diff --git a/hack/.shellcheck_failures b/hack/.shellcheck_failures
index 45e568500c..e2a3cccf73 100644
--- a/hack/.shellcheck_failures
+++ b/hack/.shellcheck_failures
@@ -158,10 +158,6 @@
 ./pkg/kubectl/cmd/edit/testdata/record_testcase.sh
 ./pkg/util/verify-util-pkg.sh
 ./plugin/pkg/admission/imagepolicy/gencerts.sh
-./staging/src/k8s.io/code-generator/generate-groups.sh
-./staging/src/k8s.io/code-generator/generate-internal-groups.sh
-./staging/src/k8s.io/code-generator/hack/update-codegen.sh
-./staging/src/k8s.io/code-generator/hack/verify-codegen.sh
 ./staging/src/k8s.io/csi-api/hack/update-codegen.sh
 ./staging/src/k8s.io/csi-api/hack/verify-codegen.sh
 ./staging/src/k8s.io/kube-aggregator/hack/build-image.sh
diff --git a/staging/src/k8s.io/code-generator/generate-groups.sh b/staging/src/k8s.io/code-generator/generate-groups.sh
index d8531a8d9d..d82002ddaf 100755
--- a/staging/src/k8s.io/code-generator/generate-groups.sh
+++ b/staging/src/k8s.io/code-generator/generate-groups.sh
@@ -23,7 +23,7 @@ set -o pipefail
 
 if [ "$#" -lt 4 ] || [ "${1}" == "--help" ]; then
   cat <<EOF
-Usage: $(basename $0) <generators> <output-package> <apis-package> <groups-versions> ...
+Usage: $(basename "$0") <generators> <output-package> <apis-package> <groups-versions> ...
 
   <generators>        the generators comma separated to run (deepcopy,defaulter,client,lister,informer) or "all".
   <output-package>    the output package name (e.g. github.com/example/project/pkg/generated).
@@ -34,8 +34,8 @@ Usage: $(basename $0) <generators> <output-package> <apis-package> <groups-versi
 
 
 Examples:
-  $(basename $0) all             github.com/example/project/pkg/client github.com/example/project/pkg/apis "foo:v1 bar:v1alpha1,v1beta1"
-  $(basename $0) deepcopy,client github.com/example/project/pkg/client github.com/example/project/pkg/apis "foo:v1 bar:v1alpha1,v1beta1"
+  $(basename "$0") all             github.com/example/project/pkg/client github.com/example/project/pkg/apis "foo:v1 bar:v1alpha1,v1beta1"
+  $(basename "$0") deepcopy,client github.com/example/project/pkg/client github.com/example/project/pkg/apis "foo:v1 bar:v1alpha1,v1beta1"
 EOF
   exit 0
 fi
@@ -49,8 +49,8 @@ shift 4
 (
   # To support running this script from anywhere, we have to first cd into this directory
   # so we can install the tools.
-  cd $(dirname "${0}")
-  go install ${GOFLAGS:-} ./cmd/{defaulter-gen,client-gen,lister-gen,informer-gen,deepcopy-gen}
+  cd "$(dirname "${0}")"
+  go install ./cmd/{defaulter-gen,client-gen,lister-gen,informer-gen,deepcopy-gen}
 )
 
 function codegen::join() { local IFS="$1"; shift; echo "$*"; }
@@ -58,35 +58,35 @@ function codegen::join() { local IFS="$1"; shift; echo "$*"; }
 # enumerate group versions
 FQ_APIS=() # e.g. k8s.io/api/apps/v1
 for GVs in ${GROUPS_WITH_VERSIONS}; do
-  IFS=: read G Vs <<<"${GVs}"
+  IFS=: read -r G Vs <<<"${GVs}"
 
