diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
new file mode 100644
index 0000000..c6916eb
--- /dev/null
+++ b/.github/workflows/lint.yaml
@@ -0,0 +1,16 @@
+name: Lint
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    paths:
+      - '**'
+env:
+  FORCE_COLOR: 1
+jobs:
+  call-workflow:
+    uses: kairos-io/linting-composite-action/.github/workflows/reusable-linting.yaml@v0.0.6
+    with:
+      yamldirs: ".github/workflows/ config/ tools-image/"
+      is-go: true
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000..0547724
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,5 @@
+disable=SC2086
+disable=SC2034
+disable=SC2046
+disable=SC2068
+disable=SC2154
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 0000000..02702cb
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,21 @@
+extends: default
+
+rules:
+  # 80 chars should be enough, but don't fail if a line is longer
+  line-length:
+    max: 150
+    level: warning
+
+  # accept both     key:
+  #                   - item
+  #
+  # and             key:
+  #                 - item
+  indentation:
+    indent-sequences: whatever
+
+  truthy:
+    check-keys: false
+
+  document-start:
+    present: false
diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml
index e66a6f2..66eb279 100644
--- a/config/default/kustomization.yaml
+++ b/config/default/kustomization.yaml
@@ -73,13 +73,11 @@ vars:
 #    kind: Service
 #    version: v1
 #    name: webhook-service
-
-vars:
 - name: NGINX_NAMESPACE
   objref:
     kind: Namespace
     name: system
-    apiVersion: v1 
+    apiVersion: v1
 
 - name: ARTIFACT_COPIER_ROLE
   objref:
diff --git a/config/manager/controller_manager_config.yaml b/config/manager/controller_manager_config.yaml
index d95dc28..2f4fbb2 100644
--- a/config/manager/controller_manager_config.yaml
+++ b/config/manager/controller_manager_config.yaml
@@ -9,13 +9,13 @@ webhook:
 leaderElection:
   leaderElect: true
   resourceName: 98ca89ca.kairos.io
-#   leaderElectionReleaseOnCancel defines if the leader should step down volume 
+#   leaderElectionReleaseOnCancel defines if the leader should step down volume
 #   when the Manager ends. This requires the binary to immediately end when the
 #   Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
 #   speeds up voluntary leader transitions as the new leader don't have to wait
 #   LeaseDuration time first.
-#   In the default scaffold provided, the program ends immediately after 
-#   the manager stops, so would be fine to enable this option. However, 
-#   if you are doing or is intended to do any operation such as perform cleanups 
+#   In the default scaffold provided, the program ends immediately after
+#   the manager stops, so would be fine to enable this option. However,
+#   if you are doing or is intended to do any operation such as perform cleanups
 #   after the manager stops then its usage might be unsafe.
 #   leaderElectionReleaseOnCancel: true
diff --git a/config/prometheus/monitor.yaml b/config/prometheus/monitor.yaml
index d19136a..6812d4d 100644
--- a/config/prometheus/monitor.yaml
+++ b/config/prometheus/monitor.yaml
@@ -1,4 +1,3 @@
-
 # Prometheus Monitor Service (Metrics)
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
diff --git a/script/test.sh b/script/test.sh
index 6985134..555feed 100755
--- a/script/test.sh
+++ b/script/test.sh
@@ -26,7 +26,8 @@ set -e
 kubectl cluster-info --context kind-$CLUSTER_NAME
 echo "Sleep to give times to node to populate with all info"
 kubectl wait --for=condition=Ready node/$CLUSTER_NAME-control-plane
-export EXTERNAL_IP=$(kubectl get nodes -o jsonpath='{.items[].status.addresses[?(@.type == "InternalIP")].address}')
+EXTERNAL_IP=$(kubectl get nodes -o jsonpath='{.items[].status.addresses[?(@.type == "InternalIP")].address}')
+export EXTERNAL_IP
 export BRIDGE_IP="172.18.0.1"
 kubectl get nodes -o wide
 cd $ROOT_DIR/tests && $GINKGO -r -v ./e2e
\ No newline at end of file
diff --git a/tools-image/build-arm-image.sh b/tools-image/build-arm-image.sh
index 53ee8ae..9820458 100755
--- a/tools-image/build-arm-image.sh
+++ b/tools-image/build-arm-image.sh
@@ -131,7 +131,7 @@ get_url()
     esac
 }
 
