diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d4e79b4..491601d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1,6 +1,13 @@
 name: Build & Test PR
 on: [pull_request]
 jobs:
+  analyze:
+    name: "Analyze shell scripts"
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@master
+    - name: sh-checker
+      uses: luizm/action-sh-checker@v0.3.0
   build:
     name: "Build & test images (${{ matrix.series }})"
     runs-on: ubuntu-latest
diff --git a/_common.sh b/_common.sh
index c4bde81..48bd5cd 100644
--- a/_common.sh
+++ b/_common.sh
@@ -1,30 +1,30 @@
 #!/usr/bin/env bash
 
-set -euxfo pipefail;
+set -euxfo pipefail
 
-DOCKER_REPOSITORY="racket/racket";
+export DOCKER_REPOSITORY="racket/racket"
 
 # We used to push images to the jackfirth/racket DockerHub repo instead
 # of racket/racket. For backwards compatibility, we still push the images
 # to that repo in addition to the primary racket/racket repo.
-SECONDARY_DOCKER_REPOSITORY="jackfirth/racket";
+export SECONDARY_DOCKER_REPOSITORY="jackfirth/racket"
 
-find_images () {
-    declare -r repository="${1}";
+find_images() {
+    declare -r repository="${1}"
 
     # Grab all of the racket images whose "tag"s start with a digit.
-    docker images --format '{{.Repository}}:{{.Tag}}' | \
-         (grep "^${repository}:[[:digit:]]" || true) | \
-         sort;
+    docker images --format '{{.Repository}}:{{.Tag}}' |
+        (grep "^${repository}:[[:digit:]]" || true) |
+        sort
 
     # Grab `latest` and `snapshot` images if available.
-    docker images --format '{{.Repository}}:{{.Tag}}' | \
-         (grep "^${repository}:\(latest\|snapshot\)" || true) | \
-         sort;
+    docker images --format '{{.Repository}}:{{.Tag}}' |
+        (grep "^${repository}:\(latest\|snapshot\)" || true) |
+        sort
 }
 
-find_testable_images () {
-    declare -r repository="${1}";
+find_testable_images() {
+    declare -r repository="${1}"
 
     # Version 6.0 is ignored during test runs because its openssl
     # bindings are broken.
diff --git a/build.sh b/build.sh
index a770cfa..b818d67 100755
--- a/build.sh
+++ b/build.sh
@@ -1,154 +1,154 @@
 #!/usr/bin/env bash
 
-set -euxfo pipefail;
+set -euxfo pipefail
 
 case "${1:-x}" in
-  8x) declare -r series="8x" ;;
-  7x) declare -r series="7x" ;;
-  6x) declare -r series="6x" ;;
-  snapshot) declare -r series="snapshot" ;;
-
-  *) echo "usage: $0 [6x|7x|8x|snapshot]"
-     exit 1
-     ;;
+8x) declare -r series="8x" ;;
+7x) declare -r series="7x" ;;
+6x) declare -r series="6x" ;;
+snapshot) declare -r series="snapshot" ;;
+
+*)
+  echo "usage: $0 [6x|7x|8x|snapshot]"
+  exit 1
+  ;;
 esac
 
-source "_common.sh";
+source _common.sh
 
-build_base () {
+build_base() {
   docker image build \
-         --file "base.Dockerfile" \
-         --tag "base" \
-         .;
+    --file "base.Dockerfile" \
+    --tag "base" \
+    .
 }
 
-build () {
-  declare -r dockerfile_name="${1}";
-  declare -r installer_url="${2}";
-  declare -r version="${3}";
-  declare -r image_name="${4}";
-  declare -r tag="${DOCKER_REPOSITORY}:${image_name}";
-  declare -r secondary_tag="${SECONDARY_DOCKER_REPOSITORY}:${image_name}";
+build() {
+  declare -r dockerfile_name="${1}"
+  declare -r installer_url="${2}"
+  declare -r version="${3}"
+  declare -r image_name="${4}"
+  declare -r tag="${DOCKER_REPOSITORY}:${image_name}"
+  declare -r secondary_tag="${SECONDARY_DOCKER_REPOSITORY}:${image_name}"
 
   docker image build \
-      --file "${dockerfile_name}.Dockerfile" \
-      --tag "${DOCKER_REPOSITORY}:${image_name}" \
-      --build-arg "RACKET_INSTALLER_URL=${installer_url}" \
-      --build-arg "RACKET_VERSION=${version}" \
-      .;
+    --file "${dockerfile_name}.Dockerfile" \
+    --tag "${DOCKER_REPOSITORY}:${image_name}" \
+    --build-arg "RACKET_INSTALLER_URL=${installer_url}" \
+    --build-arg "RACKET_VERSION=${version}" \
+    .
 
