diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
index 27b4a321d..b0b1926d6 100644
--- a/.github/workflows/android-ci.yml
+++ b/.github/workflows/android-ci.yml
@@ -216,7 +216,7 @@ jobs:
           name: uploadsEnv
 
       - name: Read uploads.env
-        run: cat uploads.env >> $GITHUB_ENV
+        run: cat uploads.env >> "$GITHUB_ENV"
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
diff --git a/.github/workflows/android-release.yml b/.github/workflows/android-release.yml
index d1ad07b4f..3c52771c0 100644
--- a/.github/workflows/android-release.yml
+++ b/.github/workflows/android-release.yml
@@ -87,7 +87,7 @@ jobs:
         run: |
           RELEASE_VERSION="$( git describe --tags --match=android-v*.*.* --abbrev=0 | sed 's/^android-v//' )"
           echo "Latest version from tag: $RELEASE_VERSION"
-          if [ ! -z "$RELEASE_VERSION" ]; then
+          if [ -n "$RELEASE_VERSION" ]; then
             sed -i -e "s/^VERSION_NAME=.*/VERSION_NAME=${RELEASE_VERSION}/" MapboxGLAndroidSDK/gradle.properties
             echo "MapboxGLAndroidSDK/gradle.properties:"
             cat MapboxGLAndroidSDK/gradle.properties
@@ -116,9 +116,9 @@ jobs:
         id: prepare_release
         run: |
           RELEASE_NOTES_PATH="${PWD}/release_notes.txt"
-          ./scripts/release-notes.js > ${RELEASE_NOTES_PATH}
-          echo release_notes=${RELEASE_NOTES_PATH} >> "$GITHUB_OUTPUT"
-          echo version_tag=$( git describe --tags --match=android-v*.*.* --abbrev=0 ) >> "$GITHUB_OUTPUT"
+          ./scripts/release-notes.js > "${RELEASE_NOTES_PATH}"
+          echo release_notes="${RELEASE_NOTES_PATH}" >> "$GITHUB_OUTPUT"
+          echo version_tag="$( git describe --tags --match=android-v*.*.* --abbrev=0 )" >> "$GITHUB_OUTPUT"
         shell: bash          
 
       - name: Create release
diff --git a/.github/workflows/cache-cleanup.yml b/.github/workflows/cache-cleanup.yml
index 15cac4555..c0fdf393a 100644
--- a/.github/workflows/cache-cleanup.yml
+++ b/.github/workflows/cache-cleanup.yml
@@ -25,14 +25,14 @@ jobs:
           BRANCH=refs/pull/${{ github.event.pull_request.number }}/merge
 
           echo "Fetching list of cache key"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
+          cacheKeysForPR="$(gh actions-cache list -R "$REPO" -B "$BRANCH" | cut -f 1 )"
 
           ## Setting this to not fail the workflow while deleting cache keys. 
           set +e
           echo "Deleting caches..."
           for cacheKey in $cacheKeysForPR
           do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
+              gh actions-cache delete "$cacheKey" -R "$REPO" -B "$BRANCH" --confirm
           done
           echo "Done"
         env:
diff --git a/.github/workflows/ios-ci.yml b/.github/workflows/ios-ci.yml
index 5281ffc3b..3468c034d 100644
--- a/.github/workflows/ios-ci.yml
+++ b/.github/workflows/ios-ci.yml
@@ -145,7 +145,7 @@ jobs:
         working-directory: ./
         run: | 
           bazel build --compilation_mode=opt //platform/ios:size --//:maplibre_platform=ios
-          cp $(bazel cquery --compilation_mode=opt --output=files //platform/ios:size --//:maplibre_platform=ios) ./size
+          cp "$(bazel cquery --compilation_mode=opt --output=files //platform/ios:size --//:maplibre_platform=ios)" ./size
 
       - name: Upload size test result
         uses: actions/upload-artifact@v3
@@ -170,7 +170,7 @@ jobs:
           mv RenderTestApp.zip RenderTestApp.ipa
           cd Payload/RenderTestApp.app/PlugIns
           zip -r "$render_test_app_dir"/RenderTest.xctest.zip RenderTest.xctest
-          echo render_test_artifacts_dir="$render_test_app_dir" >> $GITHUB_ENV
+          echo render_test_artifacts_dir="$render_test_app_dir" >> "$GITHUB_ENV"
       
       - uses: actions/upload-artifact@v3
         with:
diff --git a/.github/workflows/ios-render-test.yml b/.github/workflows/ios-render-test.yml
index e0d96887f..b1ef2e8af 100644
--- a/.github/workflows/ios-render-test.yml
+++ b/.github/workflows/ios-render-test.yml
@@ -71,16 +71,16 @@ jobs:
           max_checks=10
           sleep_time=5
 
