
 
 METALLB_OPERATOR_REPO=${METALLB_OPERATOR_REPO:-"https://github.com/metallb/metallb-operator.git"}
 METALLB_OPERATOR_COMMIT=${METALLB_OPERATOR_COMMIT:-"4d52b86"}
@@ -9,18 +10,18 @@ METALLB_OPERATOR_IMAGE_TAG=${METALLB_OPERATOR_IMAGE_TAG:-"metallb-operator"}
 export NAMESPACE=${NAMESPACE:-"metallb-system"}
 
 if [ ! -d ./metallb-operator ]; then
-	git clone ${METALLB_OPERATOR_REPO}
-	cd metallb-operator
-	git checkout ${METALLB_OPERATOR_COMMIT}
-	cd -
+	git clone "${METALLB_OPERATOR_REPO}"
+	cd metallb-operator || exit 1
+ 	git checkout "${METALLB_OPERATOR_COMMIT}"
+	cd - || exit 1
 fi
-cd metallb-operator
+cd metallb-operator || exit 1
 
 # install yq v4 for metallb deployment
 go install -mod='' github.com/mikefarah/yq/v4@v4.13.3
 
-yq e --inplace '.spec.template.spec.containers[0].env[] |= select (.name=="SPEAKER_IMAGE").value|="'${METALLB_IMAGE_BASE}':'${METALLB_IMAGE_TAG}'"' ${metallb_dir}/metallb-operator-deploy/controller_manager_patch.yaml
-yq e --inplace '.spec.template.spec.containers[0].env[] |= select (.name=="CONTROLLER_IMAGE").value|="'${METALLB_IMAGE_BASE}':'${METALLB_IMAGE_TAG}'"' ${metallb_dir}/metallb-operator-deploy/controller_manager_patch.yaml
-yq e --inplace '.spec.template.spec.containers[0].env[] |= select (.name=="FRR_IMAGE").value|="'${METALLB_IMAGE_BASE}':'${FRR_IMAGE_TAG}'"' ${metallb_dir}/metallb-operator-deploy/controller_manager_patch.yaml
+yq e --inplace '.spec.template.spec.containers[0].env[] |= select (.name=="SPEAKER_IMAGE").value|="'"${METALLB_IMAGE_BASE}"':'"${METALLB_IMAGE_TAG}"'"' "${metallb_dir}/metallb-operator-deploy/controller_manager_patch.yaml"
+yq e --inplace '.spec.template.spec.containers[0].env[] |= select (.name=="CONTROLLER_IMAGE").value|="'"${METALLB_IMAGE_BASE}"':'"${METALLB_IMAGE_TAG}"'"' "${metallb_dir}/metallb-operator-deploy/controller_manager_patch.yaml"
+yq e --inplace '.spec.template.spec.containers[0].env[] |= select (.name=="FRR_IMAGE").value|="'"${METALLB_IMAGE_BASE}"':'"${FRR_IMAGE_TAG}"'"' "${metallb_dir}/metallb-operator-deploy/controller_manager_patch.yaml"
 
 PATH="${GOPATH}:${PATH}" ENABLE_OPERATOR_WEBHOOK=true KUSTOMIZE_DEPLOY_DIR="../metallb-operator-deploy" IMG="${METALLB_IMAGE_BASE}:${METALLB_OPERATOR_IMAGE_TAG}" make deploy
diff --git a/metallb/metallb_common.sh b/metallb/metallb_common.sh
index 6a6d942a9..2241591c5 100644
--- a/metallb/metallb_common.sh
+++ b/metallb/metallb_common.sh
@@ -3,6 +3,8 @@
 METALLB_IMAGE_BASE=${METALLB_IMAGE_BASE:-"quay.io/metallb"}
 METALLB_IMAGE_TAG=${METALLB_IMAGE_TAG:-"main"}
 
