fix: Address shellcheck detected shell warnings (#22686)

Signed-off-by: Oliver Gondža <ogondza@gmail.com>
2026-02-20 01:28:45 +01:00 · 2025-07-18 13:38:27 +02:00
parent 908c73255e
commit 5ee35ad707
38 changed files with 170 additions and 149 deletions
--- a/.github/workflows/ci-build.yaml
+++ b/.github/workflows/ci-build.yaml
@@ -339,7 +339,7 @@ jobs:
      - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - run: |
          sudo apt-get install shellcheck
-          shellcheck -e SC2086 -e SC2046 -e SC2068 -e SC2206 -e SC2048 -e SC2059 -e SC2154 -e SC2034 -e SC2016 -e SC2128 -e SC1091 -e SC2207  $(find . -type f -name '*.sh') | tee sc.log
+          shellcheck -e SC2059 -e SC2154 -e SC2034 -e SC2016 -e SC1091 $(find . -type f -name '*.sh' | grep -v './ui/node_modules') | tee sc.log
          test ! -s sc.log

  analyze:
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -3,7 +3,7 @@
 # If we're started as PID 1, we should wrap command execution through tini to
 # prevent leakage of orphaned processes ("zombies").
 if test "$$" = "1"; then
-	exec tini -- $@
+	exec tini -- "$@"
 else
 	exec "$@"
 fi
--- a/hack/bump-major-version.sh
+++ b/hack/bump-major-version.sh
@@ -4,29 +4,31 @@

 # Get the current version from go.mod.
 CURRENT_VERSION=$(grep 'module github.com/argoproj/argo-cd' go.mod | awk '{print $2}' | sed 's/.*\/v//')
+NEXT_VERSION=$((CURRENT_VERSION + 1))

-echo "Upgrading from v${CURRENT_VERSION} to v$((CURRENT_VERSION + 1))..."
+echo "Upgrading from v${CURRENT_VERSION} to v${NEXT_VERSION}..."

 # sed commands in this script use -i.bak for compatibility with both GNU sed and BSD sed.

 for file in .golangci.yaml .goreleaser.yaml .mockery.yaml Makefile Procfile; do
  echo "Incrementing the major version in $file..."
-  sed -i.bak "s/github\.com\/argoproj\/argo-cd\/v${CURRENT_VERSION}/github\.com\/argoproj\/argo-cd\/v$((CURRENT_VERSION + 1))/g" "$file" && echo "  Updated $file" && rm "$file.bak"
+  sed -i.bak "s~github\.com/argoproj/argo-cd/v${CURRENT_VERSION}~github\.com/argoproj/argo-cd/v${NEXT_VERSION}~g" "$file" && echo "  Updated $file" && rm "$file.bak"
 done

 for file in hack/generate-proto.sh hack/update-codegen.sh hack/update-openapi.sh; do
  echo "Incrementing the major version in $file..."
-  sed -i.bak "s/v${CURRENT_VERSION}/v$((CURRENT_VERSION + 1))/g" "$file" && echo "  Update $file" && rm "$file.bak"
+  sed -i.bak "s~v${CURRENT_VERSION}~v${NEXT_VERSION}~g" "$file" && echo "  Update $file" && rm "$file.bak"
 done

 echo "Incrementing the major version in proto files..."
-find . -name '*.proto' -not -path "./vendor/*" -not -path "./dist/*" -exec sed -i.bak "s/github\.com\/argoproj\/argo-cd\/v${CURRENT_VERSION}/github\.com\/argoproj\/argo-cd\/v$((CURRENT_VERSION + 1))/g" {} \; -exec echo "  Updated" {} \; -exec rm {}.bak \;
-find . -name '*.proto' -not -path "./vendor/*" -not -path "./dist/*" -exec sed -i.bak "s/github\.com\.argoproj\.argo_cd\.v${CURRENT_VERSION}/github\.com\.argoproj\.argo_cd\.v$((CURRENT_VERSION + 1))/g" {} \; -exec echo "  Updated" {} \; -exec rm {}.bak \;
+find . -name '*.proto' -not -path "./vendor/*" -not -path "./dist/*" -exec sed -i.bak "s~github\.com/argoproj/argo-cd/v${CURRENT_VERSION}~github\.com/argoproj/argo-cd/v${NEXT_VERSION}~g" {} \; -exec echo "  Updated" {} \; -exec rm {}.bak \;
+find . -name '*.proto' -not -path "./vendor/*" -not -path "./dist/*" -exec sed -i.bak "s~github\.com\.argoproj\.argo_cd\.v${CURRENT_VERSION}~github\.com\.argoproj\.argo_cd\.v${NEXT_VERSION}~g" {} \; -exec echo "  Updated" {} \; -exec rm {}.bak \;

 echo "Incrementing the major version in go files..."
-find . -name '*.go' -not -path "./vendor/*" -not -path "./dist/*" -exec sed -i.bak "s/github\.com\/argoproj\/argo-cd\/v${CURRENT_VERSION}/github\.com\/argoproj\/argo-cd\/v$((CURRENT_VERSION + 1))/g" {} \; -exec echo "  Updated" {} \; -exec rm {}.bak \;
+find . -name '*.go' -not -path "./vendor/*" -not -path "./dist/*" -exec sed -i.bak "s~github\.com/argoproj/argo-cd/v${CURRENT_VERSION}~github\.com/argoproj/argo-cd/v${NEXT_VERSION}~g" {} \; -exec echo "  Updated" {} \; -exec rm {}.bak \;

 echo "Incrementing the major version in go.mod..."
-sed -i.bak "s/github\.com\/argoproj\/argo-cd\/v${CURRENT_VERSION}/github\.com\/argoproj\/argo-cd\/v$((CURRENT_VERSION + 1))/g" go.mod && echo "  Updated go.mod" && rm go.mod.bak
+sed -i.bak "s~github\.com/argoproj/argo-cd/v${CURRENT_VERSION}~github\.com/argoproj/argo-cd/v${NEXT_VERSION}~g" go.mod && echo "  Updated go.mod" && rm go.mod.bak

+# shellcheck disable=SC2016
 echo 'Finished! Now run `make codegen-local && make lint-local && make test-local` to ensure everything is working as expected.'
--- a/hack/generate-actions-list.sh
+++ b/hack/generate-actions-list.sh
@@ -1,3 +1,6 @@
 #!/usr/bin/env bash
-
-find resource_customizations -name action.lua | sed 's/resource_customizations\/\(.*\)\/actions\/\(.*\)\/action.lua/- [\1\/\2](https:\/\/github.com\/argoproj\/argo-cd\/blob\/master\/resource_customizations\/\1\/actions\/\2\/action.lua)/' | sort | uniq > docs/operator-manual/resource_actions_builtin.md
+find resource_customizations -name action.lua \
+    | sed 's~resource_customizations/\(.*\)/actions/\(.*\)/action.lua~- [\1/\2](https://github.com/argoproj/argo-cd/blob/master/resource_customizations/\1/actions/\2/action.lua)~' \
+    | sort \
+    | uniq \
+    > docs/operator-manual/resource_actions_builtin.md
--- a/hack/generate-mock.sh
+++ b/hack/generate-mock.sh
@@ -15,4 +15,4 @@ PATH="${PROJECT_ROOT}/dist:${PATH}"
 # output tool versions
 mockery version