   # enumerate versions
   for V in ${Vs//,/ }; do
-    FQ_APIS+=(${APIS_PKG}/${G}/${V})
+    FQ_APIS+=("${APIS_PKG}/${G}/${V}")
   done
 done
 
 if [ "${GENS}" = "all" ] || grep -qw "deepcopy" <<<"${GENS}"; then
   echo "Generating deepcopy funcs"
-  ${GOPATH}/bin/deepcopy-gen --input-dirs $(codegen::join , "${FQ_APIS[@]}") -O zz_generated.deepcopy --bounding-dirs ${APIS_PKG} "$@"
+  "${GOPATH}/bin/deepcopy-gen" --input-dirs "$(codegen::join , "${FQ_APIS[@]}")" -O zz_generated.deepcopy --bounding-dirs "${APIS_PKG}" "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "client" <<<"${GENS}"; then
   echo "Generating clientset for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}"
-  ${GOPATH}/bin/client-gen --clientset-name ${CLIENTSET_NAME_VERSIONED:-versioned} --input-base "" --input $(codegen::join , "${FQ_APIS[@]}") --output-package ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset} "$@"
+  "${GOPATH}/bin/client-gen" --clientset-name "${CLIENTSET_NAME_VERSIONED:-versioned}" --input-base "" --input "$(codegen::join , "${FQ_APIS[@]}")" --output-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}" "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "lister" <<<"${GENS}"; then
   echo "Generating listers for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/listers"
-  ${GOPATH}/bin/lister-gen --input-dirs $(codegen::join , "${FQ_APIS[@]}") --output-package ${OUTPUT_PKG}/listers "$@"
+  "${GOPATH}/bin/lister-gen" --input-dirs "$(codegen::join , "${FQ_APIS[@]}")" --output-package "${OUTPUT_PKG}/listers" "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "informer" <<<"${GENS}"; then
   echo "Generating informers for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/informers"
-  ${GOPATH}/bin/informer-gen \
-           --input-dirs $(codegen::join , "${FQ_APIS[@]}") \
-           --versioned-clientset-package ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_VERSIONED:-versioned} \
-           --listers-package ${OUTPUT_PKG}/listers \
-           --output-package ${OUTPUT_PKG}/informers \
+  "${GOPATH}/bin/informer-gen" \
+           --input-dirs "$(codegen::join , "${FQ_APIS[@]}")" \
+           --versioned-clientset-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_VERSIONED:-versioned}" \
+           --listers-package "${OUTPUT_PKG}/listers" \
+           --output-package "${OUTPUT_PKG}/informers" \
            "$@"
 fi
diff --git a/staging/src/k8s.io/code-generator/generate-internal-groups.sh b/staging/src/k8s.io/code-generator/generate-internal-groups.sh
index 6849ed9437..258b53b56f 100755
--- a/staging/src/k8s.io/code-generator/generate-internal-groups.sh
+++ b/staging/src/k8s.io/code-generator/generate-internal-groups.sh
@@ -23,7 +23,7 @@ set -o pipefail
 
 if [ "$#" -lt 5 ] || [ "${1}" == "--help" ]; then
   cat <<EOF
-Usage: $(basename $0) <generators> <output-package> <internal-apis-package> <extensiona-apis-package> <groups-versions> ...
+Usage: $(basename "$0") <generators> <output-package> <internal-apis-package> <extensiona-apis-package> <groups-versions> ...
 
   <generators>        the generators comma separated to run (deepcopy,defaulter,conversion,client,lister,informer) or "all".
   <output-package>    the output package name (e.g. github.com/example/project/pkg/generated).
@@ -34,8 +34,8 @@ Usage: $(basename $0) <generators> <output-package> <internal-apis-package> <ext
   ...                 arbitrary flags passed to all generator binaries.
 
 Examples:
-  $(basename $0) all                           github.com/example/project/pkg/client github.com/example/project/pkg/apis github.com/example/project/pkg/apis "foo:v1 bar:v1alpha1,v1beta1"
-  $(basename $0) deepcopy,defaulter,conversion github.com/example/project/pkg/client github.com/example/project/pkg/apis github.com/example/project/apis     "foo:v1 bar:v1alpha1,v1beta1"
+  $(basename "$0") all                           github.com/example/project/pkg/client github.com/example/project/pkg/apis github.com/example/project/pkg/apis "foo:v1 bar:v1alpha1,v1beta1"
+  $(basename "$0") deepcopy,defaulter,conversion github.com/example/project/pkg/client github.com/example/project/pkg/apis github.com/example/project/apis     "foo:v1 bar:v1alpha1,v1beta1"
 EOF
   exit 0
 fi
@@ -47,7 +47,7 @@ EXT_APIS_PKG="$4"
 GROUPS_WITH_VERSIONS="$5"
 shift 5
 
