diff --git a/.github/scripts/check-commit-titles.sh b/.github/scripts/check-commit-titles.sh
index 3886ffff2b7..657311acaa8 100755
--- a/.github/scripts/check-commit-titles.sh
+++ b/.github/scripts/check-commit-titles.sh
@@ -1,4 +1,5 @@
 #!/bin/sh
+# shellcheck disable=SC2317
 
 # This script reads newline separated commit titles from stdin
 # output an error message when titles are deemed invalid,
@@ -6,7 +7,6 @@
 
 if [ -z "$NOCOLOR" ]; then
     RED=$(tput setaf 1 2>/dev/null)
-    YELLOW=$(tput setaf 3 2>/dev/null)
     BLUE=$(tput setaf 4 2>/dev/null)
     RESET=$(tput sgr0 2>/dev/null)
 fi
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a6545e7892b..1458d0aaf00 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,6 +14,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    name: Build
     permissions:
       packages: write
     outputs:
@@ -177,8 +178,39 @@ jobs:
           name: osrdyne-test
           path: osrd-osrdyne-test.tar
 
+  check_dockerfiles:
+    runs-on: ubuntu-latest
+    name: Check dockerfiles
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Build dummy test_data and static_assets images
+        run: |
+          echo -e "FROM scratch" > Dockerfile.empty
+          docker build -t test_data -f Dockerfile.empty .
+          docker build -t static_assets -f Dockerfile.empty .
+
+      - name: Find and check all Dockerfiles using docker build --check
+        run: |
+          set -eo pipefail
+          find . -name 'Dockerfile*' -print0 | xargs -0 -I {} docker build --file {} --check .
+
+  check_scripts:
+    runs-on: ubuntu-latest
+    name: Check scripts
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Find and check all scripts using ShellCheck
+        uses: ludeeus/action-shellcheck@master
+        with:
+          ignore_names: gradlew
+
   check_generated_railjson_sync:
     runs-on: ubuntu-latest
+    name: Check generated railjson sync
     steps:
       - uses: actions/checkout@v4
       - name: Install poetry
@@ -204,6 +236,7 @@ jobs:
 
   check_railjson_generator:
     runs-on: ubuntu-latest
+    name: Check railjson generator
     steps:
       - uses: actions/checkout@v4
       - name: Install poetry
@@ -264,6 +297,7 @@ jobs:
 
   check_commits:
     runs-on: ubuntu-latest
+    name: Check commits
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -292,7 +326,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  final_newline_lint:
+  check_final_newline:
     runs-on: ubuntu-latest
     name: Check final newline
     steps:
@@ -316,6 +350,7 @@ jobs:
 
   check_integration_tests:
     runs-on: ubuntu-latest
+    name: Check integration tests
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -349,6 +384,7 @@ jobs:
 
   check_osrd_schema:
     runs-on: ubuntu-latest
+    name: Check osrd schema
     steps:
       - uses: actions/checkout@v4
       - name: Install poetry
@@ -386,6 +422,7 @@ jobs:
 
   check_toml:
     runs-on: ubuntu-latest
+    name: Check toml
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -399,6 +436,7 @@ jobs:
 
   check_infra_schema_sync:
     runs-on: ubuntu-latest
+    name: Check infra schema sync
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -417,6 +455,7 @@ jobs:
 
   check_front_rtk_sync:
     runs-on: ubuntu-latest
+    name: Check front rtk sync
     needs:
       - build
 
@@ -452,6 +491,7 @@ jobs:
 
   check_core:
     runs-on: ubuntu-latest
+    name: Check core
     needs:
       - build
     steps:
@@ -503,7 +543,7 @@ jobs:
 
   check_editoast_tests:
     runs-on: ubuntu-latest
-
+    name: Check editoast tests
     needs:
       - build
 
@@ -576,7 +616,7 @@ jobs:
     # check to complete. As editoast tests take while to run, we don't want this to
     # be on the hot path
     runs-on: ubuntu-latest
-
+    name: Check editoast lints
     needs:
       - build
     steps:
@@ -623,7 +663,7 @@ jobs:
   check_editoast_openapi:
     # for the same reason as check_editoast_lints, we run this in a separate job
     runs-on: ubuntu-latest
-
+    name: Check editoast openapi
     needs:
       - build
     steps:
@@ -668,6 +708,7 @@ jobs:
 
   check_gateway:
     runs-on: ubuntu-latest
+    name: Check gateway
     needs:
       - build
 
