diff --git a/.github/workflows/.dast-nuclei-cmd-api-server.yaml b/.github/workflows/.dast-nuclei-cmd-api-server.yaml
index c170fd6bc0b..f245c9f4721 100644
--- a/.github/workflows/.dast-nuclei-cmd-api-server.yaml
+++ b/.github/workflows/.dast-nuclei-cmd-api-server.yaml
@@ -52,25 +52,27 @@ jobs:
       - name: Create URLs file for Nuclei
         run: |
           echo https://localhost:4000/ > urls.txt
-          echo https://localhost:4000/api/v1/api-server/healthcheck >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/node/jws >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/consortium/jws >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/get-prometheus-exporter-metrics >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/run-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-transaction-receipt-by-txid >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract-go-source >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-prometheus-exporter-metrics >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/deploy-contract-solidity-bytecode >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-balance >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-block >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/run-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-past-logs >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/invoke-contract >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/sign-transaction >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-prometheus-exporter-metrics >> urls.txt
-          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-besu-record >> urls.txt
+          {
+          echo https://localhost:4000/api/v1/api-server/healthcheck
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/node/jws
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/consortium/jws
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-consortium-manual/get-prometheus-exporter-metrics
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/run-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-transaction-receipt-by-txid
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract-go-source
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/deploy-contract
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-fabric/get-prometheus-exporter-metrics
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/deploy-contract-solidity-bytecode
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-balance
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-block
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/run-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-past-logs
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/invoke-contract
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/sign-transaction
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-prometheus-exporter-metrics
+          echo https://localhost:4000/api/v1/plugins/@hyperledger/cactus-plugin-ledger-connector-besu/get-besu-record
+          } >> urls.txt
 
       - name: Show file content
         run: |
@@ -83,16 +85,16 @@ jobs:
 
       - run: yarn generate-api-server-config
 
-      - run: echo "$(jq '.authorizationProtocol = "NONE"' .config.json)" > .config.json
+      - run: jq '.authorizationProtocol = "NONE"' .config.json > .config2.json && mv .config2.json .config.json
 
       - name: Install Fabric connector into the API server
         #Uncomment line 87 when the fix for the cactus-plugin-ledger-connector-fabric has been published to npm and remove live 89
         # run: echo "$(jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{"instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json)" > .config.json
         #Line 89 is a workaround for the cactus-plugin-connector-fabric issue
-        run: echo "$(jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{ "packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-ledger-connector-fabric/", "instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json)" > .config.json
+        run: jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-fabric", "type":"org.hyperledger.cactus.plugin_import_type.LOCAL", "action":"org.hyperledger.cactus.plugin_import_action.INSTALL",  "options":{ "packageSrc":"/home/runner/work/cacti/cacti/packages/cactus-plugin-ledger-connector-fabric/", "instanceId":"some-unique-fabric-connector-instance-id", "peerBinary":"/fabric-samples/bin/peer", "connectionProfile":"{}", "dockerBinary":"usr/local/bin/docker","cliContainerEnv":{"CORE_PEER_LOCALMSPID":"Org1MSP","CORE_PEER_ADDRESS":"peer0.org1.example.com:7051","CORE_PEER_MSPCONFIGPATH":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp","CORE_PEER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt","ORDERER_TLS_ROOTCERT_FILE":"/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem"},"discoveryOptions":{"enabled":true,"asLocalhost":true}}}] ' .config.json > .config2.json && mv .config2.json .config.json
 
       - name: Install Besu connector into the API server
-        run: echo "$(jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-besu","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"rpcApiHttpHost":"http://localhost:8545", "rpcApiWsHost":"ws://localhost:8546", "instanceId":"some-unique-besu-connector-instance-id"}}]' .config.json)" > .config.json
+        run: jq '.plugins += [{"packageName":"@hyperledger/cactus-plugin-ledger-connector-besu","type":"org.hyperledger.cactus.plugin_import_type.LOCAL","action":"org.hyperledger.cactus.plugin_import_action.INSTALL","options":{"rpcApiHttpHost":"http://localhost:8545", "rpcApiWsHost":"ws://localhost:8546", "instanceId":"some-unique-besu-connector-instance-id"}}]' .config.json > .config2.json && mv .config2.json .config.json
 
