diff --git a/.github/workflows/.dast-nuclei-cmd-api-server.yaml b/.github/workflows/.dast-nuclei-cmd-api-server.yaml
index c170fd6bc0..f245c9f472 100644
--- a/.github/workflows/.dast-nuclei-cmd-api-server.yaml
+++ b/.github/workflows/.dast-nuclei-cmd-api-server.yaml
@@ -52,25 +52,27 @@ jobs:
       - name: Create URLs file for Nuclei
         run: |
           echo https://localhost:4000/ > urls.txt
-          echo https://localhost:4000/api/v1/api-server/healthcheck >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/node/jws >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/consortium/jws >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/get-prometheus-exporter-metrics >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/run-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-transaction-receipt-by-txid >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract-go-source >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-prometheus-exporter-metrics >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/deploy-contract-solidity-bytecode >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-balance >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-block >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/run-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-past-logs >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/invoke-contract >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/sign-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-prometheus-exporter-metrics >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-besu-record >> urls.txt
+          {
+          echo https://localhost:4000/api/v1/api-server/healthcheck
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/node/jws
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/consortium/jws
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/get-prometheus-exporter-metrics
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/run-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-transaction-receipt-by-txid
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract-go-source
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-prometheus-exporter-metrics
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/deploy-contract-solidity-bytecode
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-balance
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-block
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/run-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-past-logs
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/invoke-contract
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/sign-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-prometheus-exporter-metrics
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-besu-record
+          } >> urls.txt
 
       - name: Show file content
         run: |
@@ -83,16 +85,16 @@ jobs:
 
       - run: yarn generate-api-server-config
 
-      - run: echo "$(jq '.authorizationProtocol = "NONE"' .config.json)" > .config.json
+      - run: jq '.authorizationProtocol = "NONE"' .config.json > .config2.json && mv .config2.json .config.json
 
       - name: Install Fabric connector into the API server
         #Uncomment line 87 when the fix for the cactus-plugin-ledger-connector-fabric has been published to npm and remove live 89
         # run: echo "$(jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{"instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json)" > .config.json
         #Line 89 is a workaround for the cactus-plugin-connector-fabric issue
-        run: echo "$(jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{ "packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-ledger-connector-fabric/", "instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json)" > .config.json
+        run: jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{ "packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-ledger-connector-fabric/", "instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json > .config2.json && mv .config2.json .config.json
 
       - name: Install Besu connector into the API server
-        run: echo "$(jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-besu","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"rpcApiHttpHost":"http://localhost:8545", "rpcApiWsHost":"ws://localhost:8546", "instanceId":"some-unique-besu-connector-instance-id"}}]' .config.json)" > .config.json
+        run: jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-besu","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"rpcApiHttpHost":"http://localhost:8545", "rpcApiWsHost":"ws://localhost:8546", "instanceId":"some-unique-besu-connector-instance-id"}}]' .config.json > .config2.json && mv .config2.json .config.json
 
       - name: Run Besu all-in-one image
         run: |
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index 5457c8a748..c075a37958 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -46,7 +46,7 @@ jobs:
     # npm ERR! this command with --force or --legacy-peer-deps
     # npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
     - name: wipe_non_yaml_sources
-      run: rm -rf packages/ examples/ extensions/ package.json
+      run: rm -rf packages/ examples/ extensions/ package.json .github/workflows/test_weaver*.yaml .github/workflows/weaver_deploy*.yml ./weaver/
 