-  docker image tag "${tag}" "${secondary_tag}";
-};
+  docker image tag "${tag}" "${secondary_tag}"
+}
+
+installer_url() {
+  declare -r version="${1}"
+  declare -r installer_path="${2}"
+  echo "https://download.racket-lang.org/installers/${version}/${installer_path}"
+}
+
+build_snapshot() {
+  declare -r version="snapshot"
+
+  declare -r installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-minimal-current-x86_64-linux-jesse.sh"
+  build "racket" "${installer}" "${version}" "${version}"
+
+  declare -r bc_installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-minimal-current-x86_64-linux-bc.sh"
+  build "racket" "${bc_installer}" "${version}" "${version}-bc"
 
-installer_url () {
-  declare -r version="${1}";
-  declare -r installer_path="${2}";
-  echo "https://download.racket-lang.org/installers/${version}/${installer_path}";
-};
+  declare -r full_installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-current-x86_64-linux-jesse.sh"
+  build "racket" "${full_installer}" "${version}" "${version}-full"
 
-build_snapshot () {
-  declare -r version="snapshot";
+  declare -r full_bc_installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-current-x86_64-linux-bc.sh"
+  build "racket" "${full_bc_installer}" "${version}" "${version}-bc-full"
+}
+
+build_8x() {
+  declare -r version="${1}"
+
+  declare -r installer_path="racket-minimal-${version}-x86_64-linux-natipkg.sh"
+  declare -r installer=$(installer_url "${version}" "${installer_path}") || exit "${?}"
+  build "racket" "${installer}" "${version}" "${version}"
 
-  declare -r installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-minimal-current-x86_64-linux-jesse.sh";
-  build "racket" "${installer}" "${version}" "${version}";
+  declare -r bc_installer_path="racket-minimal-${version}-x86_64-linux-bc.sh"
+  declare -r bc_installer=$(installer_url "${version}" "${bc_installer_path}") || exit "${?}"
+  build "racket" "${bc_installer}" "${version}" "${version}-bc"
+
+  declare -r full_installer_path="racket-${version}-x86_64-linux-natipkg.sh"
+  declare -r full_installer=$(installer_url "${version}" "${full_installer_path}") || exit "${?}"
+  build "racket" "${full_installer}" "${version}" "${version}-full"
+
+  declare -r full_bc_installer_path="racket-${version}-x86_64-linux-bc.sh"
+  declare -r full_bc_installer=$(installer_url "${version}" "${full_bc_installer_path}") || exit "${?}"
+  build "racket" "${full_bc_installer}" "${version}" "${version}-bc-full"
+}
 
-  declare -r bc_installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-minimal-current-x86_64-linux-bc.sh";
-  build "racket" "${bc_installer}" "${version}" "${version}-bc";
+build_7x() {
+  declare -r version="${1}"
+
+  declare -r installer_path="racket-minimal-${version}-x86_64-linux-natipkg.sh"
+  declare -r installer=$(installer_url "${version}" "${installer_path}") || exit "${?}"
+  build "racket" "${installer}" "${version}" "${version}"
+
+  declare -r cs_installer_path="racket-minimal-${version}-x86_64-linux-natipkg-cs.sh"
+  declare -r cs_installer=$(installer_url "${version}" "${cs_installer_path}") || exit "${?}"
+  build "racket" "${cs_installer}" "${version}" "${version}-cs"
+
+  declare -r full_installer_path="racket-${version}-x86_64-linux-natipkg.sh"
+  declare -r full_installer=$(installer_url "${version}" "${full_installer_path}") || exit "${?}"
+  build "racket" "${full_installer}" "${version}" "${version}-full"
+
+  declare -r full_cs_installer_path="racket-${version}-x86_64-linux-natipkg-cs.sh"
+  declare -r full_cs_installer=$(installer_url "${version}" "${full_cs_installer_path}") || exit "${?}"
+  build "racket" "${full_cs_installer}" "${version}" "${version}-cs-full"
+}
+
+build_6x_7x_old() {
+  declare -r version="${1}"
+
+  declare -r installer_path="racket-minimal-${version}-x86_64-linux-natipkg.sh"
+  declare -r installer=$(installer_url "${version}" "${installer_path}") || exit "${?}"
+  build "racket" "${installer}" "${version}" "${version}"
+
+  declare -r full_installer_path="racket-${version}-x86_64-linux-natipkg.sh"
+  declare -r full_installer=$(installer_url "${version}" "${full_installer_path}") || exit "${?}"
+  build "racket" "${full_installer}" "${version}" "${version}-full"
+}
+
+foreach() {
+  declare -r command="${1}"
+  for _arg in "${@:2}"; do
+    "${command}" "${_arg}"
+  done
+}
 