       - name: Run Besu all-in-one image
         run: |
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index 5457c8a748f..873290624af 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -65,4 +65,5 @@ jobs:
         echo "actionlint found ${{ steps.actionlint.outputs.total-errors }} errors"
         echo "actionlint checked ${{ steps.actionlint.outputs.total-files }} files"
         echo "actionlint cache used: ${{ steps.actionlint.outputs.cache-hit }}"
-        exit ${{ steps.actionlint.outputs.exit-code }}
+        echo "${{ steps.actionlint.outputs.exit-code }}" >&2
+        exit 1
diff --git a/.github/workflows/besu-all-in-one-publish.yaml b/.github/workflows/besu-all-in-one-publish.yaml
index e419010d3ef..7fb29015d42 100644
--- a/.github/workflows/besu-all-in-one-publish.yaml
+++ b/.github/workflows/besu-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/cacti-dev-container-vscode-publish.yaml b/.github/workflows/cacti-dev-container-vscode-publish.yaml
index 62761a4505b..c6010396bfd 100644
--- a/.github/workflows/cacti-dev-container-vscode-publish.yaml
+++ b/.github/workflows/cacti-dev-container-vscode-publish.yaml
@@ -39,7 +39,7 @@ jobs:
         run: npm install -g @devcontainers/cli@0.44.0
 
       - name: npx_yes_devcontainers_cli_build
-        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder=./ --log-level=trace --push=false --config=./.devcontainer/devcontainer.json --image-name=$IMAGE_NAME
+        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder="./" --log-level=trace --push=false --config="./.devcontainer/devcontainer.json" --image-name="$IMAGE_NAME"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -50,16 +50,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c3cb1d89769..4b92ad196ee 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -247,7 +247,7 @@ jobs:
       - name: Set env.GIT_INDEX_FILE_COUNT
         id: set_env_git_index_file_count
         run: |
-            echo "GIT_INDEX_FILE_COUNT=$(git status --porcelain | wc -l)" >> $GITHUB_ENV
+            echo "GIT_INDEX_FILE_COUNT=$(git status --porcelain | wc -l)" >> "$GITHUB_ENV"
 
       - name: Print env.GIT_INDEX_FILE_COUNT
         id: print_env_git_index_file_count
@@ -2207,7 +2207,7 @@ jobs:
       - name: npm_install_@devcontainers/cli@0.44.0
         run: npm install -g @devcontainers/cli@0.44.0
       - name: npx_yes_devcontainers_cli_build
-        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder=./ --log-level=trace --push=false --config=./.devcontainer/devcontainer.json --image-name=$IMAGE_NAME
+        run: npx --yes @devcontainers/cli@0.44.0 build --workspace-folder="./" --log-level=trace --push=false --config="./.devcontainer/devcontainer.json" --image-name="$IMAGE_NAME"
   ghcr-example-carbon-accounting:
     runs-on: ubuntu-22.04
     steps:
diff --git a/.github/workflows/cmd-api-server-publish.yaml b/.github/workflows/cmd-api-server-publish.yaml
index 1f6eacd4ecc..04bf0a16111 100644
--- a/.github/workflows/cmd-api-server-publish.yaml
+++ b/.github/workflows/cmd-api-server-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/connector-besu-publish.yaml b/.github/workflows/connector-besu-publish.yaml
index 83681456a36..d12545e5011 100644
--- a/.github/workflows/connector-besu-publish.yaml
+++ b/.github/workflows/connector-besu-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/connector-corda-server-publish.yaml b/.github/workflows/connector-corda-server-publish.yaml
index 721bb3b39de..153dcb47caa 100644
--- a/.github/workflows/connector-corda-server-publish.yaml
+++ b/.github/workflows/connector-corda-server-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/connector-fabric-publish.yaml b/.github/workflows/connector-fabric-publish.yaml
index ad04dbd6e0e..e6a47625755 100644
--- a/.github/workflows/connector-fabric-publish.yaml
+++ b/.github/workflows/connector-fabric-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml b/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml
index 70354a19b62..10443fc446a 100644
--- a/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml
+++ b/.github/workflows/corda-4-6-all-in-one-obligation-publish.yaml
@@ -35,7 +35,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -46,16 +46,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml b/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml
index 0ec2ed25105..0c77c9e4ef5 100644
--- a/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml
+++ b/.github/workflows/corda-4-7-all-in-one-obligation-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml b/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml
index 7a9b6096efc..d741092b56d 100644
--- a/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml
+++ b/.github/workflows/corda-4-8-all-in-one-obligation-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/dev-container-vscode-publish.yaml b/.github/workflows/dev-container-vscode-publish.yaml
index 554cc12aeec..d9b9e4be57d 100644
--- a/.github/workflows/dev-container-vscode-publish.yaml
+++ b/.github/workflows/dev-container-vscode-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/example-carbon-accounting-publish.yaml b/.github/workflows/example-carbon-accounting-publish.yaml
index 360f25de659..53338a53e14 100644
--- a/.github/workflows/example-carbon-accounting-publish.yaml
+++ b/.github/workflows/example-carbon-accounting-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/example-supply-chain-app-publish.yaml b/.github/workflows/example-supply-chain-app-publish.yaml
index 19a3457642c..c997ec9881a 100644
--- a/.github/workflows/example-supply-chain-app-publish.yaml
+++ b/.github/workflows/example-supply-chain-app-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/fabric-all-in-one-publish.yaml b/.github/workflows/fabric-all-in-one-publish.yaml
index f0a2108a1c4..75b3d413307 100644
--- a/.github/workflows/fabric-all-in-one-publish.yaml
+++ b/.github/workflows/fabric-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/fabric2-all-in-one-publish.yaml b/.github/workflows/fabric2-all-in-one-publish.yaml
index 85abde550e6..43d4d1c569b 100644
--- a/.github/workflows/fabric2-all-in-one-publish.yaml
+++ b/.github/workflows/fabric2-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/geth-all-in-one-publish.yaml b/.github/workflows/geth-all-in-one-publish.yaml
index 4c9b2705dbe..95be6028240 100644
--- a/.github/workflows/geth-all-in-one-publish.yaml
+++ b/.github/workflows/geth-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml b/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml
index af49b8f8bfc..3ff50361470 100644
--- a/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml
+++ b/.github/workflows/ghpkg-all-kotlin-api-clients-publish.yaml
@@ -37,8 +37,8 @@ jobs:
 