-mockery --config ${PROJECT_ROOT}/.mockery.yaml
+mockery --config "${PROJECT_ROOT}"/.mockery.yaml
--- a/hack/goreman-start.sh
+++ b/hack/goreman-start.sh
@@ -2,13 +2,13 @@

 declare -a services=("controller" "api-server" "redis" "repo-server" "cmp-server" "ui" "applicationset-controller" "commit-server" "notification" "dex" "git-server" "helm-registry" "dev-mounter")

-EXCLUDE=$exclude
+EXCLUDE="$exclude"

 declare -a servicesToRun=()

 if [ "$EXCLUDE" != "" ]; then
-    # Parse services list by ',' character
-    servicesToExclude=($(echo "$EXCLUDE" | tr ',' '\n'))
+    # Split services list by ',' character
+    readarray -t servicesToExclude < <(tr ',' '\n' <<< "$EXCLUDE")

    # Find subset of items from services array that not include servicesToExclude items
    for element in "${services[@]}"
@@ -21,17 +21,16 @@ if [ "$EXCLUDE" != "" ]; then
          fi
        done
        if [[ "$found" == false ]]; then
-          servicesToRun+=($element)
+          servicesToRun+=("$element")
        fi
    done
 fi

-command="goreman start "
+command=("goreman" "start")

 for element in "${servicesToRun[@]}"
 do
-  command+=$element
-  command+=" "
+  command+=("$element")
 done

-eval $command
+"${command[@]}"
--- a/hack/gpg-wrapper.sh
+++ b/hack/gpg-wrapper.sh
@@ -1,19 +1,18 @@
 #!/bin/sh
 # Simple wrapper around gpg to prevent exit code != 0
-ARGS=$*
-OUTPUT=$(gpg $ARGS 2>&1)
+OUTPUT=$(gpg "$@" 2>&1)
 IFS=''
 RET=$?
 case "$RET" in
 0)
-	echo $OUTPUT
+	echo "$OUTPUT"
 	;;
 1)
-	echo $OUTPUT
+	echo "$OUTPUT"
 	RET=0
 	;;
 *)
-	echo $OUTPUT >&2
+	echo "$OUTPUT" >&2
 	;;
 esac
 exit $RET
--- a/hack/install.sh
+++ b/hack/install.sh
@@ -22,6 +22,6 @@ case "${unameOut}" in
    Darwin*)    INSTALL_OS=darwin;;
 esac

-for product in $*; do
-  ARCHITECTURE=$ARCHITECTURE INSTALL_OS=$INSTALL_OS "$(dirname $0)/installers/install-${product}.sh"
+for product in "$@"; do
+  ARCHITECTURE=$ARCHITECTURE INSTALL_OS=$INSTALL_OS "$(dirname "$0")/installers/install-${product}.sh"
 done
--- a/hack/installers/checksums/add-helm-checksums.sh
+++ b/hack/installers/checksums/add-helm-checksums.sh
@@ -8,12 +8,12 @@ for arch in amd64 arm64 ppc64le s390x; do
  checksumfile="helm-v$1-linux-$arch.tar.gz.sha256"
  wget "https://get.helm.sh/helm-v$1-linux-$arch.tar.gz.sha256sum" -O "$checksumfile"
  outname="$(git rev-parse --show-toplevel)/hack/installers/checksums/helm-v$1-linux-$arch.tar.gz.sha256"
-  mv $checksumfile  $outname
+  mv "$checksumfile" "$outname"
 done

 for arch in amd64 arm64; do
  checksumfile="helm-v$1-darwin-$arch.tar.gz.sha256"
  wget "https://get.helm.sh/helm-v$1-darwin-$arch.tar.gz.sha256sum" -O "$checksumfile"
  outname="$(git rev-parse --show-toplevel)/hack/installers/checksums/helm-v$1-darwin-$arch.tar.gz.sha256"
-  mv $checksumfile  $outname
+  mv "$checksumfile" "$outname"
 done
--- a/hack/installers/checksums/add-kustomize-checksums.sh
+++ b/hack/installers/checksums/add-kustomize-checksums.sh
@@ -9,7 +9,7 @@ wget "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2
 while IFS="" read -r line || [ -n "$line" ]
 do
  filename=$(echo "$line" | awk -F ' ' '{print $2}' | sed "s#v$1#$1#")
-  test "${line#*windows}" == "$line" && echo "$line" | sed "s#v$1#$1#" > "$filename.sha256"
+  test "${line#*windows}" = "$line" && echo "$line" | sed "s#v$1#$1#" > "$filename.sha256"
 done < checksums.txt

 rm checksums.txt
--- a/hack/installers/checksums/add-oras-checksums.sh
+++ b/hack/installers/checksums/add-oras-checksums.sh
@@ -7,7 +7,7 @@ wget "https://github.com/oras-project/oras/releases/download/v$1/oras_$1_checksu
 while IFS="" read -r line || [ -n "$line" ]
 do
  filename=$(echo "$line" | awk -F ' ' '{print $2}' | sed "s#v$1#$1#")
-  test "${line#*windows}" == "$line" && echo "$line" | sed "s#v$1#$1#" > "$filename.sha256"
-done < oras_$1_checksums.txt
+  test "${line#*windows}" = "$line" && echo "$line" | sed "s#v$1#$1#" > "$filename.sha256"
+done < "oras_$1_checksums.txt"

-rm oras_$1_checksums.txt
+rm "oras_$1_checksums.txt"
--- a/hack/installers/compare-chksum.sh
+++ b/hack/installers/compare-chksum.sh
@@ -6,7 +6,7 @@ if test "${TARGET_FILE}" = ""; then
 	exit 1
 fi

-CHKSUM_FILE=$(cd "$(dirname "$0")" && pwd)/checksums/${TARGET_FILE}.sha256
+CHKSUM_FILE="$(cd "$(dirname "$0")" && pwd)/checksums/${TARGET_FILE}.sha256"

 cd "${DOWNLOADS}" || (
 	echo "Can't change directory to ${DOWNLOAD}" >&2
@@ -18,9 +18,9 @@ if ! test -f "${TARGET_FILE}"; then
 	exit 1
 fi

