diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 000000000..13d2b53a2
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,15 @@
+name: Check all shell scripts
+on: pull_request
+
+jobs:
+  shellcheck:
+    name: Run shellcheck on shell scripts
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        submodules: recursive
+    - name: Install dependencies
+      run: sudo apt-get update -y && sudo apt-get install -y shellcheck
+    - name: Run shellcheck
+      run: make check
diff --git a/Makefile b/Makefile
new file mode 100644
index 000000000..67a27b506
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,3 @@
+.PHONY: check
+check:
+	shellcheck generator/build/*.sh
diff --git a/generator/build/install.sh b/generator/build/install.sh
index 3ead8ddc5..a8b368ee0 100644
--- a/generator/build/install.sh
+++ b/generator/build/install.sh
@@ -60,6 +60,7 @@ fi
 # so instead of set -x we just echo each command ourselves
 set +x
 echo "+ source ~/.rvm/scripts/rvm"
+# shellcheck disable=SC1090
 source ~/.rvm/scripts/rvm
 
 echo "+ rvm_rubygems_version=none rvm install --autolibs=read-only ruby-1.9.3-p551 -C --without-openssl"
diff --git a/generator/build/main.sh b/generator/build/main.sh
index 8fb33c053..9bd7587a7 100644
--- a/generator/build/main.sh
+++ b/generator/build/main.sh
@@ -24,9 +24,10 @@ set -x
 # take ownersip of all files
 sudo chown -R jenkins:jenkins .
 
-export WRKDIR=`pwd`
+WRKDIR=$(pwd)
+export WRKDIR
 
-cd $WRKDIR/documentation/generator
+cd "$WRKDIR"/documentation/generator
 
 
 ### download CFEngine ###
@@ -45,9 +46,9 @@ function fetch_file() {
   fi
   local success=1                     # 1 means False in bash, 0 means True
   set +e
-  for i in `seq 1 $tries`; do
+  for i in $(seq 1 "$tries"); do
     wget "$target" -O "$destination" && success=0 && break
-    if [ $i -lt $tries ]; then
+    if [ "$i" -lt "$tries" ]; then
       sleep 10s
     fi
   done
@@ -62,21 +63,22 @@ test ! -z "$JOB_TO_UPLOAD"
 test ! -z "$PACKAGE_UPLOAD_DIRECTORY"
 test ! -z "$PACKAGE_BUILD"
 
-BUILDCACHE=http://buildcache.cfengine.com
 
 echo "Waiting for flag file to appear"
-for i in `seq 30`; do
-    wget -O- $FLAG_FILE_URL && break || true
+for i in $(seq 30); do
+    if wget -O- "$FLAG_FILE_URL"; then
+      break
+    fi
     echo "Waiting 10 sec"
     sleep 10
 done
 # check if flag file is there - if not, script will fail here
-wget -O- $FLAG_FILE_URL
+wget -O- "$FLAG_FILE_URL"
 
 echo "Detecting version"
 HUB_DIR_NAME=PACKAGES_HUB_x86_64_linux_ubuntu_18
 HUB_DIR_URL="http://buildcache.cfengine.com/packages/$PACKAGE_JOB/$PACKAGE_UPLOAD_DIRECTORY/$HUB_DIR_NAME/"
-HUB_PACKAGE_NAME="$(wget $HUB_DIR_URL -O- | sed '/\.deb/!d;s/.*"\([^"]*\.deb\)".*/\1/')"
+HUB_PACKAGE_NAME="$(wget "$HUB_DIR_URL" -O- | sed '/\.deb/!d;s/.*"\([^"]*\.deb\)".*/\1/')"
 
 fetch_file "$HUB_DIR_URL$HUB_PACKAGE_NAME" "cfengine-nova-hub.deb" 12
 
@@ -92,7 +94,7 @@ sudo chmod -R a+rX "$WRKDIR"/masterfiles
 ./_regenerate_json.sh || exit 4
 
 # Preprocess Documentation with custom macros
-./_scripts/cfdoc_preprocess.py $BRANCH || exit 5
+./_scripts/cfdoc_preprocess.py "$BRANCH" || exit 5
 
 # rvm commands are insane scripts which pollut output
 # so instead of set -x we just echo each command ourselves
@@ -100,17 +102,20 @@ set +x
 
 # since May 14 2019, we need this to run jekyll. IDK why.
 echo "+ source ~/.rvm/scripts/rvm"
+# shellcheck disable=SC1090
 source ~/.rvm/scripts/rvm
 echo "+ rvm --default use 1.9.3-p551"
 rvm --default use 1.9.3-p551
 echo "+ source ~/.profile"
 ls -lah ~
+# shellcheck disable=SC1090
 test -f ~/.profile && source ~/.profile
 echo "+ source ~/.rvm/scripts/rvm"
+# shellcheck disable=SC1090
 source ~/.rvm/scripts/rvm
 
 export LC_ALL=C.UTF-8
 
 # finally, run actual jekyll
 echo "+ bash -x ./_scripts/_run_jekyll.sh $BRANCH || exit 6"
-bash -x ./_scripts/_run_jekyll.sh $BRANCH || exit 6
+bash -x ./_scripts/_run_jekyll.sh "$BRANCH" || exit 6
diff --git a/generator/build/run.sh b/generator/build/run.sh
index 725019a6d..3ca04669d 100644
--- a/generator/build/run.sh
+++ b/generator/build/run.sh
@@ -20,8 +20,8 @@ true "${PACKAGE_JOB?undefined}"
 true "${PACKAGE_UPLOAD_DIRECTORY?undefined}"
 true "${PACKAGE_BUILD?undefined}"
 
-c=$(buildah from -v $PWD:/nt docs22)
-trap "buildah run $c bash -c 'sudo chown -R root:root /nt; sudo chmod -R a+rwX /nt'; buildah rm $c >/dev/null" EXIT
-buildah run $c bash -x documentation/generator/build/main.sh $BRANCH $PACKAGE_JOB $PACKAGE_UPLOAD_DIRECTORY $PACKAGE_BUILD
-buildah run $c bash -x documentation/generator/_scripts/_publish.sh $BRANCH
+c=$(buildah from -v "$PWD":/nt docs22)
+trap 'buildah run "$c" bash -c "sudo chown -R root:root /nt; sudo chmod -R a+rwX /nt"; buildah rm "$c" >/dev/null' EXIT
+buildah run "$c" bash -x documentation/generator/build/main.sh "$BRANCH" "$PACKAGE_JOB" "$PACKAGE_UPLOAD_DIRECTORY" "$PACKAGE_BUILD"
+buildah run "$c" bash -x documentation/generator/_scripts/_publish.sh "$BRANCH"