-  declare -r full_installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-current-x86_64-linux-jesse.sh";
-  build "racket" "${full_installer}" "${version}" "${version}-full";
+declare -r LATEST_RACKET_VERSION="8.3"
 
-  declare -r full_bc_installer="https://www.cs.utah.edu/plt/snapshots/current/installers/racket-current-x86_64-linux-bc.sh";
-  build "racket" "${full_bc_installer}" "${version}" "${version}-bc-full";
+tag_latest() {
+  declare -r repository="${1}"
+  docker image tag "${repository}:${LATEST_RACKET_VERSION}" "${repository}:latest"
 }
 
-build_8x () {
-  declare -r version="${1}";
-
-  declare -r installer_path="racket-minimal-${version}-x86_64-linux-natipkg.sh";
-  declare -r installer=$(installer_url "${version}" "${installer_path}") || exit "${?}";
-  build "racket" "${installer}" "${version}" "${version}";
-
-  declare -r bc_installer_path="racket-minimal-${version}-x86_64-linux-bc.sh";
-  declare -r bc_installer=$(installer_url "${version}" "${bc_installer_path}") || exit "${?}";
-  build "racket" "${bc_installer}" "${version}" "${version}-bc";
-
-  declare -r full_installer_path="racket-${version}-x86_64-linux-natipkg.sh";
-  declare -r full_installer=$(installer_url "${version}" "${full_installer_path}") || exit "${?}";
-  build "racket" "${full_installer}" "${version}" "${version}-full";
-
-  declare -r full_bc_installer_path="racket-${version}-x86_64-linux-bc.sh";
-  declare -r full_bc_installer=$(installer_url "${version}" "${full_bc_installer_path}") || exit "${?}";
-  build "racket" "${full_bc_installer}" "${version}" "${version}-bc-full";
-};
-
-build_7x () {
-  declare -r version="${1}";
-
-  declare -r installer_path="racket-minimal-${version}-x86_64-linux-natipkg.sh";
-  declare -r installer=$(installer_url "${version}" "${installer_path}") || exit "${?}";
-  build "racket" "${installer}" "${version}" "${version}";
-
-  declare -r cs_installer_path="racket-minimal-${version}-x86_64-linux-natipkg-cs.sh";
-  declare -r cs_installer=$(installer_url "${version}" "${cs_installer_path}") || exit "${?}";
-  build "racket" "${cs_installer}" "${version}" "${version}-cs";
-
-  declare -r full_installer_path="racket-${version}-x86_64-linux-natipkg.sh";
-  declare -r full_installer=$(installer_url "${version}" "${full_installer_path}") || exit "${?}";
-  build "racket" "${full_installer}" "${version}" "${version}-full";
-
-  declare -r full_cs_installer_path="racket-${version}-x86_64-linux-natipkg-cs.sh";
-  declare -r full_cs_installer=$(installer_url "${version}" "${full_cs_installer_path}") || exit "${?}";
-  build "racket" "${full_cs_installer}" "${version}" "${version}-cs-full";
-};
-
-build_6x_7x_old () {
-  declare -r version="${1}";
-
-  declare -r installer_path="racket-minimal-${version}-x86_64-linux-natipkg.sh";
-  declare -r installer=$(installer_url "${version}" "${installer_path}") || exit "${?}";
-  build "racket" "${installer}" "${version}" "${version}";
-
-  declare -r full_installer_path="racket-${version}-x86_64-linux-natipkg.sh";
-  declare -r full_installer=$(installer_url "${version}" "${full_installer_path}") || exit "${?}";
-  build "racket" "${full_installer}" "${version}" "${version}-full";
-};
-
-foreach () {
-  declare -r command="${1}";
-  declare -r args="${@:2}";
-  for _arg in ${args}; do
-    "${command}" "${_arg}";
-  done;
-};
-
-declare -r LATEST_RACKET_VERSION="8.3";
-
-tag_latest () {
-  declare -r repository="${1}";
-  docker image tag "${repository}:${LATEST_RACKET_VERSION}" "${repository}:latest";
-};
-
-build_all_8x () {
-  foreach build_8x "8.0" "8.1" "8.2" "8.3";
-  tag_latest "${DOCKER_REPOSITORY}";
-  tag_latest "${SECONDARY_DOCKER_REPOSITORY}";
+build_all_8x() {
+  foreach build_8x "8.0" "8.1" "8.2" "8.3"
+  tag_latest "${DOCKER_REPOSITORY}"
+  tag_latest "${SECONDARY_DOCKER_REPOSITORY}"
 }
 