     - name: actionlint
       id: actionlint
@@ -65,4 +65,5 @@ jobs:
         echo "actionlint found ${{ steps.actionlint.outputs.total-errors }} errors"
         echo "actionlint checked ${{ steps.actionlint.outputs.total-files }} files"
         echo "actionlint cache used: ${{ steps.actionlint.outputs.cache-hit }}"
-        exit ${{ steps.actionlint.outputs.exit-code }}
+        echo "${{ steps.actionlint.outputs.exit-code }}" >&2
+        exit 1
diff --git a/.github/workflows/besu-all-in-one-publish.yaml b/.github/workflows/besu-all-in-one-publish.yaml
index e419010d3e..bddcf5189d 100644
--- a/.github/workflows/besu-all-in-one-publish.yaml
+++ b/.github/workflows/besu-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/cacti-dev-container-vscode-publish.yaml b/.github/workflows/cacti-dev-container-vscode-publish.yaml
index 62761a4505..4e40aeb10c 100644
--- a/.github/workflows/cacti-dev-container-vscode-publish.yaml
+++ b/.github/workflows/cacti-dev-container-vscode-publish.yaml
@@ -39,7 +39,7 @@ jobs:
         run: npm install -g @devcontainers/cli@0.44.0
 
       - name: npx_yes_devcontainers_cli_build
-        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder=./ --log-level=trace --push=false --config=./.devcontainer/devcontainer.json --image-name=$IMAGE_NAME
+        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder="./" --log-level=trace --push=false --config="./.devcontainer/devcontainer.json" --image-name="$IMAGE_NAME"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -50,16 +50,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 10eb5ab64d..484fae6c80 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -258,7 +258,7 @@ jobs:
       - name: Set env.GIT_INDEX_FILE_COUNT
         id: set_env_git_index_file_count
         run: |
-            echo "GIT_INDEX_FILE_COUNT=$(git status --porcelain | wc -l)" >> $GITHUB_ENV
+            echo "GIT_INDEX_FILE_COUNT=$(git status --porcelain | wc -l)" >> "$GITHUB_ENV"
 