-if ! grep -q "${TARGET_FILE}" ${CHKSUM_FILE}; then
+if ! grep -q "${TARGET_FILE}" "${CHKSUM_FILE}"; then
 	echo "No checksum for ${TARGET_FILE} in ${CHKSUM_FILE}" >&2
 	exit 1
 fi

-shasum -a 256 -c ${CHKSUM_FILE}
+shasum -a 256 -c "${CHKSUM_FILE}"
--- a/hack/installers/install-codegen-go-tools.sh
+++ b/hack/installers/install-codegen-go-tools.sh
@@ -6,20 +6,20 @@ SRCROOT="$( CDPATH='' cd -- "$(dirname "$0")/../.." && pwd -P )"
 # This script installs all our golang-based codegen utility CLIs necessary for codegen.
 # Some dependencies are vendored in go.mod (ones which are actually imported in our codebase).
 # Other dependencies are only used as a CLI and do not need vendoring in go.mod (doing so adds
-# unecessary dependencies to go.mod). We want to maintain a single source of truth for versioning
+# unnecessary dependencies to go.mod). We want to maintain a single source of truth for versioning
 # our binaries (either go.mod or go install <pkg>@<version>), so we use two techniques to install
 # our CLIs:
 # 1. For CLIs which are NOT vendored in go.mod, we can run `go install <pkg>@<version>` with an explicit version
 # 2. For packages which we *do* vendor in go.mod, we determine version from go.mod followed by `go install` with that version
 go_mod_install() {
-    module=$(go list -f '{{.Module}}' $1 | awk '{print $1}')
-    module_version=$(go list -m $module | awk '{print $NF}' | head -1)
-    go install $1@$module_version
+    module=$(go list -f '{{.Module}}' "$1" | awk '{print $1}')
+    module_version=$(go list -m "$module" | awk '{print $NF}' | head -1)
+    go install "$1@$module_version"
 }

 # All binaries are compiled into the argo-cd/dist directory, which is added to the PATH during codegen
 export GOBIN="${SRCROOT}/dist"
-mkdir -p $GOBIN
+mkdir -p "$GOBIN"

 # protoc-gen-go* is used to generate <service>.pb.go from .proto files
 # go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.0
@@ -53,6 +53,7 @@ go install github.com/go-swagger/go-swagger/cmd/swagger@v0.28.0
 # goimports is used to auto-format generated code
 go install golang.org/x/tools/cmd/goimports@v0.1.8

+# mockery is used to generate mock
 # renovate: datasource=go packageName=github.com/vektra/mockery/v3
 MOCKERY_VERSION=3.5.0
 go install github.com/vektra/mockery/v3@v${MOCKERY_VERSION}
--- a/hack/installers/install-codegen-tools.sh
+++ b/hack/installers/install-codegen-tools.sh
@@ -1,4 +1,4 @@
 #!/bin/bash
 set -eux -o pipefail

-KUSTOMIZE_VERSION=5.4.3 "$(dirname $0)/../install.sh" helm kustomize protoc
+KUSTOMIZE_VERSION=5.4.3 "$(dirname "$0")/../install.sh" helm kustomize protoc
--- a/hack/installers/install-gotestsum.sh
+++ b/hack/installers/install-gotestsum.sh
@@ -3,11 +3,11 @@ set -eux -o pipefail

 # Code from: https://github.com/argoproj/argo-rollouts/blob/f650a1fd0ba7beb2125e1598410515edd572776f/hack/installers/install-dev-tools.sh

-PROJECT_ROOT=$(cd $(dirname ${BASH_SOURCE})/../..; pwd)
+PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")"/../..; pwd)
 INSTALL_PATH="${BIN:-$INSTALL_PATH}"
 INSTALL_PATH="${INSTALL_PATH:-$PROJECT_ROOT/dist}"
 PATH="${INSTALL_PATH}:${PATH}"
-[ -d $INSTALL_PATH ] || mkdir -p $INSTALL_PATH
+[ -d "$INSTALL_PATH" ] || mkdir -p "$INSTALL_PATH"

 # renovate: datasource=github-releases depName=gotestyourself/gotestsum packageName=gotestyourself/gotestsum
 GOTESTSUM_VERSION=1.12.3
@@ -15,13 +15,13 @@ GOTESTSUM_VERSION=1.12.3
 OS=$(go env GOOS)
 ARCH=$(go env GOARCH)

-export TARGET_FILE=gotestsum_${GOTESTSUM_VERSION}_${OS}_${ARCH}.tar.gz
+export TARGET_FILE="gotestsum_${GOTESTSUM_VERSION}_${OS}_${ARCH}.tar.gz"
 temp_path="/tmp/${TARGET_FILE}"
-url=https://github.com/gotestyourself/gotestsum/releases/download/v${GOTESTSUM_VERSION}/gotestsum_${GOTESTSUM_VERSION}_${OS}_${ARCH}.tar.gz
-[ -e ${temp_path} ] || curl -sLf --retry 3 -o ${temp_path} ${url}
+url="https://github.com/gotestyourself/gotestsum/releases/download/v${GOTESTSUM_VERSION}/gotestsum_${GOTESTSUM_VERSION}_${OS}_${ARCH}.tar.gz"
+[ -e "${temp_path}" ] || curl -sLf --retry 3 -o "${temp_path}" "${url}"

 mkdir -p /tmp/gotestsum-${GOTESTSUM_VERSION}
-tar -xvzf ${temp_path} -C /tmp/gotestsum-${GOTESTSUM_VERSION}
-sudo cp /tmp/gotestsum-${GOTESTSUM_VERSION}/gotestsum ${INSTALL_PATH}/gotestsum
-sudo chmod +x ${INSTALL_PATH}/gotestsum
+tar -xvzf "${temp_path}" -C /tmp/gotestsum-${GOTESTSUM_VERSION}
+sudo cp /tmp/gotestsum-${GOTESTSUM_VERSION}/gotestsum "${INSTALL_PATH}/gotestsum"
+sudo chmod +x "${INSTALL_PATH}/gotestsum"
 gotestsum --version
--- a/hack/installers/install-helm.sh
+++ b/hack/installers/install-helm.sh
@@ -1,12 +1,12 @@
 #!/bin/bash
 set -eux -o pipefail