-trap "cleanup" 1 2 3 6 9 14 15 EXIT
+trap "cleanup" 1 2 3 6 14 15 EXIT
 
 load_vars
 
@@ -223,6 +223,7 @@ else
 fi
 
 if [ -n "$cos_config" ] && [ -e "$cos_config" ]; then
+  # shellcheck source=/dev/null
   source "$cos_config"
 fi
 
@@ -283,7 +284,7 @@ ensure_dir_structure $TARGET
 # Download the container image
 if [ -z "$directory" ]; then
   echo ">>> Downloading container image"
-  elemental pull-image $( (( $local_build == 'true')) && printf %s '--local' ) $container_image $TARGET
+  elemental pull-image $( (( local_build == 'true')) && printf %s '--local' ) $container_image $TARGET
 else
   echo ">>> Copying files from $directory"
   rsync -axq --exclude='host' --exclude='mnt' --exclude='proc' --exclude='sys' --exclude='dev' --exclude='tmp' ${directory}/ $TARGET
@@ -354,7 +355,7 @@ sgdisk -n 2:0:+${state_size}M -c 2:state -t 2:8300 ${output_image}
 if [ "$disable_lvm" == 'true' ]; then
 sgdisk -n 3:0:+${recovery_size}M -c 3:recovery -t 3:8300 ${output_image}
 else 
-sgdisk -n 3:0:+$(( ${recovery_size} + ${oem_size} ))M -c 3:lvm -t 3:8e00 ${output_image}
+sgdisk -n 3:0:+$(( recovery_size + oem_size ))M -c 3:lvm -t 3:8e00 ${output_image}
 fi
 sgdisk -n 4:0:+64M -c 4:persistent -t 4:8300 ${output_image}
 
@@ -366,7 +367,8 @@ fi
 
 # Prepare the image and copy over the files
 
-export DRIVE=$(losetup -f "${output_image}" --show)
+DRIVE=$(losetup -f "${output_image}" --show)
+export DRIVE
 if [ -z "${DRIVE}" ]; then
 	echo "Cannot execute losetup for $output_image"
 	exit 1
diff --git a/tools-image/config.yaml b/tools-image/config.yaml
index 4ceb56c..60857c2 100644
--- a/tools-image/config.yaml
+++ b/tools-image/config.yaml
@@ -3,4 +3,4 @@ iso:
   - dir:/efi
   image:
   - dir:/efi
-  - dir:/grub2
\ No newline at end of file
+  - dir:/grub2
diff --git a/tools-image/defaults.yaml b/tools-image/defaults.yaml
index 4cfc7ce..a7fe034 100644
--- a/tools-image/defaults.yaml
+++ b/tools-image/defaults.yaml
@@ -1,8 +1,8 @@
 #cloud-config
 name: "Default user"
 stages:
-   initramfs:
-     - name: "Set default user/pass"
-       users:
+  initramfs:
+    - name: "Set default user/pass"
+      users:
         kairos:
-          passwd: "kairos"
\ No newline at end of file
+          passwd: "kairos"
diff --git a/tools-image/raw-images.sh b/tools-image/raw-images.sh
index a9fc391..47f613c 100755
--- a/tools-image/raw-images.sh
+++ b/tools-image/raw-images.sh
@@ -71,7 +71,7 @@ truncate -s "+$((1024*1024))" $OUT
 
 if [ -n "$EXTEND" ]; then
   echo "Extending image of $EXTEND MB"
-  truncate -s "+$(($EXTEND*1024*1024))" $OUT
+  truncate -s "+$((EXTEND*1024*1024))" $OUT
 fi
 
 # Create the partition table in $OUT (assumes sectors of 512 bytes)