       - name: Print env.GIT_INDEX_FILE_COUNT
         id: print_env_git_index_file_count
@@ -1764,7 +1764,7 @@ jobs:
   #     - uses: actions/checkout@v4.1.1
   #     - id: yarn-cache-dir-path
   #       name: Get yarn cache directory path
-  #       run: echo "::set-output name=dir::$(yarn cache dir)"
+  #       run: echo "dir=$(yarn cache dir)" >> "$GITHUB_OUTPUT"
   #     - id: yarn-cache
   #       name: Restore Yarn Cache
   #       uses: actions/cache@v4.0.1
@@ -2039,7 +2039,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
       - id: yarn-cache-dir-path
         name: Get yarn cache directory path
-        run: echo "::set-output name=dir::$(yarn cache dir)"
+        run: echo "dir=$(yarn cache dir)" >> "$GITHUB_OUTPUT"
       - id: yarn-cache
         name: Restore Yarn Cache
         uses: actions/cache@v4.0.1
@@ -2251,7 +2251,7 @@ jobs:
       - name: npm_install_@devcontainers/cli@0.44.0
         run: npm install -g @devcontainers/cli@0.44.0
       - name: npx_yes_devcontainers_cli_build
-        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder=./ --log-level=trace --push=false --config=./.devcontainer/devcontainer.json --image-name=$IMAGE_NAME
+        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder="./" --log-level=trace --push=false --config="./.devcontainer/devcontainer.json" --image-name="$IMAGE_NAME"
   ghcr-example-carbon-accounting:
     runs-on: ubuntu-22.04
     steps:
diff --git a/.github/workflows/cmd-api-server-publish.yaml b/.github/workflows/cmd-api-server-publish.yaml
index 1f6eacd4ec..efc3dbde09 100644
--- a/.github/workflows/cmd-api-server-publish.yaml
+++ b/.github/workflows/cmd-api-server-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/connector-besu-publish.yaml b/.github/workflows/connector-besu-publish.yaml
index 83681456a3..6d3b14a650 100644
--- a/.github/workflows/connector-besu-publish.yaml
+++ b/.github/workflows/connector-besu-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/connector-corda-server-publish.yaml b/.github/workflows/connector-corda-server-publish.yaml
index 721bb3b39d..4b86a8c573 100644
--- a/.github/workflows/connector-corda-server-publish.yaml
+++ b/.github/workflows/connector-corda-server-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/connector-fabric-publish.yaml b/.github/workflows/connector-fabric-publish.yaml
index ad04dbd6e0..c634aa5bc8 100644
--- a/.github/workflows/connector-fabric-publish.yaml
+++ b/.github/workflows/connector-fabric-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml b/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml
index 70354a19b6..8c27d1e1bd 100644
--- a/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml
+++ b/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml
@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -46,16 +46,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml b/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml
index 0ec2ed2510..04e6f966b6 100644
--- a/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml
+++ b/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml b/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml
index 7a9b6096ef..9475536e48 100644
--- a/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml
+++ b/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/dev-container-vscode-publish.yaml b/.github/workflows/dev-container-vscode-publish.yaml
index 554cc12aee..fc67ee927c 100644
--- a/.github/workflows/dev-container-vscode-publish.yaml
+++ b/.github/workflows/dev-container-vscode-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/example-carbon-accounting-publish.yaml b/.github/workflows/example-carbon-accounting-publish.yaml
index 360f25de65..eb2f9490a1 100644
--- a/.github/workflows/example-carbon-accounting-publish.yaml
+++ b/.github/workflows/example-carbon-accounting-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/example-supply-chain-app-publish.yaml b/.github/workflows/example-supply-chain-app-publish.yaml
index 19a3457642..e0980cc825 100644
--- a/.github/workflows/example-supply-chain-app-publish.yaml
+++ b/.github/workflows/example-supply-chain-app-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/fabric-all-in-one-publish.yaml b/.github/workflows/fabric-all-in-one-publish.yaml
index f0a2108a1c..71e7db3efb 100644
--- a/.github/workflows/fabric-all-in-one-publish.yaml
+++ b/.github/workflows/fabric-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/fabric2-all-in-one-publish.yaml b/.github/workflows/fabric2-all-in-one-publish.yaml
index 85abde550e..4b0da1903c 100644
--- a/.github/workflows/fabric2-all-in-one-publish.yaml
+++ b/.github/workflows/fabric2-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/geth-all-in-one-publish.yaml b/.github/workflows/geth-all-in-one-publish.yaml
index 4c9b2705db..15bda39907 100644
--- a/.github/workflows/geth-all-in-one-publish.yaml
+++ b/.github/workflows/geth-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/gg-shield-action.yaml b/.github/workflows/gg-shield-action.yaml
index deb8d3d733..40b67f8de8 100644
--- a/.github/workflows/gg-shield-action.yaml
+++ b/.github/workflows/gg-shield-action.yaml
@@ -2,7 +2,6 @@ name: GitGuardian scan
 
 on: 
   push:
-  pull_request:
     # Publish `main` as Docker `latest` image.
     branches:
       - main
@@ -10,6 +9,9 @@ on:
     # Publish `v1.2.3` tags as releases.
     tags:
       - v*
+  pull_request:
+    branches:
+      - main
 
 jobs:
   scanning:
diff --git a/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml b/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml
index af49b8f8bf..3cf6dd7519 100644
--- a/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml
+++ b/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml
@@ -37,8 +37,9 @@ jobs:
 
     - name: Get the latest release version
       run: |
-        export GITVERSION=$(git describe --tags | awk -F'.' '{print $$1}')
-        echo "GITVERSION=$GITVERSION" >> $GITHUB_ENV
+        GITVERSION="$(git describe --tags | awk -F'.' '{print $$1}')"
+        export GITVERSION
+        echo "GITVERSION=$GITVERSION" >> "$GITHUB_ENV"
 
     - uses: actions/setup-java@v3.11.0
       with:
@@ -54,8 +55,8 @@ jobs:
 
     - name: build-cactus-plugin-ledger-connector-corda-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-ledger-connector-corda/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-ledger-connector-corda/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -68,8 +69,8 @@ jobs:
 
     - name: build-cactus-cmd-api-server-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-cmd-api-server/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-cmd-api-server/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -82,8 +83,8 @@ jobs:
 