-          check_status()
-            echo "$(aws devicefarm get-upload --arn $1 | jq -r '.upload.status')"
-          end
+          check_status() {
+            aws devicefarm get-upload --arn "$1" | jq -r '.upload.status'
+          }
 
-          for i in {1..$max_checks}; do
-            status_app=$(check_status "${{ env.app_arn }}")
-            status_test_package=$(check_status "${{ env.test_package_arn }}")
+          while ((max_checks--)); do
+            status_app="$(check_status "${{ env.app_arn }}")"
+            status_test_package="$(check_status "${{ env.test_package_arn }}")"
 
-            echo status_app=$status_app
-            echo status_test_package=$status_test_package
+            echo status_app="$status_app"
+            echo status_test_package="$status_test_package"
 
             if [[ "$status_app" == "SUCCEEDED" && "$status_test_package" == "SUCCEEDED" ]]; then
               exit 0
diff --git a/.github/workflows/linux-ci.yml b/.github/workflows/linux-ci.yml
index 31cc6fd38..3d250bfe9 100644
--- a/.github/workflows/linux-ci.yml
+++ b/.github/workflows/linux-ci.yml
@@ -209,7 +209,7 @@ jobs:
       - name: Generate coverage report
         run: |
           bazel coverage --test_output=all --combined_report=lcov --nobuild_runfile_links --local_test_jobs=1 --instrumentation_filter="//:mbgl-core" //test:core //render-test:render-test --//:maplibre_platform=linux --run_under=//platform/linux:startxwrapper
-          echo coverage_report=$(bazel info output_path)/_coverage/_coverage_report.dat >> $GITHUB_ENV
+          echo coverage_report="$(bazel info output_path)"/_coverage/_coverage_report.dat >> "$GITHUB_ENV"
 
       - name: Upload coverage report
         uses: codecov/codecov-action@v3
diff --git a/.github/workflows/macos-ci.yml b/.github/workflows/macos-ci.yml
index e6da3393a..9a981debb 100644
--- a/.github/workflows/macos-ci.yml
+++ b/.github/workflows/macos-ci.yml
@@ -88,9 +88,9 @@ jobs:
 
       - name: Run macOS C++ unit tests
         run: |
-          cmake -S . -B $BUILD_DIR
-          cmake --build $BUILD_DIR --target mbgl-test-runner
-          ctest -VV --test-dir $BUILD_DIR -R mbgl-test-runner
+          cmake -S . -B "$BUILD_DIR"
+          cmake --build "$BUILD_DIR" --target mbgl-test-runner
+          ctest -VV --test-dir "$BUILD_DIR" -R mbgl-test-runner
         env:
           BUILD_DIR: ../../../maplibre-gl-native-macostestbuild
 
diff --git a/.github/workflows/node-ci-mac.yml b/.github/workflows/node-ci-mac.yml
index 612e3e47c..9b4c49eb2 100644
--- a/.github/workflows/node-ci-mac.yml
+++ b/.github/workflows/node-ci-mac.yml
@@ -214,7 +214,7 @@ jobs:
       - name: Build maplibre-native (MacOS/Linux)
         if: runner.os == 'MacOS' || runner.os == 'Linux'
         run: |
-          cmake --build build -j $(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)
+          cmake --build build -j "$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)"
 
       - name: Build maplibre-native (Windows)
         if: runner.os == 'Windows'
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 30c921624..fcaaf607d 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -219,7 +219,7 @@ jobs:
       - name: Build maplibre-native (MacOS/Linux)
         if: runner.os == 'MacOS' || runner.os == 'Linux'
         run: |
-          cmake --build build -j $(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)
+          cmake --build build -j "$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)"
 
       - name: Build maplibre-native (Windows)
         if: runner.os == 'Windows'
diff --git a/.github/workflows/node-release.yml b/.github/workflows/node-release.yml
index c227e1c1b..cf52f7ae7 100644
--- a/.github/workflows/node-release.yml
+++ b/.github/workflows/node-release.yml
@@ -38,7 +38,7 @@ jobs:
 
       - name: npm version
         run: |
-          echo "NPM_VERSION=$(npm version ${{ github.event.inputs.version }} --preid pre --no-git-tag-version)" >> $GITHUB_ENV
+          echo "NPM_VERSION=$(npm version ${{ github.event.inputs.version }} --preid pre --no-git-tag-version)" >> "$GITHUB_ENV"
 
       - name: Push version to git
         run: |
@@ -212,7 +212,7 @@ jobs:
       - name: Build maplibre-native (MacOS/Linux)
         if: runner.os == 'MacOS' || runner.os == 'Linux'
         run: |
-          cmake --build build -j $(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)
+          cmake --build build -j "$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null)"
 