-metallb_dir="$(dirname $(readlink -f $0))"
-source ${metallb_dir}/../common.sh
-source ${metallb_dir}/../network.sh
+metallb_dir="$(dirname "$(readlink -f "$0")")"
+# shellcheck source=/dev/null
+source "${metallb_dir}"/../common.sh
+# shellcheck source=/dev/null
+source "${metallb_dir}"/../network.sh
diff --git a/metallb/run_e2e.sh b/metallb/run_e2e.sh
index 4cd1d8eba..c259e7f38 100755
--- a/metallb/run_e2e.sh
+++ b/metallb/run_e2e.sh
@@ -1,19 +1,20 @@
 #!/usr/bin/bash
 
-metallb_dir="$(dirname $(readlink -f $0))"
-source ${metallb_dir}/metallb_common.sh
+metallb_dir="$(dirname "$(readlink -f "$0")")"
+# shellcheck source=/dev/null
+source "${metallb_dir}/metallb_common.sh"
 
 export METALLB_REPO=${METALLB_REPO:-https://github.com/metallb/metallb.git}
 METALLB_BRANCH=${METALLB_BRANCH:-"main"}
 [[ -d /usr/local/go ]] && export PATH=${PATH}:/usr/local/go/bin
 
 if [ ! -d ./metallb ]; then
-	git clone $METALLB_REPO
-	cd metallb
+	git clone "$METALLB_REPO"
+	cd metallb || exit 1
 	git checkout "${METALLB_BRANCH}"
-	cd -
+	cd - || exit 1
 fi
-cd metallb
+cd metallb || exit 1
 
 # add firewalld rules
 sudo firewall-cmd --zone=libvirt --permanent --add-port=179/tcp
@@ -35,6 +36,7 @@ sudo firewall-cmd --zone=libvirt --add-port=4784/udp
 SKIP="\"L2 metrics\""
 if [ "${IP_STACK}" = "v4" ]; then
 	SKIP="$SKIP\|IPV6\|DUALSTACK"
+	# shellcheck disable=SC2153
 	export PROVISIONING_HOST_EXTERNAL_IPV4=${PROVISIONING_HOST_EXTERNAL_IP}
 	export PROVISIONING_HOST_EXTERNAL_IPV6=1111:1:1::1
 elif [ "${IP_STACK}" = "v6" ]; then
@@ -52,7 +54,7 @@ pip3 install --user -r ./dev-env/requirements.txt
 export PATH=${PATH}:${HOME}/.local/bin
 export CONTAINER_RUNTIME=podman
 export RUN_FRR_CONTAINER_ON_HOST_NETWORK=true
-inv e2etest --kubeconfig=$(readlink -f ../../ocp/ostest/auth/kubeconfig) \
+inv e2etest --kubeconfig="$(readlink -f ../../ocp/ostest/auth/kubeconfig)" \
 	--service-pod-port=8080 --system-namespaces="metallb-system" --skip-docker \
 	--ipv4-service-range=192.168.10.0/24 --ipv6-service-range=fc00:f853:0ccd:e799::/124 \
 	--skip="${SKIP}" --use-operator
diff --git a/must_gather.sh b/must_gather.sh
index 1c6d1d687..b0f425b42 100755
--- a/must_gather.sh
+++ b/must_gather.sh
@@ -24,8 +24,8 @@ else
   MUST_GATHER_IMAGE=""
 fi
 
-oc --insecure-skip-tls-verify adm must-gather $MUST_GATHER_IMAGE --dest-dir "$MUST_GATHER_PATH" > "$MUST_GATHER_PATH/must-gather.log"
+oc --insecure-skip-tls-verify adm must-gather "$MUST_GATHER_IMAGE" --dest-dir "$MUST_GATHER_PATH" > "$MUST_GATHER_PATH/must-gather.log"
 