     - name: build-cactus-core-api-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-core-api/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-core-api/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -96,8 +97,8 @@ jobs:
 
     - name: build-cactus-plugin-consortium-manual-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-consortium-manual/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-consortium-manual/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -110,8 +111,8 @@ jobs:
 
     - name: build-cactus-plugin-keychain-google-sm-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-google-sm/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-keychain-google-sm/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -124,8 +125,8 @@ jobs:
 
     - name: build-cactus-plugin-keychain-aws-sm-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-aws-sm/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-keychain-aws-sm/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -138,8 +139,8 @@ jobs:
 
     - name: build-cactus-plugin-keychain-azure-kv-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-azure-kv/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-keychain-azure-kv/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -152,8 +153,8 @@ jobs:
 
     - name: build-cactus-plugin-keychain-memory-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-memory/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-keychain-memory/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -166,8 +167,8 @@ jobs:
 
     - name: build-cactus-plugin-keychain-vault-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-vault/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-keychain-vault/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -180,8 +181,8 @@ jobs:
 
     - name: build-cactus-plugin-ledger-connector-fabric-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-ledger-connector-fabric/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-ledger-connector-fabric/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -194,8 +195,8 @@ jobs:
 
     - name: build-cactus-plugin-keychain-memory-wasm-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-memory-wasm/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-keychain-memory-wasm/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -208,8 +209,8 @@ jobs:
 
     - name: build-cactus-plugin-satp-hermes-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-satp-hermes/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/packages/cactus-plugin-satp-hermes/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -222,8 +223,8 @@ jobs:
 
     - name: build-cactus-example-supply-chain-business-logic-plugin-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/examples/cactus-example-supply-chain-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/examples/cactus-example-supply-chain-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -236,8 +237,8 @@ jobs:
 
     - name: build-cactus-example-carbon-accounting-business-logic-plugin-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/examples/cactus-example-carbon-accounting-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/examples/cactus-example-carbon-accounting-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -250,8 +251,8 @@ jobs:
 
     - name: build-cactus-plugin-object-store-ipfs-kotlin-client
       run: |
-        WDIR=`pwd`
-        cd ${WDIR}/extensions/cactus-plugin-object-store-ipfs/src/main/kotlin/generated/openapi/kotlin-client
+        WDIR=$(pwd)
+        cd "${WDIR}/extensions/cactus-plugin-object-store-ipfs/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
diff --git a/.github/workflows/iroha2-all-in-one-publish.yaml b/.github/workflows/iroha2-all-in-one-publish.yaml
index 47f07c50fc..48d94402b4 100644
--- a/.github/workflows/iroha2-all-in-one-publish.yaml
+++ b/.github/workflows/iroha2-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/keychain-vault-server-publish.yaml b/.github/workflows/keychain-vault-server-publish.yaml
index 2bacf8aa3e..80c5bbf5cf 100644
--- a/.github/workflows/keychain-vault-server-publish.yaml
+++ b/.github/workflows/keychain-vault-server-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/quorum-all-in-one-publish.yaml b/.github/workflows/quorum-all-in-one-publish.yaml
index b119b11127..0bbd413551 100644
--- a/.github/workflows/quorum-all-in-one-publish.yaml
+++ b/.github/workflows/quorum-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/quorum-multi-party-all-in-one-publish.yaml b/.github/workflows/quorum-multi-party-all-in-one-publish.yaml
index cbea32b5f7..3ea17ee938 100644
--- a/.github/workflows/quorum-multi-party-all-in-one-publish.yaml
+++ b/.github/workflows/quorum-multi-party-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/sawtooth-all-in-one-publish.yaml b/.github/workflows/sawtooth-all-in-one-publish.yaml
index 4148c69d3b..2fd1149919 100644
--- a/.github/workflows/sawtooth-all-in-one-publish.yaml
+++ b/.github/workflows/sawtooth-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[:upper:]' '[:lower:]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/*" ]] && VERSION="${VERSION//^v//}"
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"