     - name: Get the latest release version
       run: |
-        export GITVERSION=$(git describe --tags | awk -F'.' '{print $$1}')
-        echo "GITVERSION=$GITVERSION" >> $GITHUB_ENV
+        export GITVERSION="$(git describe --tags | awk -F'.' '{print $$1}')"
+        echo "GITVERSION=$GITVERSION" >> "$GITHUB_ENV"
 
     - uses: actions/setup-java@v3.11.0
       with:
@@ -55,7 +55,7 @@ jobs:
     - name: build-cactus-plugin-ledger-connector-corda-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-ledger-connector-corda/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-ledger-connector-corda/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -69,7 +69,7 @@ jobs:
     - name: build-cactus-cmd-api-server-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-cmd-api-server/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-cmd-api-server/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -83,7 +83,7 @@ jobs:
     - name: build-cactus-core-api-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-core-api/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-core-api/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -97,7 +97,7 @@ jobs:
     - name: build-cactus-plugin-consortium-manual-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-consortium-manual/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-consortium-manual/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -111,7 +111,7 @@ jobs:
     - name: build-cactus-plugin-keychain-google-sm-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-google-sm/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-keychain-google-sm/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -125,7 +125,7 @@ jobs:
     - name: build-cactus-plugin-keychain-aws-sm-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-aws-sm/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-keychain-aws-sm/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -139,7 +139,7 @@ jobs:
     - name: build-cactus-plugin-keychain-azure-kv-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-azure-kv/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-keychain-azure-kv/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -153,7 +153,7 @@ jobs:
     - name: build-cactus-plugin-keychain-memory-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-memory/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-keychain-memory/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -167,7 +167,7 @@ jobs:
     - name: build-cactus-plugin-keychain-vault-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-vault/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-keychain-vault/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -181,7 +181,7 @@ jobs:
     - name: build-cactus-plugin-ledger-connector-fabric-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-ledger-connector-fabric/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-ledger-connector-fabric/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -195,7 +195,7 @@ jobs:
     - name: build-cactus-plugin-keychain-memory-wasm-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-keychain-memory-wasm/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-keychain-memory-wasm/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -209,7 +209,7 @@ jobs:
     - name: build-cactus-plugin-satp-hermes-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/packages/cactus-plugin-satp-hermes/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/packages/cactus-plugin-satp-hermes/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -223,7 +223,7 @@ jobs:
     - name: build-cactus-example-supply-chain-business-logic-plugin-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/examples/cactus-example-supply-chain-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/examples/cactus-example-supply-chain-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -237,7 +237,7 @@ jobs:
     - name: build-cactus-example-carbon-accounting-business-logic-plugin-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/examples/cactus-example-carbon-accounting-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/examples/cactus-example-carbon-accounting-business-logic-plugin/src/main/kotlin/generated/openapi/kotlin-client"
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
@@ -251,7 +251,7 @@ jobs:
     - name: build-cactus-plugin-object-store-ipfs-kotlin-client
       run: |
         WDIR=`pwd`
-        cd ${WDIR}/extensions/cactus-plugin-object-store-ipfs/src/main/kotlin/generated/openapi/kotlin-client
+        cd "${WDIR}/extensions/cactus-plugin-object-store-ipfs/src/main/kotlin/generated/openapi/kotlin-client
         chmod +x gradlew
         ./gradlew clean
         ./gradlew build
diff --git a/.github/workflows/iroha2-all-in-one-publish.yaml b/.github/workflows/iroha2-all-in-one-publish.yaml
index 47f07c50fc2..ce22ebbcf01 100644
--- a/.github/workflows/iroha2-all-in-one-publish.yaml
+++ b/.github/workflows/iroha2-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/keychain-vault-server-publish.yaml b/.github/workflows/keychain-vault-server-publish.yaml
index 2bacf8aa3eb..9131bb27f70 100644
--- a/.github/workflows/keychain-vault-server-publish.yaml
+++ b/.github/workflows/keychain-vault-server-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/quorum-all-in-one-publish.yaml b/.github/workflows/quorum-all-in-one-publish.yaml
index b119b11127a..61cd6aafe4e 100644
--- a/.github/workflows/quorum-all-in-one-publish.yaml
+++ b/.github/workflows/quorum-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/quorum-multi-party-all-in-one-publish.yaml b/.github/workflows/quorum-multi-party-all-in-one-publish.yaml
index cbea32b5f7f..983b4ee0e59 100644
--- a/.github/workflows/quorum-multi-party-all-in-one-publish.yaml
+++ b/.github/workflows/quorum-multi-party-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"
diff --git a/.github/workflows/sawtooth-all-in-one-publish.yaml b/.github/workflows/sawtooth-all-in-one-publish.yaml
index 4148c69d3b7..6b47527fa65 100644
--- a/.github/workflows/sawtooth-all-in-one-publish.yaml
+++ b/.github/workflows/sawtooth-all-in-one-publish.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v4.1.1
 
       - name: Build image
-        run: docker build $DOCKER_BUILD_DIR --file $DOCKERFILE_PATH --tag $IMAGE_NAME --label "runnumber=${GITHUB_RUN_ID}"
+        run: docker build "$DOCKER_BUILD_DIR" --file "$DOCKERFILE_PATH" --tag "$IMAGE_NAME" --label "runnumber=${GITHUB_RUN_ID}"
 
       - name: Log in to registry
         # This is where you will update the PAT to GITHUB_TOKEN
@@ -45,16 +45,16 @@ jobs:
           SHORTHASH=$(git rev-parse --short "$GITHUB_SHA")
           TODAYS_DATE="$(date +%F)"
           DOCKER_TAG="$TODAYS_DATE-$SHORTHASH"
-          IMAGE_ID=ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME
+          IMAGE_ID="ghcr.io/${{ github.repository_owner }}/$IMAGE_NAME"
           # Change all uppercase to lowercase
-          IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+          IMAGE_ID=$(echo "$IMAGE_ID" | tr '[A-Z]' '[a-z]')
           # Strip git ref prefix from version
           VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
           # Strip "v" prefix from tag name
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo "$VERSION" | sed -e 's/^v//')
           # Do not use the `latest` tag at all, tag with date + git short hash if there is no git tag
           [ "$VERSION" == "main" ] && VERSION=$DOCKER_TAG
-          echo IMAGE_ID=$IMAGE_ID
-          echo VERSION=$VERSION
-          docker tag $IMAGE_NAME $IMAGE_ID:$VERSION
-          docker push $IMAGE_ID:$VERSION
+          echo IMAGE_ID="$IMAGE_ID"
+          echo VERSION="$VERSION"
+          docker tag "$IMAGE_NAME" "$IMAGE_ID:$VERSION"
+          docker push "$IMAGE_ID:$VERSION"