diff --git a/.github/actions/get-docker-image-names/action.yml b/.github/actions/get-docker-image-names/action.yml
index 00d8c8a01b..ab82761c50 100644
--- a/.github/actions/get-docker-image-names/action.yml
+++ b/.github/actions/get-docker-image-names/action.yml
@@ -56,14 +56,16 @@ runs:
     - name: Get node image names
       id: get-docker-image-names
       shell: bash
+      env:
+        COMMIT_SHA: ${{ steps.get-ref-properties.outputs.sha }}
+        COMMIT_TAG: ${{ steps.get-ref-properties.outputs.tag }}
+        ECR: ${{ inputs.ecr-repo }}
+        DOCKERHUB: ${{ inputs.dockerhub-repo }}
+      # yamllint disable rule:line-length
       run: |
-        commit_sha=${{ steps.get-ref-properties.outputs.sha }}
-        commit_tag=${{ steps.get-ref-properties.outputs.tag }}
-        ecr='${{ inputs.ecr-repo }}'
-        dockerhub='${{ inputs.dockerhub-repo }}'
-        echo "ecr-rc-image=${ecr}:${commit_sha}" >> $GITHUB_OUTPUT
-        echo "ecr-deploy-image=${ecr}:${commit_tag}" >> $GITHUB_OUTPUT
-        echo "dockerhub-testnet-image=${dockerhub}:testnet-${commit_tag}" >> $GITHUB_OUTPUT
-        echo "dockerhub-mainnet-image=${dockerhub}:mainnet-${commit_tag}" >> $GITHUB_OUTPUT
-        echo "dockerhub-testnet-latest-image=${dockerhub}:testnet-latest" >> $GITHUB_OUTPUT
-        echo "dockerhub-mainnet-latest-image=${dockerhub}:mainnet-latest" >> $GITHUB_OUTPUT
+        echo 'ecr-rc-image=${{ env.ECR }}:${{ env.COMMIT_SHA }}' >> $GITHUB_OUTPUT
+        echo 'ecr-deploy-image=${{ env.ECR }}:${{ env.COMMIT_TAG }}' >> $GITHUB_OUTPUT
+        echo 'dockerhub-testnet-image=${{ env.DOCKERHUB }}:testnet-${{ env.COMMIT_TAG }}' >> $GITHUB_OUTPUT
+        echo 'dockerhub-mainnet-image=${{ env.DOCKERHUB }}:mainnet-${{ env.COMMIT_TAG }}' >> $GITHUB_OUTPUT
+        echo 'dockerhub-testnet-latest-image=${{ env.DOCKERHUB }}:testnet-latest' >> $GITHUB_OUTPUT
+        echo 'dockerhub-mainnet-latest-image=${{ env.DOCKERHUB }}:mainnet-latest' >> $GITHUB_OUTPUT
diff --git a/.github/workflows/_build-and-push-pull-request-image-to-featurenets.yml b/.github/workflows/_build-and-push-pull-request-image-to-featurenets.yml
index 370aaa000c..98bbc8f1c5 100644
--- a/.github/workflows/_build-and-push-pull-request-image-to-featurenets.yml
+++ b/.github/workflows/_build-and-push-pull-request-image-to-featurenets.yml
@@ -32,7 +32,7 @@ jobs:
           ls -alh target/release/
           ls -alh ./docker/
           docker build \
-            --tag ${{ vars.ECR_PUBLIC_REGISTRY }}feature-env-aleph-node:${{ env.IMAGE_TAG }} \
+            --tag '${{ vars.ECR_PUBLIC_REGISTRY }}feature-env-aleph-node:${{ env.IMAGE_TAG }}' \
             -f ./docker/Dockerfile .
 
       - name: Login to ECR
@@ -47,4 +47,4 @@ jobs:
           # yamllint disable-line rule:line-length
           IMAGE_TAG: fe-${{ steps.get-ref-properties.outputs.branch-name-for-argo-with-sha }}
         run: |
-          docker push ${{ vars.ECR_PUBLIC_REGISTRY }}feature-env-aleph-node:${{ env.IMAGE_TAG }}
+          docker push '${{ vars.ECR_PUBLIC_REGISTRY }}feature-env-aleph-node:${{ env.IMAGE_TAG }}'
diff --git a/.github/workflows/_build-liminal-node.yml b/.github/workflows/_build-liminal-node.yml
index c2a664039a..68b01e0b8f 100644
--- a/.github/workflows/_build-liminal-node.yml
+++ b/.github/workflows/_build-liminal-node.yml
@@ -23,7 +23,7 @@ jobs:
 
       - name: Build test binary and runtime
         run: |
-          cargo build --release -p aleph-node --features "liminal"
+          cargo build --release -p aleph-node --features 'liminal'
 
       - name: Upload test binary to GH Artifacts
         uses: actions/upload-artifact@v2
diff --git a/.github/workflows/_check-excluded-packages.yml b/.github/workflows/_check-excluded-packages.yml
index 7ab256846f..1486913e18 100644
--- a/.github/workflows/_check-excluded-packages.yml
+++ b/.github/workflows/_check-excluded-packages.yml
@@ -34,27 +34,30 @@ jobs:
           field: 'toolchain.channel'
 