-. $(dirname $0)/../tool-versions.sh
+. "$(dirname "$0")"/../tool-versions.sh

 export TARGET_FILE=helm-v${helm3_version}-${INSTALL_OS}-${ARCHITECTURE}.tar.gz

-[ -e $DOWNLOADS/${TARGET_FILE} ] || curl -sLf --retry 3 -o $DOWNLOADS/${TARGET_FILE} https://get.helm.sh/helm-v${helm3_version}-$INSTALL_OS-$ARCHITECTURE.tar.gz
-$(dirname $0)/compare-chksum.sh
-mkdir -p /tmp/helm && tar -C /tmp/helm -xf $DOWNLOADS/${TARGET_FILE}
-sudo install -m 0755 /tmp/helm/$INSTALL_OS-$ARCHITECTURE/helm $BIN/helm
+[ -e "$DOWNLOADS/${TARGET_FILE}" ] || curl -sLf --retry 3 -o "$DOWNLOADS/${TARGET_FILE}" "https://get.helm.sh/helm-v${helm3_version}-$INSTALL_OS-$ARCHITECTURE.tar.gz"
+"$(dirname "$0")"/compare-chksum.sh
+mkdir -p /tmp/helm && tar -C /tmp/helm -xf "$DOWNLOADS/${TARGET_FILE}"
+sudo install -m 0755 "/tmp/helm/$INSTALL_OS-$ARCHITECTURE/helm" "$BIN/helm"
 helm version --client
--- a/hack/installers/install-kustomize.sh
+++ b/hack/installers/install-kustomize.sh
@@ -1,17 +1,19 @@
 #!/bin/bash
 set -eux -o pipefail

-. $(dirname $0)/../tool-versions.sh
+PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")"/../..; pwd)
+INSTALLERS=$(cd "$(dirname "${BASH_SOURCE[0]}")"; pwd)
+
+. "$INSTALLERS/../tool-versions.sh"

-PROJECT_ROOT=$(cd $(dirname ${BASH_SOURCE})/../..; pwd)
 INSTALL_PATH="${BIN:-$INSTALL_PATH}"
 INSTALL_PATH="${INSTALL_PATH:-$PROJECT_ROOT/dist}"
 PATH="${INSTALL_PATH}:${PATH}"
-[ -d $INSTALL_PATH ] || mkdir -p $INSTALL_PATH
+[ -d "$INSTALL_PATH" ] || mkdir -p "$INSTALL_PATH"

 KUSTOMIZE_VERSION=${KUSTOMIZE_VERSION:-$kustomize5_version}

-if [ -z $INSTALL_OS ]; then
+if [ -z "$INSTALL_OS" ]; then
    echo "install kustomize error: unsupported operating system"
    exit 1
 fi
@@ -27,10 +29,10 @@ case $ARCHITECTURE in
      export TARGET_FILE=kustomize_${KUSTOMIZE_VERSION}_${INSTALL_OS}_${ARCHITECTURE}.tar.gz
      URL=https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_${INSTALL_OS}_$ARCHITECTURE.tar.gz
      BINNAME=kustomize
-      [ -e ${DOWNLOADS}/${TARGET_FILE} ] || curl -sLf --retry 3 -o ${DOWNLOADS}/${TARGET_FILE} "$URL"
-      $(dirname $0)/compare-chksum.sh
-      tar -C /tmp -xf ${DOWNLOADS}/${TARGET_FILE}
-      sudo install -m 0755 /tmp/kustomize $INSTALL_PATH/$BINNAME
+      [ -e "${DOWNLOADS}/${TARGET_FILE}" ] || curl -sLf --retry 3 -o "${DOWNLOADS}/${TARGET_FILE}" "$URL"
+      "$INSTALLERS/compare-chksum.sh"
+      tar -C /tmp -xf "${DOWNLOADS}/${TARGET_FILE}"
+      sudo install -m 0755 /tmp/kustomize "$INSTALL_PATH/$BINNAME"
      ;;
  *)
    case $KUSTOMIZE_VERSION in
@@ -38,21 +40,21 @@ case $ARCHITECTURE in
        export TARGET_FILE=kustomize_${KUSTOMIZE_VERSION}_${INSTALL_OS}_${ARCHITECTURE}
        URL=https://github.com/kubernetes-sigs/kustomize/releases/download/v${KUSTOMIZE_VERSION}/kustomize_${KUSTOMIZE_VERSION}_${INSTALL_OS}_$ARCHITECTURE
        BINNAME=kustomize2
-        [ -e ${DOWNLOADS}/${TARGET_FILE} ] || curl -sLf --retry 3 -o ${DOWNLOADS}/${TARGET_FILE} "$URL"
-        $(dirname $0)/compare-chksum.sh
-        sudo install -m 0755 ${DOWNLOADS}/${TARGET_FILE} $INSTALL_PATH/$BINNAME
+        [ -e "${DOWNLOADS}/${TARGET_FILE}" ] || curl -sLf --retry 3 -o "${DOWNLOADS}/${TARGET_FILE}" "$URL"
+        "$INSTALLERS/compare-chksum.sh"
+        sudo install -m 0755 "${DOWNLOADS}/${TARGET_FILE}" "$INSTALL_PATH/$BINNAME"
        ;;
      *)
        export TARGET_FILE=kustomize_${KUSTOMIZE_VERSION}_${INSTALL_OS}_${ARCHITECTURE}.tar.gz
        URL=https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize/v${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_${INSTALL_OS}_$ARCHITECTURE.tar.gz
        BINNAME=kustomize
-        [ -e ${DOWNLOADS}/${TARGET_FILE} ] || curl -sLf --retry 3 -o ${DOWNLOADS}/${TARGET_FILE} "$URL"
-        $(dirname $0)/compare-chksum.sh
-        tar -C /tmp -xf ${DOWNLOADS}/${TARGET_FILE}
-        sudo install -m 0755 /tmp/kustomize $INSTALL_PATH/$BINNAME
+        [ -e "${DOWNLOADS}/${TARGET_FILE}" ] || curl -sLf --retry 3 -o "${DOWNLOADS}/${TARGET_FILE}" "$URL"
+        "$INSTALLERS/compare-chksum.sh"
+        tar -C /tmp -xf "${DOWNLOADS}/${TARGET_FILE}"
+        sudo install -m 0755 /tmp/kustomize "$INSTALL_PATH/$BINNAME"
        ;;
    esac
    ;;
 esac

-$BINNAME version
+"$BINNAME" version
--- a/hack/installers/install-protoc.sh
+++ b/hack/installers/install-protoc.sh
@@ -1,11 +1,11 @@
 #!/bin/bash
 set -eux -o pipefail

-PROJECT_ROOT=$(cd $(dirname ${BASH_SOURCE})/../..; pwd)
+PROJECT_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")"/../..; pwd)
 DIST_PATH="${PROJECT_ROOT}/dist"
 PATH="${DIST_PATH}:${PATH}"