-build_all_7x () {
-  foreach build_6x_7x_old "7.0" "7.1" "7.3";
-  foreach build_7x "7.4" "7.5" "7.6" "7.7" "7.8" "7.9";
+build_all_7x() {
+  foreach build_6x_7x_old "7.0" "7.1" "7.3"
+  foreach build_7x "7.4" "7.5" "7.6" "7.7" "7.8" "7.9"
 }
 
-build_all_6x () {
-  foreach build_6x_7x_old "6.5" "6.6" "6.7" "6.8" "6.9" "6.10" "6.10.1" "6.11" "6.12";
+build_all_6x() {
+  foreach build_6x_7x_old "6.5" "6.6" "6.7" "6.8" "6.9" "6.10" "6.10.1" "6.11" "6.12"
 }
 
-build_base;
+build_base
 
 case "$series" in
-  8x) build_all_8x ;;
-  7x) build_all_7x ;;
-  6x) build_all_6x ;;
-  snapshot) build_snapshot ;;
+8x) build_all_8x ;;
+7x) build_all_7x ;;
+6x) build_all_6x ;;
+snapshot) build_snapshot ;;
 esac
diff --git a/deploy.sh b/deploy.sh
index 76cb8c1..530fa52 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
 
-set -euxfo pipefail;
+set -euxfo pipefail
 
-source "_common.sh";
+source _common.sh
 
-push () {
-  declare -r image="${1}";
-  docker image push "${image}";
-};
+push() {
+  declare -r image="${1}"
+  docker image push "${image}"
+}
 
 for image in $(find_images "${DOCKER_REPOSITORY}"); do
-  push "${image}";
+  push "${image}"
 done
 
 for image in $(find_images "${SECONDARY_DOCKER_REPOSITORY}"); do
-  push "${image}";
+  push "${image}"
 done
diff --git a/login.sh b/login.sh
index 0c05f6f..aa59c8b 100755
--- a/login.sh
+++ b/login.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
 # no -x because that leaks password in CI logs
-set -eufo pipefail;
+set -eufo pipefail
 
 docker login \
     --password="${DOCKER_USER_PASSWORD}" \
-    --username="${DOCKER_USER_NAME}";
+    --username="${DOCKER_USER_NAME}"
diff --git a/test.sh b/test.sh
index db790c2..fc76e1a 100755
--- a/test.sh
+++ b/test.sh
@@ -1,23 +1,23 @@
 #!/usr/bin/env bash
 
-set -euxfo pipefail;
+set -euxfo pipefail
 
-source "_common.sh";
+source _common.sh
 
-test-image () {
-  declare -r image="${1}";
-  docker container run "${image}" racket -e "(+ 1 2 3)";
+test-image() {
+  declare -r image="${1}"
+  docker container run "${image}" racket -e "(+ 1 2 3)"
 
   # The "nevermore" package is an empty package that never changes which we
   # created specifically for this test. This lets us test that package
   # installation works and the default package catalogs are properly configured.
-  docker container run "${image}" raco pkg install --auto nevermore;
-};
+  docker container run "${image}" raco pkg install --auto nevermore
+}
 
 for image in $(find_testable_images "${DOCKER_REPOSITORY}"); do
-  test-image "${image}";
+  test-image "${image}"
 done
 
 for image in $(find_testable_images "${SECONDARY_DOCKER_REPOSITORY}"); do
-  test-image "${image}";
+  test-image "${image}"
 done