       - name: Install prerequisites
+        env:
+          RUST_TOOLCHAIN: ${{ steps.aleph-client-toolchain-channel.outputs.value }}
+          RUST_CONTRACTS_TOOLCHAIN: ${{ steps.contracts-toolchain-channel.outputs.value }}
+        # yamllint disable rule:line-length
         run: |
-          RUST_TOOLCHAIN=${{ steps.aleph-client-toolchain-channel.outputs.value }}
-          RUST_CONTRACTS_TOOLCHAIN=${{ steps.contracts-toolchain-channel.outputs.value }}
-          rustup toolchain install ${RUST_TOOLCHAIN}
-          rustup toolchain install ${RUST_CONTRACTS_TOOLCHAIN}
-          rustup component add rust-src --toolchain ${RUST_CONTRACTS_TOOLCHAIN}
+          rustup toolchain install '${{ env.RUST_TOOLCHAIN }}'
+          rustup toolchain install '${{ env.RUST_CONTRACTS_TOOLCHAIN }}'
+          rustup component add rust-src --toolchain '${{ env.RUST_CONTRACTS_TOOLCHAIN }}'
 
-          mkdir -p /tmp/contracts_toolchain/$RUST_CONTRACTS_TOOLCHAIN/
-          mkdir -p /tmp/$RUST_TOOLCHAIN/
+          mkdir -p '/tmp/contracts_toolchain/${{ env.RUST_CONTRACTS_TOOLCHAIN }}/'
+          mkdir -p '/tmp/${{ env.RUST_TOOLCHAIN }}/'
 
           export WASM_BUILD_WORKSPACE_HINT=${PWD}
-          export CARGO_TARGET_DIR=/tmp/contracts_toolchain/$RUST_CONTRACTS_TOOLCHAIN/target/
+          export CARGO_TARGET_DIR='/tmp/contracts_toolchain/${{ env.RUST_CONTRACTS_TOOLCHAIN }}/target/'
 
-          cargo +${RUST_CONTRACTS_TOOLCHAIN} \
-            install --version $CARGO_CONTRACT_VERSION \
+          cargo '+${{ env.RUST_CONTRACTS_TOOLCHAIN }}' \
+            install --version '${{ env.CARGO_CONTRACT_VERSION }}' \
             --force --locked cargo-contract
 
-          export CARGO_TARGET_DIR=/tmp/$RUST_TOOLCHAIN/target/
+          export CARGO_TARGET_DIR='/tmp/${{ env.RUST_TOOLCHAIN }}/target/'
 
-          cargo +${RUST_TOOLCHAIN} \
+          cargo '+${{ env.RUST_TOOLCHAIN }}' \
             install aleph-zero-cargo-nono --locked
+        # yamllint enable rule:line-length
 
       - name: Check excluded packages
         env:
@@ -72,13 +75,13 @@ jobs:
           # a version bump
           #
           # cd baby-liminal-extension/
-          # ${CHECK}
-          # ${CHECK} --features ink
+          # ${{ env.CHECK }}
+          # ${{ env.CHECK }} --features ink
 
           cd poseidon/
-          ${CHECK}
-          ${CHECK} --features circuit
+          ${{ env.CHECK }}
+          ${{ env.CHECK }} --features circuit
 
           cd ../relations/ark/
-          ${CHECK}
-          ${CHECK} --features circuit
+          ${{ env.CHECK }}
+          ${{ env.CHECK }} --features circuit
diff --git a/.github/workflows/_check-runtime-determimism.yml b/.github/workflows/_check-runtime-determimism.yml
index 6850e1eb3c..e9738cec95 100644
--- a/.github/workflows/_check-runtime-determimism.yml
+++ b/.github/workflows/_check-runtime-determimism.yml
@@ -31,9 +31,9 @@ jobs:
           ARTIFACT: aleph_runtime.compact.compressed.wasm
           TARGET_DIR: target/production/wbuild/aleph-runtime
         run: |
-          mkdir -p "$TARGET_DIR"
-          mv "$ARTIFACT" "$TARGET_DIR"
-          sha256sum "$TARGET_DIR/$ARTIFACT" > checksum.sha256
+          mkdir -p '${{ env.TARGET_DIR }}'
+          mv '${{ env.ARTIFACT }}' '${{ env.TARGET_DIR }}'
+          sha256sum '${{ env.TARGET_DIR }}/${{ env.ARTIFACT }}' > checksum.sha256
           cargo clean
           cargo build --profile production -p aleph-runtime
           sha256sum -c checksum.sha256
diff --git a/.github/workflows/_check-vars-and-secrets.yml b/.github/workflows/_check-vars-and-secrets.yml
index d7abc44411..d75cae1beb 100644
--- a/.github/workflows/_check-vars-and-secrets.yml
+++ b/.github/workflows/_check-vars-and-secrets.yml
@@ -13,44 +13,44 @@ jobs:
       - name: Check vars
         run: |
           if [[ \
-            -z "${{ vars.ECR_PUBLIC_HOST }}" || \
-            -z "${{ vars.ECR_PUBLIC_REGISTRY }}" || \
-            -z "${{ vars.DOCKERHUB_ALEPH_NODE_REPO }}" || \
-            -z "${{ vars.ECR_ALEPH_NODE_REPO }}" || \
-            -z "${{ vars.KUSTOMIZE_VERSION }}"
+            -z '${{ vars.ECR_PUBLIC_HOST }}' || \
+            -z '${{ vars.ECR_PUBLIC_REGISTRY }}' || \
+            -z '${{ vars.DOCKERHUB_ALEPH_NODE_REPO }}' || \
+            -z '${{ vars.ECR_ALEPH_NODE_REPO }}' || \
+            -z '${{ vars.KUSTOMIZE_VERSION }}'
           ]]; then
-            echo "!!! Some repository variables are either missing or empty."
-            echo "!!! Please check either repository or organization settings."
+            echo '!!! Some repository variables are either missing or empty.'
+            echo '!!! Please check either repository or organization settings.'
             exit 1
           fi
 