       - name: Build maplibre-native (Windows)
         if: runner.os == 'Windows'
@@ -262,7 +262,7 @@ jobs:
       - name: Publish to NPM (release)
         if: github.ref == 'refs/heads/main' && (github.event.inputs.version == 'patch' || github.event.inputs.version == 'minor' || github.event.inputs.version == 'major')
         run: |
-          npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN}
+          npm config set //registry.npmjs.org/:_authToken "${NPM_TOKEN}"
           npm publish --access public
         env:
           NPM_TOKEN: ${{ secrets.NPM_ORG_TOKEN }}
@@ -270,7 +270,7 @@ jobs:
       - name: Publish to NPM (prerelease)
         if: github.ref == 'refs/heads/main' && (github.event.inputs.version == 'prerelease' || github.event.inputs.version == 'prepatch' || github.event.inputs.version == 'preminor' || github.event.inputs.version == 'premajor')
         run: |
-          npm config set //registry.npmjs.org/:_authToken ${NPM_TOKEN}
+          npm config set //registry.npmjs.org/:_authToken "${NPM_TOKEN}"
           npm publish --tag next --access public
         env:
           NPM_TOKEN: ${{ secrets.NPM_ORG_TOKEN }}
diff --git a/.github/workflows/pr-size-test-result.yml b/.github/workflows/pr-size-test-result.yml
index b23ba834d..f718ca32f 100644
--- a/.github/workflows/pr-size-test-result.yml
+++ b/.github/workflows/pr-size-test-result.yml
@@ -41,9 +41,11 @@ jobs:
           key: ios-size
 
       - run: |
-          echo old_size="$(cat ./size_main)" >> "$GITHUB_ENV"
-          echo new_size="$(cat ./size)" >> "$GITHUB_ENV"
-          echo percentage_change=$(awk 'NR==FNR{a=$0;next}{printf "%+.2f%%\n", 100*($0-a)/a}' ./size ./size_main) >> "$GITHUB_ENV"
+          {
+            echo old_size="$(cat ./size_main)"
+            echo new_size="$(cat ./size)"
+            echo percentage_change="$(awk 'NR==FNR{a=$0;next}{printf "%+.2f%%\n", 100*($0-a)/a}' ./size ./size_main)"
+          } >> "$GITHUB_ENV"
         if: github.event.workflow_run.event == 'pull_request'
 
       - name: 'Leave comment on PR with test results'
diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml
index e8eabb3e6..8180443b6 100644
--- a/.github/workflows/qt-ci.yml
+++ b/.github/workflows/qt-ci.yml
@@ -175,7 +175,7 @@ jobs:
           # version is pinned due to issues with caching MSVC in 4.8
           choco.exe install ccache --version=4.7.5 --no-progress
           ccache.exe --version
-          echo "CCACHE_CONFIGPATH=C:/Users/runneradmin/AppData/Roaming/ccache/ccache.conf" >> $GITHUB_ENV
+          echo "CCACHE_CONFIGPATH=C:/Users/runneradmin/AppData/Roaming/ccache/ccache.conf" >> "$GITHUB_ENV"
 
       - name: Set up ccache
         uses: hendrikmuhs/ccache-action@v1
@@ -238,7 +238,7 @@ jobs:
           QT_VERSION: ${{ matrix.qt_version }}
         run: |
           pushd install
-          tar cjvf ../maplibre-native_${QT_ARCH}_Qt${QT_VERSION}.tar.bz2 *
+          tar cjvf ../maplibre-native_"${QT_ARCH}"_Qt"${QT_VERSION}".tar.bz2 ./*
           popd
 
       - name: Upload artifacts
@@ -294,9 +294,9 @@ jobs:
       - name: Build test app
         run: |
           mkdir install && cd install
-          tar xf ../maplibre-native_${QT_ARCH}_Qt${QT_VERSION}.tar.bz2
+          tar xf ../maplibre-native_"${QT_ARCH}"_Qt"${QT_VERSION}".tar.bz2
           cd ..
-          export CMAKE_PREFIX_PATH=$PWD/install
+          export CMAKE_PREFIX_PATH="$PWD"/install
           mkdir build && cd build
           cmake ../source/platform/qt/app/
           make
@@ -326,7 +326,7 @@ jobs:
         TAG_PLATFORM: ${{ matrix.name }}
         QT_VERSION: ${{ matrix.qt_version }}
       run: |
-        mv maplibre-native_${TAG_PLATFORM}_Qt${QT_VERSION}.tar.bz2 QMapLibreGL_${TAG_NAME//qt-/}_Qt${QT_VERSION}_${TAG_PLATFORM}.tar.bz2
+        mv maplibre-native_"${TAG_PLATFORM}"_Qt"${QT_VERSION}".tar.bz2 QMapLibreGL_"${TAG_NAME//qt-/}"_Qt"${QT_VERSION}"_"${TAG_PLATFORM}".tar.bz2
 
     - name: Release
       uses: ncipollo/release-action@v1