diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 00000000000..6a142fc066f
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,16 @@
+name: Shell Check All Scripts
+
+on:
+  pull_request:
+    branches: "*"
+
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Run ShellCheck
+      uses: ludeeus/action-shellcheck@master
+      with:
+        ignore_paths: vendor
diff --git a/cmd/sealer/test/apply.sh b/cmd/sealer/test/apply.sh
index 5dd20098e84..e3ab0c28b5b 100644
--- a/cmd/sealer/test/apply.sh
+++ b/cmd/sealer/test/apply.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 # Copyright © 2021 Alibaba Group Holding Ltd.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/cmd/sealer/test/delete.sh b/cmd/sealer/test/delete.sh
index c60085989a4..2c11a2572b2 100644
--- a/cmd/sealer/test/delete.sh
+++ b/cmd/sealer/test/delete.sh
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # Copyright © 2021 Alibaba Group Holding Ltd.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
diff --git a/hack/autobuild.sh b/hack/autobuild.sh
index 861a97de762..eedeba406a9 100644
--- a/hack/autobuild.sh
+++ b/hack/autobuild.sh
@@ -23,12 +23,12 @@ arch=$2
 echo "arch: $arch"
 wget http://sealer.oss-cn-beijing.aliyuncs.com/auto-build/rootfs.tar.gz
 tar -xvf rootfs.tar.gz
-wget https://dl.k8s.io/$version/kubernetes-server-linux-$arch.tar.gz
+wget https://dl.k8s.io/"$version"/kubernetes-server-linux-"$arch".tar.gz
 tar -xvf kubernetes-server-linux-$arch.tar.gz
 sudo cp ./kubernetes/server/bin/kubectl ./rootfs/bin/
 sudo cp ./kubernetes/server/bin/kubeadm ./rootfs/bin/
 sudo cp ./kubernetes/server/bin/kubelet ./rootfs/bin/
-wget https://dl.k8s.io/$version/kubernetes-server-linux-amd64.tar.gz
+wget https://dl.k8s.io/"$version"/kubernetes-server-linux-amd64.tar.gz
 tar -xvf kubernetes-server-linux-amd64.tar.gz
 wget http://sealer.oss-cn-beijing.aliyuncs.com/auto-build/sealer.tar.gz
 sudo tar -xvf sealer.tar.gz -C /usr/bin
@@ -36,5 +36,5 @@ sudo sed -i "s/v1.20.14/$version/g" ./rootfs/etc/kubeadm.yml
 sudo sed -i "s/v1.20.14/$version/g" ./rootfs/Metadata
 sudo sed -i "s/amd64/$arch/g" ./rootfs/Metadata
 sudo ./kubernetes/server/bin/kubeadm config images list --config ./rootfs/etc/kubeadm.yml 2>/dev/null>>./rootfs/imageList
-cd ./rootfs
-sudo sealer build -f Kubefile -m lite -t kubernetes:$version .
\ No newline at end of file
+cd ./rootfs || exit
+sudo sealer build -f Kubefile -m lite -t kubernetes:"$version" .
\ No newline at end of file
diff --git a/hack/build.sh b/hack/build.sh
index 4c9bd5e51f9..25ee9feac57 100755
--- a/hack/build.sh
+++ b/hack/build.sh
@@ -41,7 +41,7 @@ get_version_vars() {
   if [[ $GIT_TAG ]]; then
     GIT_VERSION=$GIT_TAG
   fi
-  GIT_COMMIT=`git rev-parse --short HEAD || true`
+  GIT_COMMIT=$(git rev-parse --short HEAD || true)
   if [[ -z $GIT_COMMIT ]]; then
     GIT_COMMIT="0.0.0"
   fi
@@ -95,28 +95,28 @@ build_binaries() {
   get_version_vars
   goldflags="${GOLDFLAGS=-s -w} $(ldflags)"
   osarch=${1-}_${2-}
-  mkdir -p $THIS_PLATFORM_ASSETS
+  mkdir -p "$THIS_PLATFORM_ASSETS"
   tarFile="${GIT_VERSION}-${1-}-${2-}.tar.gz"
 
   debug "!!! build $osarch sealer"
-  GOOS=${1-} GOARCH=${2-} go build -o $THIS_PLATFORM_BIN/sealer/$osarch/sealer -mod vendor -ldflags "$goldflags"  $SEALER_ROOT/cmd/sealer/main.go
+  GOOS=${1-} GOARCH=${2-} go build -o "$THIS_PLATFORM_BIN"/sealer/"$osarch"/sealer -mod vendor -ldflags "$goldflags"  "$SEALER_ROOT"/cmd/sealer/main.go
   check $? "build $osarch sealer"
   debug "output bin: $THIS_PLATFORM_BIN/sealer/$osarch/sealer"
-  cd ${SEALER_ROOT}/_output/bin/sealer/$osarch/
-  tar czf sealer-$tarFile sealer
-  sha256sum sealer-$tarFile > sealer-$tarFile.sha256sum
-  mv *.tar.gz*  $THIS_PLATFORM_ASSETS/
+  cd "${SEALER_ROOT}"/_output/bin/sealer/"$osarch"/ || exit
+  tar czf sealer-"$tarFile" sealer
+  sha256sum sealer-"$tarFile" > sealer-"$tarFile".sha256sum
+  mv *.tar.gz*  "$THIS_PLATFORM_ASSETS"/
   debug "output tar.gz: $THIS_PLATFORM_ASSETS/sealer-$tarFile"
   debug "output sha256sum: $THIS_PLATFORM_ASSETS/sealer-$tarFile.sha256sum"
 
   debug "!!! build $osarch seautil"
-  GOOS=${1-} GOARCH=${2-} go build -o $THIS_PLATFORM_BIN/seautil/$osarch/seautil -mod vendor -ldflags "$goldflags"  $SEALER_ROOT/cmd/seautil/main.go
+  GOOS=${1-} GOARCH=${2-} go build -o "$THIS_PLATFORM_BIN"/seautil/"$osarch"/seautil -mod vendor -ldflags "$goldflags"  "$SEALER_ROOT"/cmd/seautil/main.go
   check $? "build $osarch seautil"
   debug "output bin: $THIS_PLATFORM_BIN/seautil/$osarch/seautil"
-  cd ${SEALER_ROOT}/_output/bin/seautil/$osarch/
-  tar czf seautil-$tarFile seautil
-  sha256sum seautil-$tarFile >  seautil-$tarFile.sha256sum
-  mv *.tar.gz*  $THIS_PLATFORM_ASSETS/
+  cd "${SEALER_ROOT}"/_output/bin/seautil/"$osarch"/ || exit
+  tar czf seautil-"$tarFile" seautil
+  sha256sum seautil-"$tarFile" >  seautil-"$tarFile".sha256sum
+  mv *.tar.gz*  "$THIS_PLATFORM_ASSETS"/
   debug "output tar.gz: $THIS_PLATFORM_ASSETS/seautil-$tarFile"
   debug "output sha256sum: $THIS_PLATFORM_ASSETS/seautil-$tarFile.sha256sum"
 
@@ -130,9 +130,9 @@ if [[ $MULTI_PLATFORM_BUILD ]]; then
    for platform in "${SEALER_SUPPORTED_PLATFORMS[@]}"; do
      OS=${platform%/*}
      ARCH=${platform##*/}
-     build_binaries $OS $ARCH
+     build_binaries "$OS" "$ARCH"
    done;
 else
-  build_binaries `go env GOOS` `go env GOARCH`
+  build_binaries "$(go env GOOS)" "$(go env GOARCH)"
 fi