       - name: Check secrets
         run: |
           if [[ \
-            -z "${{ secrets.ARGOCD_DEVNET_HOST }}" || \
-            -z "${{ secrets.ARGO_SYNC_USER_TOKEN }}" || \
-            -z "${{ secrets.AWS_DEVNET_ACCESS_KEY_ID }}" || \
-            -z "${{ secrets.AWS_DEVNET_SECRET_ACCESS_KEY }}" || \
-            -z "${{ secrets.AWS_MAINNET_ACCESS_KEY_ID }}" || \
-            -z "${{ secrets.AWS_MAINNET_SECRET_ACCESS_KEY }}" || \
-            -z "${{ secrets.AUTOCOMMIT_AUTHOR }}" || \
-            -z "${{ secrets.AUTOCOMMIT_EMAIL }}" || \
-            -z "${{ secrets.CI_DEVNET_S3BUCKET_NAME }}" || \
-            -z "${{ secrets.CI_MAINNET_S3BUCKET_NAME }}" || \
-            -z "${{ secrets.CI_GH_TOKEN }}" || \
-            -z "${{ secrets.CI_S3BUCKET_NAME }}" || \
-            -z "${{ secrets.DEVNET_KEYS_S3BUCKET_NAME }}" || \
-            -z "${{ secrets.FEATURENET_KEYS_S3BUCKET_NAME }}" || \
-            -z "${{ secrets.REPO_ARGOCD_APPS_NAME }}" || \
-            -z "${{ secrets.REPO_OPS_FEATURENETS_NAME }}" || \
-            -z "${{ secrets.REPO_FEATURENET_TEMPLATE_NAME }}" || \
-            -z "${{ secrets.SYNCAZF }}" || \
-            -z "${{ secrets.DOCKERHUB_PASSWORD }}" || \
-            -z "${{ secrets.DOCKERHUB_USERNAME }}" || \
-            -z "${{ secrets.SLACK_WEBHOOK_TRACK_APPLICATIONS }}" || \
-            -z "${{ secrets.SLACK_WEBHOOK_DEV_ONDUTY }}"
+            -z '${{ secrets.ARGOCD_DEVNET_HOST }}' || \
+            -z '${{ secrets.ARGO_SYNC_USER_TOKEN }}' || \
+            -z '${{ secrets.AWS_DEVNET_ACCESS_KEY_ID }}' || \
+            -z '${{ secrets.AWS_DEVNET_SECRET_ACCESS_KEY }}' || \
+            -z '${{ secrets.AWS_MAINNET_ACCESS_KEY_ID }}' || \
+            -z '${{ secrets.AWS_MAINNET_SECRET_ACCESS_KEY }}' || \
+            -z '${{ secrets.AUTOCOMMIT_AUTHOR }}' || \
+            -z '${{ secrets.AUTOCOMMIT_EMAIL }}' || \
+            -z '${{ secrets.CI_DEVNET_S3BUCKET_NAME }}' || \
+            -z '${{ secrets.CI_MAINNET_S3BUCKET_NAME }}' || \
+            -z '${{ secrets.CI_GH_TOKEN }}' || \
+            -z '${{ secrets.CI_S3BUCKET_NAME }}' || \
+            -z '${{ secrets.DEVNET_KEYS_S3BUCKET_NAME }}' || \
+            -z '${{ secrets.FEATURENET_KEYS_S3BUCKET_NAME }}' || \
+            -z '${{ secrets.REPO_ARGOCD_APPS_NAME }}' || \
+            -z '${{ secrets.REPO_OPS_FEATURENETS_NAME }}' || \
+            -z '${{ secrets.REPO_FEATURENET_TEMPLATE_NAME }}' || \
+            -z '${{ secrets.SYNCAZF }}' || \
+            -z '${{ secrets.DOCKERHUB_PASSWORD }}' || \
+            -z '${{ secrets.DOCKERHUB_USERNAME }}' || \
+            -z '${{ secrets.SLACK_WEBHOOK_TRACK_APPLICATIONS }}' || \
+            -z '${{ secrets.SLACK_WEBHOOK_DEV_ONDUTY }}'
           ]]; then
-            echo "!!! Some repository secrets are either missing or empty."
-            echo "!!! Please check either repository or organization settings."
+            echo '!!! Some repository secrets are either missing or empty.'
+            echo '!!! Please check either repository or organization settings.'
             exit 1
           fi
diff --git a/.github/workflows/_update-node-image-infra.yml b/.github/workflows/_update-node-image-infra.yml
index d541835113..d0380dd6a1 100644
--- a/.github/workflows/_update-node-image-infra.yml
+++ b/.github/workflows/_update-node-image-infra.yml
@@ -18,8 +18,8 @@ jobs:
       - name: Validate action inputs
         shell: bash
         run: |
-          if [[ "${{ inputs.env }}" != 'testnet' && "${{ inputs.env }}" != 'mainnet' ]]; then
-            echo "Error: inputs.env should be either mainnet or testnet!"
+          if [[ '${{ inputs.env }}' != 'testnet' && '${{ inputs.env }}' != 'mainnet' ]]; then
+            echo 'Error: inputs.env should be either mainnet or testnet!'
             exit 1
           fi
 