 # Gather audit logs
-mkdir -p $MUST_GATHER_PATH/audit-logs
-oc --insecure-skip-tls-verify adm must-gather $MUST_GATHER_IMAGE --dest-dir "$MUST_GATHER_PATH/audit-logs" -- /usr/bin/gather_audit_logs > "$MUST_GATHER_PATH/audit-logs.log"
+mkdir -p "$MUST_GATHER_PATH/audit-logs"
+oc --insecure-skip-tls-verify adm must-gather "$MUST_GATHER_IMAGE" --dest-dir "$MUST_GATHER_PATH/audit-logs" -- /usr/bin/gather_audit_logs > "$MUST_GATHER_PATH/audit-logs.log"
diff --git a/oc_mirror_cleanup.sh b/oc_mirror_cleanup.sh
index 4f3765391..aefa63200 100755
--- a/oc_mirror_cleanup.sh
+++ b/oc_mirror_cleanup.sh
@@ -4,8 +4,8 @@ set -euxo pipefail
 source common.sh
 
 if [ -d "${WORKING_DIR}/mirror-registry" ]; then
-   pushd ${WORKING_DIR}/mirror-registry
-   sudo ./mirror-registry uninstall --quayRoot ${WORKING_DIR}/quay-install/ -v --autoApprove
+   pushd "${WORKING_DIR}/mirror-registry"
+   sudo ./mirror-registry uninstall --quayRoot "${WORKING_DIR}/quay-install/" -v --autoApprove
    popd
    rm -rf "${WORKING_DIR}/mirror-registry"
 fi
@@ -24,6 +24,6 @@ fi
 
 # restore docker config file that was updated with auth settings
 if [[ -f ${DOCKER_CONFIG_FILE}.old ]]; then
-   cp ${DOCKER_CONFIG_FILE}.old ${DOCKER_CONFIG_FILE}
-   rm ${DOCKER_CONFIG_FILE}.old
+   cp "${DOCKER_CONFIG_FILE}.old" "${DOCKER_CONFIG_FILE}"
+   rm "${DOCKER_CONFIG_FILE}.old"
 fi
diff --git a/ocp_cleanup.sh b/ocp_cleanup.sh
index 7637d1cbe..d6645d8f8 100755
--- a/ocp_cleanup.sh
+++ b/ocp_cleanup.sh
@@ -12,29 +12,29 @@ if sudo systemctl is-active fix_certs.timer; then
   sudo systemctl stop fix_certs.timer
 fi
 
-if [ -d ${OCP_DIR} ]; then
-    ${OCP_DIR}/openshift-install --dir ${OCP_DIR} --log-level=debug destroy bootstrap
-    ${OCP_DIR}/openshift-install --dir ${OCP_DIR} --log-level=debug destroy cluster
+if [ -d "${OCP_DIR}" ]; then
+    "${OCP_DIR}/openshift-install" --dir "${OCP_DIR}" --log-level=debug destroy bootstrap
+    "${OCP_DIR}/openshift-install" --dir "${OCP_DIR}" --log-level=debug destroy cluster
     sudo rm -rf "${OCP_DIR}"
 fi
 
-sudo rm -rf /etc/NetworkManager/dnsmasq.d/openshift-${CLUSTER_NAME}.conf
+sudo rm -rf "/etc/NetworkManager/dnsmasq.d/openshift-${CLUSTER_NAME}.conf"
 
 # Cleanup ssh keys for baremetal network
-if [ -f $HOME/.ssh/known_hosts ]; then
+if [ -f "$HOME/.ssh/known_hosts" ]; then
     EXT_SUB_V4=$(echo "${EXTERNAL_SUBNET_V4}" | cut -d"/" -f1 | sed "s/0$//")
     if [ -n "${EXT_SUB_V4}" ]; then
-        sed -i "/^${EXT_SUB_V4}/d" $HOME/.ssh/known_hosts
+        sed -i "/^${EXT_SUB_V4}/d" "$HOME/.ssh/known_hosts"
     fi
     EXT_SUB_V6=$(echo "${EXTERNAL_SUBNET_V6}" | cut -d"/" -f1 | sed "s/0$//")
     if [ -n "${EXT_SUB_V6}" ]; then
-        sed -i "/^${EXT_SUB_V6}/d" $HOME/.ssh/known_hosts
+        sed -i "/^${EXT_SUB_V6}/d" "$HOME/.ssh/known_hosts"
     fi
     PRO_SUB=$(echo "${PROVISIONING_NETWORK}" | cut -d"/" -f1 | sed "s/0$//")
     if [ -n "${PRO_SUB}" ]; then
-        sed -i "/^${PRO_SUB}/d" $HOME/.ssh/known_hosts
+        sed -i "/^${PRO_SUB}/d" "$HOME/.ssh/known_hosts"
     fi
-    sed -i "/^api.${CLUSTER_DOMAIN}/d" $HOME/.ssh/known_hosts
+    sed -i "/^api.${CLUSTER_DOMAIN}/d" "$HOME/.ssh/known_hosts"
 fi
 
