diff --git a/.buildscript/check_git_clean.sh b/.buildscript/check_git_clean.sh
index 8668c07c9d..1ffa522f07 100755
--- a/.buildscript/check_git_clean.sh
+++ b/.buildscript/check_git_clean.sh
@@ -1,3 +1,5 @@
+#!/bin/sh -eux
+
 if [ -n "$(git status --porcelain)" ]; then
   echo 'warning: source tree contains uncommitted changes; .gitignore patterns may need to be fixed'
   git status
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 185735733e..11bcff71e7 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -53,6 +53,11 @@ jobs:
         uses: gradle/gradle-build-action@v2
         with:
           arguments: build
+      - name: Run shellcheck
+        uses: gradle/gradle-build-action@v2
+        with:
+          arguments: shellcheck
+        if: runner.os == 'Linux'
       - name: Report jacoco coverage
         uses: gradle/gradle-build-action@v2
         env:
diff --git a/.github/workflows/get_repo_details.sh b/.github/workflows/get_repo_details.sh
index 55521665f4..fc448af858 100644
--- a/.github/workflows/get_repo_details.sh
+++ b/.github/workflows/get_repo_details.sh
@@ -16,5 +16,5 @@ REPO_FULL_NAME=$(echo "$PR_DETAILS" | jq -r .head.repo.full_name)
 BRANCH_NAME=$(echo "$PR_DETAILS" | jq -r .head.ref)
 
 # Export vars to GITHUB_ENV so they can be used by later scripts
-echo "REPO_FULL_NAME=$REPO_FULL_NAME" >> $GITHUB_ENV
-echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+echo "REPO_FULL_NAME=$REPO_FULL_NAME" >> "$GITHUB_ENV"
+echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
diff --git a/.github/workflows/run_gcp_benchmarks.sh b/.github/workflows/run_gcp_benchmarks.sh
index 059e72c4f6..9dc8604f87 100644
--- a/.github/workflows/run_gcp_benchmarks.sh
+++ b/.github/workflows/run_gcp_benchmarks.sh
@@ -7,14 +7,14 @@ chmod +x ./.github/workflows/gcloud_ssh.sh
 ./.github/workflows/gcloud_ssh.sh "export BRANCH_NAME=${BRANCH_NAME} && mkdir $BRANCH_NAME"
 
 # Using gcloud compute scp to copy the bash scripts that will run the benchmarks onto the GCCE
-gcloud compute scp ./.github/workflows/run_pr_benchmarks.sh root@nullway-jmh:$BRANCH_NAME/ --zone=us-central1-a
-gcloud compute scp ./.github/workflows/run_main_benchmarks.sh root@nullway-jmh:$BRANCH_NAME/ --zone=us-central1-a
+gcloud compute scp ./.github/workflows/run_pr_benchmarks.sh root@nullway-jmh:"$BRANCH_NAME/" --zone=us-central1-a
+gcloud compute scp ./.github/workflows/run_main_benchmarks.sh root@nullway-jmh:"$BRANCH_NAME/" --zone=us-central1-a
 
 # Running the benchmark script for the pull request branch and main branch on GCCE
 ./.github/workflows/gcloud_ssh.sh " export BRANCH_NAME=${BRANCH_NAME} && export REPO_NAME=${REPO_FULL_NAME} && chmod +x $BRANCH_NAME/run_pr_benchmarks.sh && $BRANCH_NAME/run_pr_benchmarks.sh && cd && chmod +x $BRANCH_NAME/run_main_benchmarks.sh && $BRANCH_NAME/run_main_benchmarks.sh"
 
 # Copying the benchmark results from GCCE back to the Github runner for the PR branch
-gcloud compute scp root@nullway-jmh:$BRANCH_NAME/pr/NullAway/jmh/build/results/jmh/results.txt ./pr_text.txt --zone=us-central1-a
+gcloud compute scp root@nullway-jmh:"$BRANCH_NAME/pr/NullAway/jmh/build/results/jmh/results.txt" ./pr_text.txt --zone=us-central1-a
 
 # Copying the benchmark results from GCCE back to the Github runner for the main branch
-gcloud compute scp root@nullway-jmh:$BRANCH_NAME/main/NullAway/jmh/build/results/jmh/results.txt ./main_text.txt --zone=us-central1-a
+gcloud compute scp root@nullway-jmh:"$BRANCH_NAME/main/NullAway/jmh/build/results/jmh/results.txt" ./main_text.txt --zone=us-central1-a
diff --git a/.github/workflows/run_main_benchmarks.sh b/.github/workflows/run_main_benchmarks.sh
index 27d58187aa..fad59dcd0d 100644
--- a/.github/workflows/run_main_benchmarks.sh
+++ b/.github/workflows/run_main_benchmarks.sh
@@ -1,9 +1,9 @@
-#!/bin/bash
+#!/bin/bash -eux
 
-cd $BRANCH_NAME/
+cd "$BRANCH_NAME/" 
 mkdir main
-cd main/
+cd main/ 
 git clone git@github.com:Uber/NullAway.git
-cd NullAway/
+cd NullAway/ 
 
 ./gradlew jmh --no-daemon
diff --git a/.github/workflows/run_pr_benchmarks.sh b/.github/workflows/run_pr_benchmarks.sh
index 0627db598c..83c4a3b20d 100644
--- a/.github/workflows/run_pr_benchmarks.sh
+++ b/.github/workflows/run_pr_benchmarks.sh
@@ -1,9 +1,9 @@
-#!/bin/bash
+#!/bin/bash -eux
 
-cd $BRANCH_NAME/
+cd "$BRANCH_NAME/" 
 mkdir pr
-cd pr/
-git clone --branch $BRANCH_NAME --single-branch git@github.com:$REPO_NAME.git NullAway
-cd NullAway/
+cd pr/ 
+git clone --branch "$BRANCH_NAME" --single-branch git@github.com:"$REPO_NAME".git NullAway
+cd NullAway/ 
 
 ./gradlew jmh --no-daemon
diff --git a/build.gradle b/build.gradle
index 07f6250836..fd309c61fb 100644
--- a/build.gradle
+++ b/build.gradle
@@ -41,6 +41,7 @@ plugins {
   id "com.github.kt3k.coveralls" version "2.12.0" apply false
   id "me.champeau.jmh" version "0.7.1" apply false
   id "com.github.ben-manes.versions" version "0.47.0"
+  id "com.felipefzdz.gradle.shellcheck" version "1.4.6"
 }
 
 repositories {
@@ -121,6 +122,16 @@ spotless {
 spotlessPredeclare {
     java { googleJavaFormat('1.17.0') }
 }
+
+shellcheck {
+    useDocker = false
+    shellcheckBinary = "shellcheck"
+    sourceFiles =
+            fileTree(".") {
+                include("**/*.sh")
+            }
+}
+
 ////////////////////////////////////////////////////////////////////////
 //
 //  Google Java Format pre-commit hook installation