- Quote all variable expansions: `"$var"` not `$var`, `"${array[@]}"` not `${array[@]}`, `"$(cmd)"` not `$(cmd)` — prevents SC2086 and SC2046.
- Add `set -euo pipefail` at the top of every non-interactive script — exits on error, unset vars, and piped command failures.
- Use `[[ ... ]]` instead of `[ ... ]` in bash — handles empty strings safely, supports `=~` for regex, and avoids word splitting.
- Declare all function-local variables with `local varname` to prevent unintended global scope pollution.
- Run `shellcheck -S warning script.sh` in CI — block on SC2086 (unquoted variables) and SC2046 (unquoted command substitution).
- Prefer `$(cmd)` over backtick command substitution — backticks nest poorly and trigger SC2006 warnings.
- Use `printf '%s\n' "$var"` instead of `echo "$var"` for portability — `echo` behaviour varies across shells for `-e` and `-n` flags.
- Suppress intentional warnings inline: `# shellcheck disable=SC2034` — always add a comment explaining why the warning is expected.