 if test -f assets/templates/98_master-chronyd-redhat.yaml ; then
@@ -47,21 +47,21 @@ fi
 # If the installer fails before terraform completes the destroy bootstrap
 # cleanup doesn't clean up the VM/volumes created..
 for vm in $(sudo virsh list --all --name | grep "^${CLUSTER_NAME}.*bootstrap"); do
-  sudo virsh destroy $vm
-  sudo virsh undefine $vm --remove-all-storage
+  sudo virsh destroy "$vm"
+  sudo virsh undefine "$vm" --remove-all-storage
 done
 
 # For some reason --remove-all-storage doesn't actually remove the storage
 # so we do some extra cleanup of volumes
 if [ -d /var/lib/libvirt/openshift-images ]; then
-  sudo rm -fr /var/lib/libvirt/openshift-images/${CLUSTER_NAME}-*
+  sudo rm -fr "/var/lib/libvirt/openshift-images/${CLUSTER_NAME}-*"
 fi
 
 VOLS=$(sudo virsh vol-list --pool default | awk '{print $1}' | grep -e "^${CLUSTER_NAME}.*bootstrap" -e "^configdrive-" -e "^boot-.*-iso-") || true
 
-if [ -n $VOLS ]; then
+if [ -n "$VOLS" ]; then
   for v in $VOLS; do
-    sudo virsh vol-delete $v --pool default
+    sudo virsh vol-delete "$v" --pool default
   done
 fi
 
@@ -74,8 +74,8 @@ fi
 sudo sed -ie '/^allow /d' /etc/chrony.conf
 
 # Restore file after workaround
-if [ -d ${METAL3_DEV_ENV_PATH} ]; then
-  cd ${METAL3_DEV_ENV_PATH}
+if [ -d "${METAL3_DEV_ENV_PATH}" ]; then
+  cd "${METAL3_DEV_ENV_PATH}" || exit 1
   git checkout vm-setup/roles/packages_installation/tasks/centos_required_packages.yml
 fi
 
diff --git a/registry_cleanup.sh b/registry_cleanup.sh
index f3b49fe42..5413a30c6 100755
--- a/registry_cleanup.sh
+++ b/registry_cleanup.sh
@@ -12,5 +12,5 @@ if sudo podman container exists registry; then
   sudo podman rm registry
 fi
 
-sudo rm -rf $WORKING_DIR/registry
-sudo rm -rf $WORKING_DIR/mirror_registry
+sudo rm -rf "$WORKING_DIR/registry"
+sudo rm -rf "$WORKING_DIR/mirror_registry"
diff --git a/remote_nodes.sh b/remote_nodes.sh
index 597c71908..2fa2502b6 100644
--- a/remote_nodes.sh
+++ b/remote_nodes.sh
@@ -92,50 +92,50 @@ function playbook() {
 		-e "forward_mode=nat" \
 		-e "cluster_domain=$REMOTE_CLUSTER_DOMAIN" \
 		-e "networks={{external_network}}" \
-		-i ${VM_SETUP_PATH}/inventory.ini \
-		-b -vvv ${PLAYBOOK}
+		-i "${VM_SETUP_PATH}/inventory.ini" \
+		-b -vvv "${PLAYBOOK}"
 }
 
 function setup_remote_cluster() {
 	playbook setup
 
 	# Generate the assets for extra worker VMs
-	cp -f ${REMOTE_NODES_FILE} ${REMOTE_NODES_FILE}.orig
+	cp -f "${REMOTE_NODES_FILE}" "${REMOTE_NODES_FILE}.orig"
 	jq '.nodes' "${REMOTE_NODES_FILE}" | tee "${REMOTE_BAREMETALHOSTS_FILE}"
 