@@ -59,7 +59,7 @@ jobs:
           # yamllint disable-line rule:line-length
           repository: ${{ steps.get-repo-owner.outputs.repo-owner }}/${{ secrets.REPO_ARGOCD_APPS_NAME }}
           token: ${{ secrets.CI_GH_TOKEN }}
-          path: "${{ secrets.REPO_ARGOCD_APPS_NAME }}"
+          path: ${{ secrets.REPO_ARGOCD_APPS_NAME }}
 
       - name: Init kustomize
         uses: imranismail/setup-kustomize@v2
@@ -96,4 +96,4 @@ jobs:
           author_email: ${{ secrets.AUTOCOMMIT_EMAIL }}
           message: "Update ${{ inputs.env }} aleph-node tag ${{ env.TAG }}"
           add: "*.yaml"
-          cwd: "${{ secrets.REPO_ARGOCD_APPS_NAME }}"
+          cwd: ${{ secrets.REPO_ARGOCD_APPS_NAME }}
diff --git a/.github/workflows/build-and-push-cliain.yml b/.github/workflows/build-and-push-cliain.yml
index bce1e2bc9c..5a13781552 100644
--- a/.github/workflows/build-and-push-cliain.yml
+++ b/.github/workflows/build-and-push-cliain.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Cargo | Build release binary
         run: |
-          if [[ ${{ matrix.runtime }} = 'liminal' ]]; then
+          if [[ '${{ matrix.runtime }}' = 'liminal' ]]; then
             FEATURES="--features liminal"
           fi
           cd ./bin/cliain && cargo build --release ${FEATURES}
@@ -76,13 +76,13 @@ jobs:
                steps.get-ref-properties.outputs.branch-name-flattened) ||
                matrix.runtime == 'liminal' && steps.get-ref-properties.outputs.sha }}
         run: |
-          docker build -t "${{ env.REGISTRY }}${{ env.IMAGE_NAME }}:${{ env.TAG }}" \
+          docker build -t '${{ env.REGISTRY }}${{ env.IMAGE_NAME }}:${{ env.TAG }}' \
             -f ./bin/cliain/Dockerfile ./bin/cliain
           if [[ \
-            "${{ github.event_name }}" == "workflow_dispatch" || \
-            "${{ github.event_name }}" == "push" \
+            '${{ github.event_name }}' == 'workflow_dispatch' || \
+            '${{ github.event_name }}' == 'push' \
           ]]; then
-             docker push "${{ env.REGISTRY }}${{ env.IMAGE_NAME }}:${{ env.TAG }}"
+             docker push '${{ env.REGISTRY }}${{ env.IMAGE_NAME }}:${{ env.TAG }}'
           fi
 
       - name: Configure AWS credentials for S3 AWS
diff --git a/.github/workflows/deploy-to-devnet.yml b/.github/workflows/deploy-to-devnet.yml
index 3ef67f90c3..33a235e143 100644
--- a/.github/workflows/deploy-to-devnet.yml
+++ b/.github/workflows/deploy-to-devnet.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           repository: Cardinal-Cryptography/${{ secrets.REPO_ARGOCD_APPS_NAME }}
           token: ${{ secrets.CI_GH_TOKEN }}
-          path: "${{ secrets.REPO_ARGOCD_APPS_NAME }}"
+          path: ${{ secrets.REPO_ARGOCD_APPS_NAME }}
 
       - name: Init kustomize
         uses: imranismail/setup-kustomize@v2
@@ -64,7 +64,7 @@ jobs:
       - name: Sync all validator's keystores from S3
         run: |
           #!/bin/bash
-          aws s3 cp s3://alephzero-devnet-eu-central-1-keys-bucket/data data --recursive
+          aws s3 cp s3://${{ secrets.DEVNET_KEYS_S3BUCKET_NAME }}/data data --recursive
           # rename validator paths
           declare -A \
             NAMES=([aleph-node-validator-0]=5D34dL5prEUaGNQtPPZ3yN5Y6BnkfXunKXXz6fo7ZJbLwRRH \
@@ -84,11 +84,10 @@ jobs:
       - name: Generate chainspec
         env:
           RELEASE_TAG: ${{ steps.vars.outputs.sha_short }}
-
         # yamllint disable rule:line-length
         run: |
           #!/bin/bash
-          aws s3 cp s3://alephzero-devnet-eu-central-1-keys-bucket/data data --recursive
+          aws s3 cp 's3://${{ secrets.DEVNET_KEYS_S3BUCKET_NAME }}/data' data --recursive
 