@@ -730,6 +771,7 @@ jobs:
 
   check_osrdyne:
     runs-on: ubuntu-latest
+    name: Check osrdyne
     needs:
       - build
 
@@ -792,6 +834,7 @@ jobs:
 
   check_front:
     runs-on: ubuntu-latest
+    name: Check front
     needs:
       - build
 
@@ -846,6 +889,7 @@ jobs:
 
   integration_tests:
     runs-on: ubuntu-latest
+    name: Integration tests
     needs:
       - build
     steps:
@@ -956,6 +1000,7 @@ jobs:
 
   end_to_end_tests:
     runs-on: ubuntu-latest
+    name: End to end tests
     needs:
       - build
     steps:
@@ -1058,6 +1103,7 @@ jobs:
 
   check_reuse_compliance:
     runs-on: ubuntu-latest
+    name: Check reuse compliance
     steps:
       - uses: actions/checkout@v4
       - name: REUSE Compliance Check
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 8bdbd0e4b88..19d0b9fcd5c 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -7,6 +7,7 @@ jobs:
       contents: read
       pull-requests: write
     runs-on: ubuntu-latest
+    name: "Check PR label"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/editoast/assets/signal_sprites/generate-atlas.sh b/editoast/assets/signal_sprites/generate-atlas.sh
index 48501ae9ef6..bf3e3e41824 100755
--- a/editoast/assets/signal_sprites/generate-atlas.sh
+++ b/editoast/assets/signal_sprites/generate-atlas.sh
@@ -4,9 +4,9 @@
 # First add all your svg in a subfolder named to the signaling system (eg: `BAL`)
 # Then run this script. You will need docker.
 
-for signaling_system in $(ls); do
+for signaling_system in *; do
   # Skip files (like this file)
-  [ ! -d "${signaling_system}" ] && continue
+  [ -d "${signaling_system}" ] || continue
 
   # Prepare the tmp directory
   tmp_dir="$(mktemp -d)"
@@ -20,7 +20,8 @@ for signaling_system in $(ls); do
   cp "${tmp_dir}"/sprites/sprites* "${signaling_system}"
 
   # Add a linefeed to the json files
-  for json_file in $(ls  "${signaling_system}"/*.json); do
+  for json_file in "${signaling_system}"/*.json; do
+    [ -f "$json_file" ] || continue
     echo "" >> "${json_file}"
   done
 
diff --git a/front/scripts/generate-types.sh b/front/scripts/generate-types.sh
index 0a86dee5396..296a6c03b0d 100755
--- a/front/scripts/generate-types.sh
+++ b/front/scripts/generate-types.sh
@@ -1,12 +1,10 @@
 #!/bin/sh
-npx @rtk-query/codegen-openapi src/config/openapi-editoast-config.ts
-if [ $? -ne 0 ]; then
+if ! npx @rtk-query/codegen-openapi src/config/openapi-editoast-config.ts; then
     echo "npx @rtk-query/codegen-openapi src/config/openapi-editoast-config.ts command failed. Exit the script"
     exit 1
 fi
 yarn eslint --fix src/common/api/generatedEditoastApi.ts --no-ignore
-npx @rtk-query/codegen-openapi src/config/openapi-gateway-config.ts
-if [ $? -ne 0 ]; then
+if ! npx @rtk-query/codegen-openapi src/config/openapi-gateway-config.ts; then
     echo "npx @rtk-query/codegen-openapi src/config/openapi-gateway-config.ts command failed. Exit the script"
     exit 1
 fi
diff --git a/scripts/cleanup-db.sh b/scripts/cleanup-db.sh
index e4c73df04e2..ddb4467f1e8 100755
--- a/scripts/cleanup-db.sh
+++ b/scripts/cleanup-db.sh
@@ -14,7 +14,7 @@ if [ "$#" -ne 0 ]; then
   exit 1
 fi
 
-root_path="$(realpath $(dirname "$0")/..)"
+root_path=$(realpath "$(dirname "$0")/..")
 