-. $(dirname $0)/../tool-versions.sh
+. "$(dirname "$0")"/../tool-versions.sh

 OS=$(go env GOOS)
 case $OS in
@@ -34,14 +34,20 @@ case $OS in
    ;;
 esac

-export TARGET_FILE=protoc-${protoc_version}-${protoc_os}-${protoc_arch}.zip
-url=https://github.com/protocolbuffers/protobuf/releases/download/v${protoc_version}/protoc-${protoc_version}-${protoc_os}-${protoc_arch}.zip
-[ -e $DOWNLOADS/${TARGET_FILE} ] || curl -sLf --retry 3 -o $DOWNLOADS/${TARGET_FILE} ${url}
-$(dirname $0)/compare-chksum.sh
-mkdir -p /tmp/protoc-${protoc_version}
-unzip -o $DOWNLOADS/${TARGET_FILE} -d /tmp/protoc-${protoc_version}
-mkdir -p ${DIST_PATH}/protoc-include
-sudo install -m 0755 /tmp/protoc-${protoc_version}/bin/protoc ${DIST_PATH}/protoc
-(cd /tmp/protoc-${protoc_version}/include/ && find -- * -type d -exec install -m 0755 -d "${DIST_PATH}/protoc-include/{}" \;)
-(cd /tmp/protoc-${protoc_version}/include/ && find -- * -type f -exec install -m 0644 "/tmp/protoc-${protoc_version}/include/{}" "${DIST_PATH}/protoc-include/{}" \;)
+export TARGET_FILE="protoc-${protoc_version}-${protoc_os}-${protoc_arch}.zip"
+url="https://github.com/protocolbuffers/protobuf/releases/download/v${protoc_version}/protoc-${protoc_version}-${protoc_os}-${protoc_arch}.zip"
+[ -e "$DOWNLOADS/${TARGET_FILE}" ] || curl -sLf --retry 3 -o "$DOWNLOADS/${TARGET_FILE}" "${url}"
+"$(dirname "$0")"/compare-chksum.sh
+mkdir -p "/tmp/protoc-${protoc_version}"
+unzip -o "$DOWNLOADS/${TARGET_FILE}" -d "/tmp/protoc-${protoc_version}"
+mkdir -p "${DIST_PATH}/protoc-include"
+sudo install -m 0755 "/tmp/protoc-${protoc_version}/bin/protoc" "${DIST_PATH}/protoc"
+(
+    cd "/tmp/protoc-${protoc_version}/include/"
+    find -- * -type d -exec install -m 0755 -d "${DIST_PATH}/protoc-include/{}" \;
+)
+(
+    cd "/tmp/protoc-${protoc_version}/include/"
+    find -- * -type f -exec install -m 0644 "/tmp/protoc-${protoc_version}/include/{}" "${DIST_PATH}/protoc-include/{}" \;
+)
 protoc --version
--- a/hack/snyk-container-tests.sh
+++ b/hack/snyk-container-tests.sh
@@ -7,14 +7,14 @@ images=$(grep 'image: ' manifests/install.yaml manifests/namespace-install.yaml

 failed=false
 while IFS= read -r image; do
-  extra_args=""
+  extra_args=()
  if echo "$image" | grep "argocd"; then
    # Pass the file arg only for the Argo CD image. The file arg also gives us access to sarif output.
-    extra_args="--file=Dockerfile --sarif-file-output=/tmp/argocd-image.sarif"
+    extra_args+=("--file=Dockerfile" "--sarif-file-output=/tmp/argocd-image.sarif")
  fi

  set -x
-  if ! snyk container test "$image" --org=argoproj --severity-threshold=high $extra_args; then
+  if ! snyk container test "$image" --org=argoproj --severity-threshold=high "${extra_args[@]}"; then
    failed=true
  fi
  set +x
--- a/hack/snyk-report.sh
+++ b/hack/snyk-report.sh
@@ -107,15 +107,15 @@ for version in $versions; do
  images=$(grep 'image: ' manifests/install.yaml manifests/namespace-install.yaml manifests/ha/install.yaml | sed 's/.*image: //' | sort | uniq)

  while IFS= read -r image; do
-    extra_args=""
+    extra_args=()
    if echo "$image" | grep "argocd"; then
      # Pass the file arg only for the Argo CD image. The file arg also gives us access to sarif output.
-      extra_args="--file=Dockerfile --sarif-file-output=/tmp/${image//[\/:]/_}.sarif "
+      extra_args+=("--file=Dockerfile" "--sarif-file-output=/tmp/${image//[\/:]/_}.sarif")
    fi

    set -x
    # || [ $? == 1 ] ignores errors due to vulnerabilities.
-    snyk container test "$image" --org=argoproj "--json-file-output=/tmp/${image//[\/:]/_}.json" $extra_args || [ $? == 1 ]
+    snyk container test "$image" --org=argoproj "--json-file-output=/tmp/${image//[\/:]/_}.json" "${extra_args[@]}" || [ $? == 1 ]
    set +x

    snyk-to-html -i "/tmp/${image//[\/:]/_}.json" -o "$argocd_dir/docs/snyk/$version/${image//[\/:]/_}.html"
--- a/hack/test.sh
+++ b/hack/test.sh
@@ -13,6 +13,11 @@ if test "${ARGOCD_TEST_VERBOSE:-}" != ""; then
 	TEST_FLAGS="$TEST_FLAGS -v"
 fi

-mkdir -p $TEST_RESULTS
+mkdir -p "$TEST_RESULTS"

-GODEBUG="tarinsecurepath=0,zipinsecurepath=0" gotestsum --rerun-fails-report=rerunreport.txt --junitfile=$TEST_RESULTS/junit.xml --format=testname --rerun-fails="$RERUN_FAILS" --packages="$PACKAGES" -- -cover $TEST_FLAGS $*
+# `TEST_FLAGS` cannot be quoted as empty needs to evaluate to 0 arguments.
+# `TEST_FLAGS` cannot be turned into array without backward incompatible change of script input
+# shellcheck disable=SC2086
+GODEBUG="tarinsecurepath=0,zipinsecurepath=0" \
+    gotestsum --rerun-fails-report=rerunreport.txt --junitfile="$TEST_RESULTS/junit.xml" --format=testname \
+    --rerun-fails="$RERUN_FAILS" --packages="$PACKAGES" -- -cover $TEST_FLAGS "$@"
--- a/hack/trigger-release.sh
+++ b/hack/trigger-release.sh
@@ -33,7 +33,7 @@ echo ">> Working in release branch '${RELEASE_BRANCH}'"

 echo ">> Ensuring release branch is up to date."
 # make sure release branch is up to date
-git pull ${GIT_REMOTE} ${RELEASE_BRANCH}
+git pull "${GIT_REMOTE}" "${RELEASE_BRANCH}"

 # Check for target (version) tag in local repo
 if git tag -l | grep -q -E "^${NEW_TAG}$"; then
@@ -42,7 +42,7 @@ if git tag -l | grep -q -E "^${NEW_TAG}$"; then
 fi