           # well-known accounts
           ALICE=5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY
@@ -97,12 +96,12 @@ jobs:
           EVE=5HGjWAeFDfFCWPsjFQdVV2Msvz2XtMktvgocEZcCj68kUMaw
 
           docker run -i -v $(pwd)/data:/data --env RUST_BACKTRACE=1 --entrypoint \
-            "/usr/local/bin/aleph-node" ${{ vars.ECR_PUBLIC_REGISTRY }}aleph-node:${RELEASE_TAG} \
+            '/usr/local/bin/aleph-node' '${{ vars.ECR_PUBLIC_REGISTRY }}aleph-node:${{ env.RELEASE_TAG }}' \
             bootstrap-chain --raw --base-path /data --chain-id a0dnet1 \
             --account-ids 5D34dL5prEUaGNQtPPZ3yN5Y6BnkfXunKXXz6fo7ZJbLwRRH,5GBNeWRhZc2jXu7D55rBimKYDk8PGk8itRYFTPfC8RJLKG5o,5Dfis6XL8J2P6JHUnUtArnFWndn62SydeP8ee8sG2ky9nfm9,5F4H97f7nQovyrbiq4ZetaaviNwThSVcFobcA5aGab6167dK,5DiDShBWa1fQx6gLzpf3SFBhMinCoyvHM1BWjPNsmXS8hkrW,5EFb84yH9tpcFuiKUcsmdoF7xeeY3ajG1ZLQimxQoFt9HMKR,5DZLHESsfGrJ5YzT3HuRPXsSNb589xQ4Unubh1mYLodzKdVY,5GHJzqvG6tXnngCpG7B12qjUvbo5e4e9z8Xjidk3CQZHxTPZ,5CUnSsgAyLND3bxxnfNhgWXSe9Wn676JzLpGLgyJv858qhoX,5CVKn7HAZW1Ky4r7Vkgsr7VEW88C2sHgUNDiwHY9Ct2hjU8q \
             --sudo-account-id 5F4SvwaUEQubiqkPF8YnRfcN77cLsT2DfG4vFeQmSXNjR7hD \
             --rich-account-ids $ALICE,$BOB,$CHARLIE,$EVE > chainspec.json
-          aws s3 cp chainspec.json s3://alephzero-devnet-eu-central-1-keys-bucket/chainspec.json
+          aws s3 cp chainspec.json 's3://${{ secrets.DEVNET_KEYS_S3BUCKET_NAME }}/chainspec.json'
         # yamllint enable rule:line-length
 
       - name: Stop and purge db Devnet
@@ -114,18 +113,18 @@ jobs:
           kubectl delete pvc -l app=aleph-node-validator -n devnet --ignore-not-found=true
 
       - name: Start Devnet
+        # yamllint disable rule:line-length
         env:
-          RELEASE_TAG: ${{ steps.vars.outputs.sha_short }}
+          IMAGE_PLACEHOLDER: ${{ vars.ECR_PUBLIC_REGISTRY }}aleph-node:${{ steps.vars.outputs.sha_short }}
         run: |
           #!/bin/bash
-          export image_placeholder=${{ vars.ECR_PUBLIC_REGISTRY }}aleph-node:${RELEASE_TAG}
-
-          cd ${{ secrets.REPO_ARGOCD_APPS_NAME }}/aleph-node-validators/overlays/devnet/eu-central-1
+          cd '${{ secrets.REPO_ARGOCD_APPS_NAME }}/aleph-node-validators/overlays/devnet/eu-central-1'
           kustomize edit set image \
-            "aleph-node-validator-image-placeholder=${image_placeholder}"
+            'aleph-node-validator-image-placeholder=${{ env.IMAGE_PLACEHOLDER }}'
           kustomize build . | kubectl apply -f -
           sleep 2
           kubectl rollout status --watch --timeout=3600s statefulset/aleph-node-validator -n devnet
+        # yamllint enable rule:line-length
 
       - name: Waiting 5 minutes for validators to boot
         run: |
@@ -139,7 +138,7 @@ jobs:
           author_email: ${{ secrets.AUTOCOMMIT_EMAIL }}
           message: "Update Devnet docker image tag to: ${{ steps.vars.outputs.sha_short }}"
           add: "*.yaml"
-          cwd: "${{ secrets.REPO_ARGOCD_APPS_NAME }}"
+          cwd: ${{ secrets.REPO_ARGOCD_APPS_NAME }}
 