-	generate_ocp_host_manifest ${OCP_DIR} ${REMOTE_BAREMETALHOSTS_FILE} remote_host_manifests.yaml ${NS}
+	generate_ocp_host_manifest "${OCP_DIR}" "${REMOTE_BAREMETALHOSTS_FILE}" remote_host_manifests.yaml "${NS}"
 
 	# Enable watchAllNamepaces flag in the provisioning-configuration resource
 	oc patch provisioning provisioning-configuration --type merge -p '{"spec":{"watchAllNamespaces": true}}'
 
 	# Enable traffic between ostestbm and ostest<NS>
-	sudo $IPTABLES -I FORWARD 1 -o ${REMOTE_CLUSTER_NAME} -i ${BAREMETAL_NETWORK_NAME} -j ACCEPT
+	sudo $IPTABLES -I FORWARD 1 -o "${REMOTE_CLUSTER_NAME}" -i "${BAREMETAL_NETWORK_NAME}" -j ACCEPT
 
 	# Create the NS and apply the manifests
 	if [[ $APPLY_REMOTE_NODES = "true" ]]
 	then
 		# The default of $NS openshift-machine-api is a protected namespace
-		if !(is_ocp_protected_namespace $NS)
+		if ! (is_ocp_protected_namespace "$NS")
 		then
-			oc create ns ${NS}
+			oc create ns "${NS}"
 		fi
-		oc apply -f ${OCP_DIR}/remote_host_manifests.yaml
+		oc apply -f "${OCP_DIR}/remote_host_manifests.yaml"
 	fi
 
 }
 
 function cleanup_remote_cluster() {
 	# The default of $NS openshift-machine-api is a protected namespace
-	if !(is_ocp_protected_namespace $NS)
+	if ! (is_ocp_protected_namespace "$NS")
 	then
-		oc delete ns ${NS}
+		oc delete ns "${NS}"
 	fi
 
 	# Remove manifests
-	rm -f ${OCP_DIR}/remote_host_manifests.yaml ${OCP_DIR}/${REMOTE_BAREMETALHOSTS_FILE} ${REMOTE_NODES_FILE}
+	rm -f "${OCP_DIR}/remote_host_manifests.yaml" "${OCP_DIR}/${REMOTE_BAREMETALHOSTS_FILE}" "${REMOTE_NODES_FILE}"
 
 	# Run a partial teardown playbook. We don't want a full virtualbmc teardown.
-	cat > ${TEARDOWN_PLAYBOOK} <<EOF
+	cat > "${TEARDOWN_PLAYBOOK}" <<EOF
 ---
 - name: Teardown previous libvirt setup
   hosts: virthost
@@ -151,12 +151,11 @@ function cleanup_remote_cluster() {
 EOF
 
 	playbook cleanup
-	rm -f ${TEARDOWN_PLAYBOOK}
+	rm -f "${TEARDOWN_PLAYBOOK}"
 