 # Check for target (version) tag in remote repo
-if git ls-remote ${GIT_REMOTE} refs/tags/${NEW_TAG} | grep -q -E "${NEW_TAG}$"; then
+if git ls-remote "${GIT_REMOTE}" "refs/tags/${NEW_TAG}" | grep -q -E "${NEW_TAG}$"; then
 	echo "!! Target version tag '${NEW_TAG}' already exists in remote '${GIT_REMOTE}'" >&2
 	exit 1
 fi
@@ -50,7 +50,7 @@ fi
 echo ">> Creating new release '${NEW_TAG}' by pushing '${NEW_TAG}' to '${GIT_REMOTE}'"

 # Create new tag in local repository
-git tag ${NEW_TAG}
+git tag "${NEW_TAG}"

 # Push the new tag to remote repository
-git push ${GIT_REMOTE} ${NEW_TAG}
+git push "${GIT_REMOTE}" "${NEW_TAG}"
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -20,7 +20,7 @@ set -o nounset
 set -o pipefail

 PROJECT_ROOT=$(
-  cd $(dirname ${BASH_SOURCE})/..
+  cd "$(dirname "${BASH_SOURCE[0]}")"/..
  pwd
 )
 PATH="${PROJECT_ROOT}/dist:${PATH}"
@@ -29,11 +29,12 @@ GOPATH_PROJECT_ROOT="${GOPATH}/src/github.com/argoproj/argo-cd"

 TARGET_SCRIPT=kube_codegen.sh

-# codegen utilities are installed outside of kube_codegen.sh so remove the `go install` step in the script.
-sed -e '/go install/d' ${PROJECT_ROOT}/vendor/k8s.io/code-generator/kube_codegen.sh >${TARGET_SCRIPT}
+# codegen utilities are installed outside kube_codegen.sh so remove the `go install` step in the script.
+sed -e '/go install/d' "${PROJECT_ROOT}/vendor/k8s.io/code-generator/kube_codegen.sh" > ${TARGET_SCRIPT}

 # generate-groups.sh assumes codegen utilities are installed to GOBIN, but we just ensure the CLIs
 # are in the path and invoke them without assumption of their location
+# shellcheck disable=SC2016
 sed -i.bak -e 's#${gobin}/##g' ${TARGET_SCRIPT}

 [ -e ./v3 ] || ln -s . v3
--- a/hack/update-kubernetes-version.sh
+++ b/hack/update-kubernetes-version.sh
@@ -5,11 +5,14 @@ if [ -z "${1:-}" ]; then
  echo "Example usage: ./hack/update-kubernetes-version.sh v1.26.11"
  exit 1
 fi
-VERSION=${1#"v"}
-MODS=($(
-  curl -sS https://raw.githubusercontent.com/kubernetes/kubernetes/v${VERSION}/go.mod |
+
+function fetch_mods() {
+  curl -sS "https://raw.githubusercontent.com/kubernetes/kubernetes/v${VERSION}/go.mod" |
    sed -n 's|.*k8s.io/\(.*\) => ./staging/src/k8s.io/.*|k8s.io/\1|p'
-))
+}
+
+VERSION=${1#"v"}
+readarray -t MODS < <(fetch_mods)
 for MOD in "${MODS[@]}"; do
  echo "Updating $MOD..." >&2
  V=$(
--- a/hack/update-manifests.sh
+++ b/hack/update-manifests.sh
@@ -10,7 +10,7 @@ AUTOGENMSG="# This is an auto-generated file. DO NOT EDIT"
 KUSTOMIZE=kustomize
 [ -f "$SRCROOT/dist/kustomize" ] && KUSTOMIZE="$SRCROOT/dist/kustomize"

-cd ${SRCROOT}/manifests/ha/base/redis-ha && ./generate.sh
+cd "${SRCROOT}/manifests/ha/base/redis-ha" && ./generate.sh

 IMAGE_NAMESPACE="${IMAGE_NAMESPACE:-quay.io/argoproj}"
 IMAGE_TAG="${IMAGE_TAG:-}"
@@ -20,7 +20,7 @@ if [ "$IMAGE_TAG" = "" ]; then
  branch=$(git rev-parse --abbrev-ref HEAD)
  if [[ $branch = release-* ]]; then
    pwd
-    IMAGE_TAG=v$(cat $SRCROOT/VERSION)
+    IMAGE_TAG=v$(cat "$SRCROOT/VERSION")
  fi
 fi
 # otherwise, use latest
@@ -29,15 +29,15 @@ if [ "$IMAGE_TAG" = "" ]; then
 fi

 $KUSTOMIZE version
-which $KUSTOMIZE
+which "$KUSTOMIZE"

-cd ${SRCROOT}/manifests/base && $KUSTOMIZE edit set image quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}
-cd ${SRCROOT}/manifests/ha/base && $KUSTOMIZE edit set image quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}
-cd ${SRCROOT}/manifests/core-install && $KUSTOMIZE edit set image quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}
+cd "${SRCROOT}/manifests/base" && $KUSTOMIZE edit set image "quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}"
+cd "${SRCROOT}/manifests/ha/base" && $KUSTOMIZE edit set image "quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}"
+cd "${SRCROOT}/manifests/core-install" && $KUSTOMIZE edit set image "quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}"

 # Because commit-server is added as a resource outside the base, we have to explicitly set the image override here.
 # If/when commit-server is added to the base, this can be removed.
-cd ${SRCROOT}/manifests/base/commit-server && $KUSTOMIZE edit set image quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}
+cd "${SRCROOT}/manifests/base/commit-server" && $KUSTOMIZE edit set image "quay.io/argoproj/argocd=${IMAGE_NAMESPACE}/argocd:${IMAGE_TAG}"

 echo "${AUTOGENMSG}" > "${SRCROOT}/manifests/install.yaml"
 $KUSTOMIZE build "${SRCROOT}/manifests/cluster-install" >> "${SRCROOT}/manifests/install.yaml"
--- a/hack/update-openapi.sh
+++ b/hack/update-openapi.sh
@@ -6,7 +6,7 @@ set -o nounset
 set -o pipefail

 PROJECT_ROOT=$(
-  cd $(dirname "$0")/..
+  cd "$(dirname "$0")/.."
  pwd
 )
 PATH="${PROJECT_ROOT}/dist:${PATH}"
@@ -19,11 +19,11 @@ VERSION="v1alpha1"
 [ -e "${GOPATH_PROJECT_ROOT}" ] || (mkdir -p "$(dirname "${GOPATH_PROJECT_ROOT}")" && ln -s "${PROJECT_ROOT}" "${GOPATH_PROJECT_ROOT}")

 openapi-gen \
-  --go-header-file ${PROJECT_ROOT}/hack/custom-boilerplate.go.txt \
+  --go-header-file "${PROJECT_ROOT}/hack/custom-boilerplate.go.txt" \
  --output-pkg github.com/argoproj/argo-cd/v3/pkg/apis/application/${VERSION} \
  --report-filename pkg/apis/api-rules/violation_exceptions.list \
  --output-dir "${GOPATH}/src" \
-  $@
+  "$@"