   slack:
     name: Slack notification
diff --git a/.github/workflows/deploy-to-mainnet.yml b/.github/workflows/deploy-to-mainnet.yml
index bc926f2f53..ab740aeb52 100644
--- a/.github/workflows/deploy-to-mainnet.yml
+++ b/.github/workflows/deploy-to-mainnet.yml
@@ -43,8 +43,8 @@ jobs:
         if: inputs.force != true
         shell: bash
         run: |
-          testnet_sha=${{ steps.get-testnet-node-commit-sha.outputs.sha }}
-          current_sha=${{ steps.get-ref-properties.outputs.sha }}
+          testnet_sha='${{ steps.get-testnet-node-commit-sha.outputs.sha }}'
+          current_sha='${{ steps.get-ref-properties.outputs.sha }}'
           if [[ "${testnet_sha}" != "${current_sha}" ]]; then
             echo "Error: Testnet RPC system.version sha ${testnet_sha} is different from the"
             echo "node you're trying to deploy: ${current_sha}. If you know what you're doing"
@@ -81,8 +81,8 @@ jobs:
           target-image: ${{ steps.get-docker-image-names.outputs.dockerhub-mainnet-image }}
           additional-image:
             ${{ steps.get-docker-image-names.outputs.dockerhub-mainnet-latest-image }}
-          dockerhub-username: "${{ secrets.DOCKERHUB_USERNAME }}"
-          dockerhub-password: "${{ secrets.DOCKERHUB_PASSWORD }}"
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
   slack:
     name: Slack notification
diff --git a/.github/workflows/deploy-to-testnet.yml b/.github/workflows/deploy-to-testnet.yml
index 685ed2618f..6bc25b49be 100644
--- a/.github/workflows/deploy-to-testnet.yml
+++ b/.github/workflows/deploy-to-testnet.yml
@@ -44,8 +44,8 @@ jobs:
           target-image: ${{ steps.get-docker-image-names.outputs.dockerhub-testnet-image }}
           additional-image:
             ${{ steps.get-docker-image-names.outputs.dockerhub-testnet-latest-image }}
-          dockerhub-username: "${{ secrets.DOCKERHUB_USERNAME }}"
-          dockerhub-password: "${{ secrets.DOCKERHUB_PASSWORD }}"
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
   slack:
     name: Slack notification
diff --git a/.github/workflows/featurenet-create-from-branch.yml b/.github/workflows/featurenet-create-from-branch.yml
index 58becf940b..1992ef3d9f 100644
--- a/.github/workflows/featurenet-create-from-branch.yml
+++ b/.github/workflows/featurenet-create-from-branch.yml
@@ -62,10 +62,10 @@ jobs:
         # yamllint disable rule:line-length
         run: |
           if [[
-          ! "${{ inputs.featurenet-name }}" =~ ^[a-z0-9][a-z0-9\-]{4,48}$
+          ! '${{ inputs.featurenet-name }}' =~ ^[a-z0-9][a-z0-9\-]{4,48}$
           ]]
           then
-            echo "!!! Invalid featurenet name"
+            echo '!!! Invalid featurenet name'
             exit 1
           fi
         # yamllint enable rule:line-length
diff --git a/.github/workflows/nightly-fe-e2e-tests.yml b/.github/workflows/nightly-fe-e2e-tests.yml
index 01f00d21c6..3683f5f61f 100644
--- a/.github/workflows/nightly-fe-e2e-tests.yml
+++ b/.github/workflows/nightly-fe-e2e-tests.yml
@@ -118,7 +118,7 @@ jobs:
         # yamllint disable rule:line-length
           APP_NAME: ${{ format('{0}-{1}', github.run_id, matrix.testcase) }}
         run: |
-          final_featurename_local=${{ env.APP_NAME }}
+          final_featurename_local='${{ env.APP_NAME }}'
           echo "final-featurenet-name=$(printf $final_featurename_local | sed 's|::|-|g' | sed 's|_|-|g')" >> $GITHUB_OUTPUT
         # yamllint enable rule:line-length
 
@@ -153,8 +153,8 @@ jobs:
         # yamllint disable rule:line-length
         run: |
           docker run --network host \
-            -e NODE_URL="wss://${{ steps.create-featurenet.outputs.ws-hostname }}:443" \
-            -e TEST_CASES="${{ matrix.testcase }}" \
+            -e NODE_URL='wss://${{ steps.create-featurenet.outputs.ws-hostname }}:443' \
+            -e TEST_CASES='${{ matrix.testcase }}' \
             -e RUST_LOG=info \
             aleph-e2e-client:latest
         timeout-minutes: 15
diff --git a/.github/workflows/on-main-branch-commit-push-liminal-node-to-ecr.yml b/.github/workflows/on-main-branch-commit-push-liminal-node-to-ecr.yml
index c0995cfed6..a906922014 100644
--- a/.github/workflows/on-main-branch-commit-push-liminal-node-to-ecr.yml
+++ b/.github/workflows/on-main-branch-commit-push-liminal-node-to-ecr.yml
@@ -62,10 +62,10 @@ jobs:
           ECR_PUSH_IMAGE: ${{ vars.ECR_PUBLIC_REGISTRY }}aleph-node-liminal
           COMMIT_SHA: ${{ steps.get-ref-properties.outputs.sha }}
         run: |
-          docker tag ${{ env.CURRENT_IMAGE }} ${{ env.ECR_PUSH_IMAGE }}:${{ env.COMMIT_SHA }}
-          docker push ${{ env.ECR_PUSH_IMAGE }}:${{ env.COMMIT_SHA }}
-          docker tag ${{ env.CURRENT_IMAGE }} ${{ env.ECR_PUSH_IMAGE }}:latest
-          docker push ${{ env.ECR_PUSH_IMAGE }}:latest
+          docker tag '${{ env.CURRENT_IMAGE }}' '${{ env.ECR_PUSH_IMAGE }}:${{ env.COMMIT_SHA }}'
+          docker push '${{ env.ECR_PUSH_IMAGE }}:${{ env.COMMIT_SHA }}'
+          docker tag '${{ env.CURRENT_IMAGE }}' '${{ env.ECR_PUSH_IMAGE }}:latest'
+          docker push '${{ env.ECR_PUSH_IMAGE }}:latest'
 