 	# Remove the iptables rule between ostestbm and ostest<NS>
-	sudo $IPTABLES -C FORWARD -o ${REMOTE_CLUSTER_NAME} -i ${BAREMETAL_NETWORK_NAME} -j ACCEPT  >/dev/null 2>&1
-	if [ $? -ne 0 ]; then
-		sudo $IPTABLES -D FORWARD -o ${REMOTE_CLUSTER_NAME} -i ${BAREMETAL_NETWORK_NAME} -j ACCEPT
+	if sudo $IPTABLES -C FORWARD -o "${REMOTE_CLUSTER_NAME}" -i "${BAREMETAL_NETWORK_NAME}" -j ACCEPT  >/dev/null 2>&1; then
+		sudo $IPTABLES -D FORWARD -o "${REMOTE_CLUSTER_NAME}" -i "${BAREMETAL_NETWORK_NAME}" -j ACCEPT
 	fi
 }
 
diff --git a/run-custom-mao.sh b/run-custom-mao.sh
index 9238aceb8..7dde4463e 100755
--- a/run-custom-mao.sh
+++ b/run-custom-mao.sh
@@ -26,31 +26,31 @@ MAO_RBAC_MANIFEST="install/0000_30_machine-api-operator_09_rbac.yaml"
 
 wait_for_metal3_to_terminate() {
     echo "Waiting for metal3 pod to terminate..."
-    METAL3_POD=$(oc --request-timeout=5s --config ${KUBECONFIG} get pods --namespace openshift-machine-api | grep metal3 | awk '{print $1}')
-    while [ "$(oc --config ${KUBECONFIG} get pods -n openshift-machine-api | grep ${METAL3_POD})" != "" ]; do sleep 5; done
+    METAL3_POD=$(oc --request-timeout=5s --config "${KUBECONFIG}" get pods --namespace openshift-machine-api | grep metal3 | awk '{print $1}')
+    while [ "$(oc --config "${KUBECONFIG}" get pods -n openshift-machine-api | grep "${METAL3_POD}")" != "" ]; do sleep 5; done
 }
 
 wait_for_metal3_to_start() {
     echo "Waiting for metal3 pod to start..."
-    while [ "$(oc --config ${KUBECONFIG} get pods -n openshift-machine-api | grep metal3 | wc -l)" != 1 ]; do sleep 5; done
+    while [ "$(oc --config "${KUBECONFIG}" get pods -n openshift-machine-api | grep -c metal3)" != 1 ]; do sleep 5; done
 }
 
 update_mao_rbac() {
-    wget https://${MAO_REPO}/${MAO_BRANCH}/${MAO_RBAC_MANIFEST} -O ${SCRIPTDIR}/ocp/machine-api-operator-roles.yaml
+    wget "https://${MAO_REPO}/${MAO_BRANCH}/${MAO_RBAC_MANIFEST}" -O "${SCRIPTDIR}/ocp/machine-api-operator-roles.yaml"
 
     # Give the machine-api-operator rbac access to create and read secrets
-    oc --config ${KUBECONFIG} apply -f ${SCRIPTDIR}/ocp/machine-api-operator-roles.yaml
+    oc --config "${KUBECONFIG}" apply -f "${SCRIPTDIR}/ocp/machine-api-operator-roles.yaml"
 }
 
 replace_mao_image() {
     #Replace the MAO image with the one provided as input param
-    oc --config ${KUBECONFIG} get deployments -n openshift-machine-api machine-api-operator -o yaml > ${SCRIPTDIR}/ocp/mao.yaml
-    sed -i -e "s!image: .*!${REPLACEMENT_TEXT}!g" ${SCRIPTDIR}/ocp/mao.yaml
-    oc --config ${KUBECONFIG} apply -f ${SCRIPTDIR}/ocp/mao.yaml
+    oc --config "${KUBECONFIG}" get deployments -n openshift-machine-api machine-api-operator -o yaml > "${SCRIPTDIR}/ocp/mao.yaml"
+    sed -i -e "s!image: .*!${REPLACEMENT_TEXT}!g" "${SCRIPTDIR}/ocp/mao.yaml"
+    oc --config "${KUBECONFIG}" apply -f "${SCRIPTDIR}/ocp/mao.yaml"
 }
 
 check_if_new_mariadb_password_exists() {
-    if [ "$(oc --config ${KUBECONFIG} get secrets --namespace openshift-machine-api | grep metal3-mariadb-password | wc -l)" != 1 ]; then
+    if [ "$(oc --config "${KUBECONFIG}" get secrets --namespace openshift-machine-api | grep -c metal3-mariadb-password)" != 1 ]; then
       exit 1
     else
       echo "New metal3-mariadb-password successfully created."
@@ -58,9 +58,9 @@ check_if_new_mariadb_password_exists() {
 }
 