 # These variables are necessary to load the infra on the correct instance (the pr-infra or the dev one)
 OSRD_POSTGRES="osrd-postgres"
@@ -37,13 +37,13 @@ echo "Checking database exists..."
 DB_EXISTS="$(docker exec $OSRD_POSTGRES psql -p $OSRD_POSTGRES_PORT -c "SELECT EXISTS (SELECT FROM pg_stat_database WHERE datname = 'osrd');")"
 DB_EXISTS="$(echo "$DB_EXISTS" | grep -o -E '[tf]$')"
 
-if [ $DB_EXISTS = 't' ]; then
+if [ "$DB_EXISTS" = 't' ]; then
   echo "  Database 'osrd' found"
 else
   echo "  Database 'osrd' not found"
 fi
 
-if [ $DB_EXISTS = 't' ]; then
+if [ "$DB_EXISTS" = 't' ]; then
   # Check that no service is connected to the database
   echo "Checking database availability..."
 
@@ -56,7 +56,7 @@ if [ $DB_EXISTS = 't' ]; then
   DB_CONN="$(docker exec "$OSRD_POSTGRES" psql -p "$OSRD_POSTGRES_PORT" -c "SELECT numbackends FROM pg_stat_database WHERE datname = 'osrd';")"
   DB_CONN="$(echo "$DB_CONN" | grep -o -E '[0-9]+$')"
 
-  if [ $DB_CONN -ne 0 ]; then
+  if [ "$DB_CONN" -ne 0 ]; then
     echo "  The database can not be cleared."
     echo "  A process is connected to your database, please check it and close it."
     echo "  In doubt, you can shutdown the whole compose stack and only keep the database running."
@@ -77,6 +77,6 @@ docker exec "$OSRD_POSTGRES" psql -p "$OSRD_POSTGRES_PORT" -f //tmp/init.sql > /
 echo "Deleting valkey cache..."
 docker exec "$OSRD_VALKEY" valkey-cli -p "$OSRD_VALKEY_PORT" FLUSHALL > /dev/null 2>&1 || docker volume rm -f $OSRD_VALKEY_VOLUME > /dev/null
 
-echo "Cleanup done!\n"
+echo 'Cleanup done!'
 echo "You may want to apply migrations if you don't load a backup:"
 echo "'diesel migration run --migration-dir \"$root_path/editoast/migrations\"'  # 'docker compose up editoast' does it automatically"
diff --git a/scripts/create-backup.sh b/scripts/create-backup.sh
index dff7afd611a..6fb161dc2b7 100755
--- a/scripts/create-backup.sh
+++ b/scripts/create-backup.sh
@@ -10,7 +10,7 @@ set -e
 
 OUTPUT_DIR="."
 if [ "$#" -eq 1 ]; then
-  OUTPUT_DIR="$(readlink -f $1)/"
+  OUTPUT_DIR="$(readlink -f "$1")/"
 fi
 
 # Check output directory
diff --git a/scripts/drop-core.sh b/scripts/drop-core.sh
index 0db5f5b2835..a7f0269f8fc 100755
--- a/scripts/drop-core.sh
+++ b/scripts/drop-core.sh
@@ -1,8 +1,8 @@
 #!/bin/sh
 
-docker rm -f dyn-osrd-core-$1
+docker rm -f "dyn-osrd-core-$1"
 
 docker compose \
     -p "osrd" \
     -f "docker-compose.yml" \
-    exec rabbitmq rabbitmqctl delete_queue core-$1
+    exec rabbitmq rabbitmqctl delete_queue "core-$1"
diff --git a/scripts/load-backup.sh b/scripts/load-backup.sh
index 9c2e235bec4..564cbc3b51e 100755
--- a/scripts/load-backup.sh
+++ b/scripts/load-backup.sh
@@ -14,7 +14,7 @@ if [ "$#" -ne 1 ]; then
   exit 1
 fi
 
-root_path="$(realpath $(dirname "$0")/..)"
+root_path=$(realpath "$(dirname "$0")/..")
 
 # Check sha1 is matching
 echo "Checking backup integrity..."