   send-slack-notification:
     name: Send Slack notification about workflow status
diff --git a/.github/workflows/on-main-or-release-branch-commit.yml b/.github/workflows/on-main-or-release-branch-commit.yml
index 39da7bedb7..f08f1e3ebf 100644
--- a/.github/workflows/on-main-or-release-branch-commit.yml
+++ b/.github/workflows/on-main-or-release-branch-commit.yml
@@ -92,12 +92,12 @@ jobs:
           CURRENT_IMAGE: aleph-node
           ECR_PUSH_IMAGE: ${{ vars.ECR_PUBLIC_REGISTRY }}aleph-node
         run: |
-          docker tag ${{ env.CURRENT_IMAGE }} \
-            ${{ env.ECR_PUSH_IMAGE }}:${{ steps.get-ref-properties.outputs.sha }}
-          docker push ${{ env.ECR_PUSH_IMAGE }}:${{ steps.get-ref-properties.outputs.sha }}
-          if [[ "${{ steps.get-ref-properties.outputs.branch }}" -eq "main" ]]; then
-            docker tag ${{ env.CURRENT_IMAGE }} ${{ env.ECR_PUSH_IMAGE }}:latest
-            docker push ${{ env.ECR_PUSH_IMAGE }}:latest
+          docker tag '${{ env.CURRENT_IMAGE }}' \
+            '${{ env.ECR_PUSH_IMAGE }}:${{ steps.get-ref-properties.outputs.sha }}'
+          docker push '${{ env.ECR_PUSH_IMAGE }}:${{ steps.get-ref-properties.outputs.sha }}'
+          if [[ '${{ steps.get-ref-properties.outputs.branch }}' -eq 'main' ]]; then
+            docker tag '${{ env.CURRENT_IMAGE }}' '${{ env.ECR_PUSH_IMAGE }}:latest'
+            docker push '${{ env.ECR_PUSH_IMAGE }}:latest'
           fi
 
   send-slack-notification-release:
diff --git a/.github/workflows/on-pull-request-close.yml b/.github/workflows/on-pull-request-close.yml
index 94412a3e75..74f74944c7 100644
--- a/.github/workflows/on-pull-request-close.yml
+++ b/.github/workflows/on-pull-request-close.yml
@@ -30,8 +30,7 @@ jobs:
           # yamllint disable-line rule:line-length
           FE_NAME: ${{ format('{0}{1}', 'fe-', steps.get-ref-properties.outputs.branch-name-for-argo) }}
         run: |
-          name_local=${{ env.FE_NAME }}
-          echo "name=$name_local" >> $GITHUB_OUTPUT
+          echo 'name=${{ env.FE_NAME }}' >> $GITHUB_OUTPUT
 
   delete-featurenet:
     if: >
diff --git a/.github/workflows/on-pull-request-label.yml b/.github/workflows/on-pull-request-label.yml
index 4011635fca..cb0b66a616 100644
--- a/.github/workflows/on-pull-request-label.yml
+++ b/.github/workflows/on-pull-request-label.yml
@@ -30,8 +30,7 @@ jobs:
           # yamllint disable-line rule:line-length
           FE_NAME: ${{ steps.get-ref-properties.outputs.branch-name-for-argo }}
         run: |
-          name_local=${{ env.FE_NAME }}
-          echo "name=$name_local" >> $GITHUB_OUTPUT
+          echo 'name=${{ env.FE_NAME }}' >> $GITHUB_OUTPUT
 
   create-featurenet:
     if: github.event.label.name == 'trigger:create-featurenet'
diff --git a/.github/workflows/on-push-release-tag.yml b/.github/workflows/on-push-release-tag.yml
index c964813cec..9aef53150b 100644
--- a/.github/workflows/on-push-release-tag.yml
+++ b/.github/workflows/on-push-release-tag.yml
@@ -45,13 +45,13 @@ jobs:
 