 # Stop CVO, MAO and Metal3 deployments
-oc --config ${KUBECONFIG} scale deployment --replicas=0 cluster-version-operator --namespace openshift-cluster-version
-oc --config ${KUBECONFIG} scale deployment --replicas=0 machine-api-operator --namespace openshift-machine-api
-oc --config ${KUBECONFIG} scale deployment --replicas=0 metal3 --namespace openshift-machine-api
+oc --config "${KUBECONFIG}" scale deployment --replicas=0 cluster-version-operator --namespace openshift-cluster-version
+oc --config "${KUBECONFIG}" scale deployment --replicas=0 machine-api-operator --namespace openshift-machine-api
+oc --config "${KUBECONFIG}" scale deployment --replicas=0 metal3 --namespace openshift-machine-api
 
 wait_for_metal3_to_terminate
 
@@ -68,7 +68,7 @@ update_mao_rbac
 
 replace_mao_image
 
-oc --config ${KUBECONFIG} scale deployment --replicas=1 machine-api-operator --namespace openshift-machine-api
+oc --config "${KUBECONFIG}" scale deployment --replicas=1 machine-api-operator --namespace openshift-machine-api
 
 wait_for_metal3_to_start
 
diff --git a/run_capi_e2e.sh b/run_capi_e2e.sh
index a040758d3..0c4447ba5 100755
--- a/run_capi_e2e.sh
+++ b/run_capi_e2e.sh
@@ -24,6 +24,6 @@ export EXTRA_WORKERS_NAMESPACE="openshift-cluster-api"
 
 sync_repo_and_patch cluster-capi-operator https://github.com/openshift/cluster-capi-operator
 
-pushd $REPO_PATH/cluster-capi-operator
+pushd "$REPO_PATH/cluster-capi-operator"
 make e2e
 popd
diff --git a/scripts/periodics_pass_rates.sh b/scripts/periodics_pass_rates.sh
index 4def393ab..bf4c493c0 100755
--- a/scripts/periodics_pass_rates.sh
+++ b/scripts/periodics_pass_rates.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 usage() {
-    echo "$(basename $0) -  list recent pass rates for metal-ipi jobs" 1>&2
+    echo "$(basename "$0") -  list recent pass rates for metal-ipi jobs" 1>&2
     echo "Usage: $(basename 0) [-h] [-l] RELEASE" 1>&2
     echo "  -l: list links to failed job runs" 1>&2
     echo "  RELEASE: release to display results for (default: all)" 1>&2
@@ -31,20 +31,22 @@ RESULT_FORMAT=${RESULT_FORMAT:-"%4s %5s - %s\n"}
 function getJobSummary(){
     JOB=$1
     URL=https://prow.ci.openshift.org/job-history/gs/origin-ci-test/logs/$JOB
-    DATA=$(curl --silent $URL | grep allBuilds - | grep -o '\[.*\]')
-    SUCCESS=$(echo $DATA | jq '.[].Result' | grep "SUCCESS" | wc -l)
-    TOTAL=$(echo $DATA | jq '.[].Result' | grep -v "PENDING" | wc -l)
+    DATA=$(curl --silent "$URL" | grep allBuilds - | grep -o '\[.*\]')
+    SUCCESS=$(echo "$DATA" | jq '.[].Result' | grep -c "SUCCESS")
+    TOTAL=$(echo "$DATA" | jq '.[].Result' | grep -c -v "PENDING")
     if [ "$TOTAL" == 0 ] ; then
-        printf "$RESULT_FORMAT" $SUCCESS/0 0% - ${URL}
+        # shellcheck disable=SC2059
+        printf "$RESULT_FORMAT" "$SUCCESS"/0 0% - "${URL}"
         return
     fi
-    printf "$RESULT_FORMAT" $(( (SUCCESS * 100)/TOTAL ))% $SUCCESS/$TOTAL ${URL}
+    # shellcheck disable=SC2059
+    printf "$RESULT_FORMAT" $(( (SUCCESS * 100)/TOTAL ))% "$SUCCESS"/"$TOTAL" "${URL}"
     if [ "$LIST" == "1" ] ; then
-        echo $DATA | jq '.[] | select(.Result | contains("FAILURE")) | "    \(.Started) https://prow.ci.openshift.org/\(.SpyglassLink) " ' -r
+        echo "$DATA" | jq '.[] | select(.Result | contains("FAILURE")) | "    \(.Started) https://prow.ci.openshift.org/\(.SpyglassLink) " ' -r
     fi
 }
 