 [ -L "${GOPATH_PROJECT_ROOT}" ] && rm -rf "${GOPATH_PROJECT_ROOT}"
 [ -L ./v3 ] && rm -rf v3
--- a/hack/update-ssh-known-hosts.sh
+++ b/hack/update-ssh-known-hosts.sh
@@ -4,12 +4,12 @@ set -e

 KNOWN_HOSTS_FILE=$(dirname "$0")/ssh_known_hosts
 HEADER="# This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT"
-echo "$HEADER" > $KNOWN_HOSTS_FILE
-{ \
-  ssh-keyscan github.com gitlab.com bitbucket.org ssh.dev.azure.com vs-ssh.visualstudio.com && \
-  ssh-keyscan -p 443 ssh.github.com ; \
-} | sort -u >> $KNOWN_HOSTS_FILE
-chmod 0644 $KNOWN_HOSTS_FILE
+echo "$HEADER" > "$KNOWN_HOSTS_FILE"
+{
+    ssh-keyscan github.com gitlab.com bitbucket.org ssh.dev.azure.com vs-ssh.visualstudio.com
+    ssh-keyscan -p 443 ssh.github.com
+} | sort -u >> "$KNOWN_HOSTS_FILE"
+chmod 0644 "$KNOWN_HOSTS_FILE"

 # Public SSH keys can be verified at the following URLs:
 # - github.com: https://help.github.com/articles/github-s-ssh-key-fingerprints/
@@ -17,7 +17,7 @@ chmod 0644 $KNOWN_HOSTS_FILE
 # - gitlab.com: https://docs.gitlab.com/ee/user/gitlab_com/#ssh-host-keys-fingerprints
 # - bitbucket.org: https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html
 # - ssh.dev.azure.com, vs-ssh.visualstudio.com: https://docs.microsoft.com/en-us/azure/devops/repos/git/use-ssh-keys-to-authenticate?view=azure-devops
-diff - <(ssh-keygen -l -f $KNOWN_HOSTS_FILE | sort -k 3) <<EOF
+diff - <(ssh-keygen -l -f "$KNOWN_HOSTS_FILE" | sort -k 3) <<EOF
 256 SHA256:p2QAMXNIC1TJYWeIOttrVc98/R1BUFWu3/LiyKgUfQM [ssh.github.com]:443 (ECDSA)
 256 SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU [ssh.github.com]:443 (ED25519)
 3072 SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s [ssh.github.com]:443 (RSA)
--- a/hack/update-supported-versions.sh
+++ b/hack/update-supported-versions.sh
@@ -33,4 +33,4 @@ done

 git checkout "release-$argocd_current_version"

-printf "$out" > docs/operator-manual/tested-kubernetes-versions.md
+echo -en "$out" > docs/operator-manual/tested-kubernetes-versions.md
--- a/test/container/entrypoint.sh
+++ b/test/container/entrypoint.sh
@@ -2,8 +2,8 @@
 set -e

 if test "$(id -u)" == "0" -a "${USER_ID}" != ""; then
-  useradd -u ${USER_ID} -d /home/user -s /bin/bash ${USER_NAME:-default}
-  chown -R "${USER_NAME:-default}" ${GOCACHE}
+  useradd -u "${USER_ID}" -d /home/user -s /bin/bash "${USER_NAME:-default}"
+  chown -R "${USER_NAME:-default}" "${GOCACHE}"
 fi

 export PATH=$PATH:/usr/local/go/bin:/go/bin
--- a/test/container/reaper.sh
+++ b/test/container/reaper.sh
@@ -1,12 +1,12 @@
 #!/bin/sh

 # Simple helper script to kill all running processes in the container that
-# have belong to the root user.
+# belong to the root user.

 # DO NOT RUN OUTSIDE THE DOCKER CONTAINER EXECUTING ARGO CD TESTS.
 # YOU HAVE BEEN WARNED.

-somefunc() {
+cleanup() {
 	echo "Killing all processes"
 	sudo pkill -u root
 }
@@ -16,7 +16,7 @@ if test "${PWD}" != "/go/src/github.com/argoproj/argo-cd"; then
 	echo "ERROR: We don't seem to be in Docker container. Exit." >&2
 	exit 1
 fi
-trap somefunc 2 15
+trap cleanup 2 15
 while :; do
 	sleep 1
 done
--- a/test/e2e/testdata/cmp-gitsshcreds-disable-provide/generate.sh
+++ b/test/e2e/testdata/cmp-gitsshcreds-disable-provide/generate.sh
@@ -1,5 +1,5 @@
 #!/bin/bash

 FILE=$(echo "$GIT_SSH_COMMAND" | grep -oP '\-i \K[/\w]+')
-GIT_SSH_CRED_FILE_SHA=$(sha256sum ${FILE})
+GIT_SSH_CRED_FILE_SHA=$(sha256sum "${FILE}")
 echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"GitSSHCommand\":\"$GIT_SSH_COMMAND\", \"GitSSHCredsFileSHA\":\"$GIT_SSH_CRED_FILE_SHA\"}}}"
--- a/test/e2e/testdata/cmp-gitsshcreds/generate.sh
+++ b/test/e2e/testdata/cmp-gitsshcreds/generate.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
 set -e
 FILE=$(echo "$GIT_SSH_COMMAND" | grep -oP '\-i \K[/\w]+')
-GIT_SSH_CRED_FILE_SHA=$(sha256sum ${FILE})
+GIT_SSH_CRED_FILE_SHA=$(sha256sum "${FILE}")
 echo "{\"kind\": \"ConfigMap\", \"apiVersion\": \"v1\", \"metadata\": { \"name\": \"$ARGOCD_APP_NAME\", \"namespace\": \"$ARGOCD_APP_NAMESPACE\", \"annotations\": {\"GitSSHCommand\":\"$GIT_SSH_COMMAND\", \"GitSSHCredsFileSHA\":\"$GIT_SSH_CRED_FILE_SHA\"}}}"
--- a/test/fixture/testrepos/start-authenticated-helm-registry.sh
+++ b/test/fixture/testrepos/start-authenticated-helm-registry.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 export HELM_EXPERIMENTAL_OCI=1
-docker run -p 5001:5000 --rm --name authed-registry -v $(pwd)/test/fixture/testrepos/.oci-htpasswd:/etc/docker/registry/auth.htpasswd \
+docker run -p 5001:5000 --rm --name authed-registry -v "$(pwd)"/test/fixture/testrepos/.oci-htpasswd:/etc/docker/registry/auth.htpasswd \
 -e REGISTRY_AUTH="{htpasswd: {realm: localhost, path: /etc/docker/registry/auth.htpasswd}}" \
 registry
--- a/test/fixture/testrepos/start-git.sh
+++ b/test/fixture/testrepos/start-git.sh
@@ -2,5 +2,5 @@