       - name: Tag and push image to ECR
         shell: bash
+        env:
+          RC_IMAGE: ${{ steps.get-docker-image-names.outputs.ecr-rc-image }}
+          DEPLOY_IMAGE: ${{ steps.get-docker-image-names.outputs.ecr-deploy-image }}
         run: |
-          rc_image=${{ steps.get-docker-image-names.outputs.ecr-rc-image }}
-          deploy_image=${{ steps.get-docker-image-names.outputs.ecr-deploy-image }}
-
-          docker pull ${rc_image}
-          docker tag ${rc_image} ${deploy_image}
-          docker push ${deploy_image}
+          docker pull '${{ env.RC_IMAGE }}'
+          docker tag '${{ env.RC_IMAGE }}' '${{ env.DEPLOY_IMAGE }}'
+          docker push '${{ env.DEPLOY_IMAGE }}'
 
   slack:
     name: Slack notification
diff --git a/.github/workflows/on-release-branch-commit.yml b/.github/workflows/on-release-branch-commit.yml
index 28218f24a7..ab662178ed 100644
--- a/.github/workflows/on-release-branch-commit.yml
+++ b/.github/workflows/on-release-branch-commit.yml
@@ -28,12 +28,12 @@ jobs:
         run: |
           set +e
           fail=0
-          # compare every worflow except e2e tests as those might get added on main
+          # compare every workflow except e2e tests as those might get added on main
           for i in $(ls -1 .github/workflows/*.yml | grep -v on-pull-request-commit.yml)
           do
             diff -ur $i aleph-node-main/$i > $i.diff
             if [[ $(cat $i.diff | wc -l) > 0 ]]; then
-              echo ""
+              echo ''
               cat $i.diff
               fail=1
             fi
@@ -42,12 +42,12 @@ jobs:
           do
             diff -ur $i aleph-node-main/$i > $i.diff
             if [[ $(cat $i.diff | wc -l) > 0 ]]; then
-              echo ""
+              echo ''
               cat $i.diff
               fail=1
             fi
           done
           if [[ $fail == 1 ]]; then
-            echo "!!! YAML files in .github on this branch differ from the ones on main branch!"
+            echo '!!! YAML files in .github on this branch differ from the ones on main branch!'
             exit 1
           fi
diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml
index b04e3356ce..ea8aedfbd6 100644
--- a/.github/workflows/on-release.yml
+++ b/.github/workflows/on-release.yml
@@ -46,8 +46,8 @@ jobs:
           S3BUCKET_URL: s3://${{ secrets.CI_MAINNET_S3BUCKET_NAME }}/builds/aleph-node/commits/${{ steps.get-ref-properties.outputs.sha }}/aleph-production-runtime
           S3BUCKET_FILE: aleph-production-runtime-${{ steps.get-ref-properties.outputs.sha }}.tar.gz
         run: |
-          aws s3 cp ${{ env.S3BUCKET_URL }}/${{ env.S3BUCKET_FILE }} \
-            aleph-runtime-${{ steps.get-ref-properties.outputs.sha }}.tar.gz
+          aws s3 cp '${{ env.S3BUCKET_URL }}/${{ env.S3BUCKET_FILE }}' \
+            'aleph-runtime-${{ steps.get-ref-properties.outputs.sha }}.tar.gz'
 
       - name: Download release binary from S3 bucket
         shell: bash
@@ -56,8 +56,8 @@ jobs:
           S3BUCKET_URL: s3://${{ secrets.CI_MAINNET_S3BUCKET_NAME }}/builds/aleph-node/commits/${{ steps.get-ref-properties.outputs.sha }}/aleph-production-node
           S3BUCKET_FILE: aleph-production-node-${{ steps.get-ref-properties.outputs.sha }}.tar.gz
         run: |
-          aws s3 cp ${{ env.S3BUCKET_URL }}/${{ env.S3BUCKET_FILE }} \
-             aleph-node-${{ steps.get-ref-properties.outputs.sha }}-linux-amd64.tar.gz
+          aws s3 cp '${{ env.S3BUCKET_URL }}/${{ env.S3BUCKET_FILE }}' \
+             'aleph-node-${{ steps.get-ref-properties.outputs.sha }}-linux-amd64.tar.gz'
 
       - name: Add runtime and binary to the release
         uses: softprops/action-gh-release@v1
diff --git a/.github/workflows/push-foundation-repo.yml b/.github/workflows/push-foundation-repo.yml
index 7e4f32f263..3e660a6766 100644
--- a/.github/workflows/push-foundation-repo.yml
+++ b/.github/workflows/push-foundation-repo.yml
@@ -31,7 +31,7 @@ jobs:
 
       - name: Push to Aleph-Zero-Foundation
         # yamllint disable-line rule:line-length
-        run: git push https://x-access-token:${{ secrets.SYNCAZF }}@github.com/aleph-zero-foundation/aleph-node.git
+        run: git push 'https://x-access-token:${{ secrets.SYNCAZF }}@github.com/aleph-zero-foundation/aleph-node.git'
 
 
   sync-release-branch:
@@ -78,13 +78,13 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: aleph-zero-foundation/aleph-node
-          token: "${{ secrets.SYNCAZF }}"
+          token: ${{ secrets.SYNCAZF }}
           path: aleph-zero-foundation-aleph-node
           fetch-depth: 0
 
       - name: Checkout commit SHA and add tag in Aleph-Zero-Foundation repository
         run: |
           cd aleph-zero-foundation-aleph-node/
-          git checkout "${{ steps.get-ref-properties.outputs.sha }}"
-          git tag "${{ steps.get-ref-properties.outputs.tag }}"
-          git push origin "${{ steps.get-ref-properties.outputs.tag }}"
+          git checkout '${{ steps.get-ref-properties.outputs.sha }}'
+          git tag '${{ steps.get-ref-properties.outputs.tag }}'
+          git push origin '${{ steps.get-ref-properties.outputs.tag }}'