 for JOB in $JOBSTOTEST ; do
-    getJobSummary $JOB
+    getJobSummary "$JOB"
 done
 
diff --git a/show_bootstrap_log.sh b/show_bootstrap_log.sh
index d04773530..99126fba0 100755
--- a/show_bootstrap_log.sh
+++ b/show_bootstrap_log.sh
@@ -6,4 +6,4 @@ source utils.sh
 
 BOOTSTRAP_VM_IP=$(bootstrap_ip)
 echo "Attempting to follow $1 on ${BOOTSTRAP_VM_IP} ..."
-ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no core@${BOOTSTRAP_VM_IP} journalctl -b -f -u $1
+ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "core@${BOOTSTRAP_VM_IP}" journalctl -b -f -u "$1"
diff --git a/stop-cbo.sh b/stop-cbo.sh
index 06fdb31bd..1c9450d8d 100755
--- a/stop-cbo.sh
+++ b/stop-cbo.sh
@@ -7,8 +7,8 @@ source common.sh
 # fail.
 pod=$(oc get pod -n openshift-machine-api -o name | grep cluster-baremetal-operator || true)
 if [ -n "$pod" ]; then
-    oc exec $pod -n openshift-machine-api -c cluster-baremetal-operator \
-       -- cat /etc/cluster-baremetal-operator/images/images.json > ${OCP_DIR}/cbo-images.json
+    oc exec "$pod" -n openshift-machine-api -c cluster-baremetal-operator \
+       -- cat /etc/cluster-baremetal-operator/images/images.json > "${OCP_DIR}/cbo-images.json"
     echo "CBO image settings saved to ${OCP_DIR}/cbo-images.json"
 else
     echo "No CBO pod found, cannot save image settings"
diff --git a/stop-mao.sh b/stop-mao.sh
index 31e975e74..d5feb0128 100755
--- a/stop-mao.sh
+++ b/stop-mao.sh
@@ -7,8 +7,8 @@ source common.sh
 # fail.
 pod=$(oc get pod -n openshift-machine-api -o name | grep machine-api-operator || true)
 if [ -n "$pod" ]; then
-    oc exec $pod -n openshift-machine-api -c machine-api-operator \
-       -- cat /etc/machine-api-operator-config/images/images.json > ${OCP_DIR}/mao-images.json
+    oc exec "$pod" -n openshift-machine-api -c machine-api-operator \
+       -- cat /etc/machine-api-operator-config/images/images.json > "${OCP_DIR}/mao-images.json"
     echo "MAO image settings saved to ${OCP_DIR}/mao-images.json"
 else
     echo "No MAO pod found, cannot save image settings"
diff --git a/workingdir_cleanup.sh b/workingdir_cleanup.sh
index 67bbbbd90..a5b3880d2 100755
--- a/workingdir_cleanup.sh
+++ b/workingdir_cleanup.sh
@@ -7,4 +7,4 @@ source validation.sh
 
 early_cleanup_validation
 
-sudo rm -rf $WORKING_DIR
+sudo rm -rf "$WORKING_DIR"