 docker run --name e2e-git --rm -i \
    -p 2222:2222 -p 9080:9080 -p 9443:9443 -p 9444:9444 -p 9445:9445 \
-    -w /go/src/github.com/argoproj/argo-cd -v $(pwd):/go/src/github.com/argoproj/argo-cd -v /tmp:/tmp docker.io/argoproj/argo-cd-ci-builder:v1.0.0 \
+    -w /go/src/github.com/argoproj/argo-cd -v "$(pwd)":/go/src/github.com/argoproj/argo-cd -v /tmp:/tmp docker.io/argoproj/argo-cd-ci-builder:v1.0.0 \
    bash -c "goreman -f ./test/fixture/testrepos/Procfile start"
--- a/test/remote/entrypoint.sh
+++ b/test/remote/entrypoint.sh
@@ -2,8 +2,8 @@
 set -e

 if test "$(id -u)" == "0" -a "${USER_ID}" != ""; then
-  useradd -u ${USER_ID} -d /home/user -s /bin/bash ${USER_NAME:-default}
-  chown -R "${USER_NAME:-default}" ${GOCACHE}
+  useradd -u "${USER_ID}" -d /home/user -s /bin/bash "${USER_NAME:-default}"
+  chown -R "${USER_NAME:-default}" "${GOCACHE}"
 fi

 export PATH=$PATH:/usr/local/go/bin:/go/bin
--- a/test/remote/generate-permissions.sh
+++ b/test/remote/generate-permissions.sh
@@ -1,8 +1,8 @@
 #!/bin/sh

-BASEPATH=$(dirname $0)
+BASEPATH=$(dirname "$0")
 PERMFILE=${BASEPATH}/argocd-remote-permissions.yaml
-if ! test -f ${PERMFILE}; then
+if ! test -f "${PERMFILE}"; then
 	echo "ERROR: $PERMFILE does not exist." >&2
 	exit 1
 fi
@@ -27,4 +27,4 @@ sed \
 	-e "s/##CONTROLLERSANAME##/${CONTROLLERSANAME}/g" \
 	-e "s/##SERVERSANAME##/${SERVERSANAME}/g" \
 	-e "s/##NAMESPACE##/${NAMESPACE}/g" \
-	$PERMFILE 
+	"$PERMFILE"
--- a/test/remote/run-e2e-remote.sh
+++ b/test/remote/run-e2e-remote.sh
@@ -17,7 +17,7 @@ export ARGOCD_E2E_DEFAULT_TIMEOUT=30

 # Set ARGOCD_E2E_NAMESPACE to the namespace the Argo CD we're testing against is
 # running in. Defaults to "argocd-e2e"
-export ARGOCD_E2E_NAMESPACE=${ARGOCD_E2E_NAMESPACE:-argocd-e2e}
+export ARGOCD_E2E_NAMESPACE="${ARGOCD_E2E_NAMESPACE:-argocd-e2e}"

 # Name prefix the operator sets on resources created for Argo CD instance. This
 # is usually also the name of the instance itself.
@@ -29,13 +29,13 @@ export ARGOCD_E2E_K3S=true
 # Configuration for skipping certain classes of tests

 # GnuPG features not yet available with GitOps Operator
-export ARGOCD_E2E_SKIP_GPG=${ARGOCD_E2E_SKIP_GPG:-false}
+export ARGOCD_E2E_SKIP_GPG="${ARGOCD_E2E_SKIP_GPG:-false}"
 # Some tests do not work OOTB with OpenShift
-export ARGOCD_E2E_SKIP_OPENSHIFT=${ARGOCD_E2E_SKIP_OPENSHIFT:-false}
+export ARGOCD_E2E_SKIP_OPENSHIFT="${ARGOCD_E2E_SKIP_OPENSHIFT:-false}"
 # Skip Helm tests
-export ARGOCD_E2E_SKIP_HELM=${ARGOCD_E2E_SKIP_HELM:-false}
+export ARGOCD_E2E_SKIP_HELM="${ARGOCD_E2E_SKIP_HELM:-false}"
 # Skip Ksonnet tests
-export ARGOCD_E2E_SKIP_KSONNET=${ARGOCD_E2E_SKIP_KSONNET:-false}
+export ARGOCD_E2E_SKIP_KSONNET="${ARGOCD_E2E_SKIP_KSONNET:-false}"

 ## ====================================================
 # no changes below this line required
@@ -50,7 +50,7 @@ export ARGOCD_E2E_HELM_SERVICE="http://127.0.0.1:9081/helm-repo"
 export ARGOCD_E2E_GIT_SERVICE_SUBMODULE="http://127.0.0.1:9081/argo-e2e/submodule.git"
 export ARGOCD_E2E_GIT_SERVICE_SUBMODULE_PARENT="http://127.0.0.1:9081/argo-e2e/submoduleParent.git"

-# URLs used during testing - usually no need to change thos
+# URLs used during testing - usually no need to change those
 export ARGOCD_E2E_REPO_SSH="ssh://root@argocd-e2e-server:2222/tmp/argo-e2e/testdata.git"
 export ARGOCD_E2E_REPO_SSH_SUBMODULE="ssh://root@argocd-e2e-server:2222/tmp/argo-e2e/submodule.git"
 export ARGOCD_E2E_REPO_SSH_SUBMODULE_PARENT="ssh://root@argocd-e2e-server:2222/tmp/argo-e2e/submoduleParent.git"
@@ -61,4 +61,4 @@ export ARGOCD_E2E_REPO_HTTPS_SUBMODULE_PARENT="https://argocd-e2e-server:9443/ar
 export ARGOCD_E2E_REPO_HELM="https://argocd-e2e-server:9444/helm-repo"
 export ARGOCD_E2E_REPO_DEFAULT="http://argocd-e2e-server:9081/argo-e2e/testdata.git"

-$*
+"$@"
--- a/ui/scripts/build_docker.sh
+++ b/ui/scripts/build_docker.sh
@@ -4,9 +4,9 @@ set -e

 TAG=${IMAGE_TAG:-'latest'}

-docker build --build-arg ARGO_VERSION=${TAG} -t ${IMAGE_NAMESPACE:-$(whoami)}/argocd-ui:${TAG} .
+docker build --build-arg ARGO_VERSION="${TAG}" -t "${IMAGE_NAMESPACE:-$(whoami)}/argocd-ui:${TAG}" .

 if [ "$DOCKER_PUSH" == "true" ]
 then
-    docker push ${IMAGE_NAMESPACE:-$(whoami)}/argocd-ui:${TAG}
+    docker push "${IMAGE_NAMESPACE:-$(whoami)}/argocd-ui:${TAG}"
 fi