-go install ${GOFLAGS:-} ./$(dirname "${0}")/cmd/{defaulter-gen,conversion-gen,client-gen,lister-gen,informer-gen,deepcopy-gen}
+go install ./"$(dirname "${0}")"/cmd/{defaulter-gen,conversion-gen,client-gen,lister-gen,informer-gen,deepcopy-gen}
 function codegen::join() { local IFS="$1"; shift; echo "$*"; }
 
 # enumerate group versions
@@ -55,7 +55,7 @@ ALL_FQ_APIS=() # e.g. k8s.io/kubernetes/pkg/apis/apps k8s.io/api/apps/v1
 INT_FQ_APIS=() # e.g. k8s.io/kubernetes/pkg/apis/apps
 EXT_FQ_APIS=() # e.g. k8s.io/api/apps/v1
 for GVs in ${GROUPS_WITH_VERSIONS}; do
-  IFS=: read G Vs <<<"${GVs}"
+  IFS=: read -r G Vs <<<"${GVs}"
 
   if [ -n "${INT_APIS_PKG}" ]; then
     ALL_FQ_APIS+=("${INT_APIS_PKG}/${G}")
@@ -71,39 +71,40 @@ done
 
 if [ "${GENS}" = "all" ] || grep -qw "deepcopy" <<<"${GENS}"; then
   echo "Generating deepcopy funcs"
-  ${GOPATH}/bin/deepcopy-gen --input-dirs $(codegen::join , "${ALL_FQ_APIS[@]}") -O zz_generated.deepcopy --bounding-dirs ${INT_APIS_PKG},${EXT_APIS_PKG} "$@"
+  "${GOPATH}/bin/deepcopy-gen" --input-dirs "$(codegen::join , "${ALL_FQ_APIS[@]}")" -O zz_generated.deepcopy --bounding-dirs "${INT_APIS_PKG},${EXT_APIS_PKG}" "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "defaulter" <<<"${GENS}"; then
   echo "Generating defaulters"
-  ${GOPATH}/bin/defaulter-gen  --input-dirs $(codegen::join , "${EXT_FQ_APIS[@]}") -O zz_generated.defaults "$@"
+  "${GOPATH}/bin/defaulter-gen"  --input-dirs "$(codegen::join , "${EXT_FQ_APIS[@]}")" -O zz_generated.defaults "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "conversion" <<<"${GENS}"; then
   echo "Generating conversions"
-  ${GOPATH}/bin/conversion-gen --input-dirs $(codegen::join , "${ALL_FQ_APIS[@]}") -O zz_generated.conversion "$@"
+  "${GOPATH}/bin/conversion-gen" --input-dirs "$(codegen::join , "${ALL_FQ_APIS[@]}")" -O zz_generated.conversion "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "client" <<<"${GENS}"; then
   echo "Generating clientset for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}"
   if [ -n "${INT_APIS_PKG}" ]; then
-    ${GOPATH}/bin/client-gen --clientset-name ${CLIENTSET_NAME_INTERNAL:-internalversion} --input-base "" --input $(codegen::join , $(printf '%s/ ' "${INT_FQ_APIS[@]}")) --output-package ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset} "$@"
+    IFS=" " read -r -a APIS <<< "$(printf '%s/ ' "${INT_FQ_APIS[@]}")"
+    "${GOPATH}/bin/client-gen" --clientset-name "${CLIENTSET_NAME_INTERNAL:-internalversion}" --input-base "" --input "$(codegen::join , "${APIS[@]}")" --output-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}" "$@"
   fi
-  ${GOPATH}/bin/client-gen --clientset-name ${CLIENTSET_NAME_VERSIONED:-versioned} --input-base "" --input $(codegen::join , "${EXT_FQ_APIS[@]}") --output-package ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset} "$@"
+  "${GOPATH}/bin/client-gen" --clientset-name "${CLIENTSET_NAME_VERSIONED:-versioned}" --input-base "" --input "$(codegen::join , "${EXT_FQ_APIS[@]}")" --output-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}" "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "lister" <<<"${GENS}"; then
   echo "Generating listers for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/listers"
-  ${GOPATH}/bin/lister-gen --input-dirs $(codegen::join , "${ALL_FQ_APIS[@]}") --output-package ${OUTPUT_PKG}/listers "$@"
+  "${GOPATH}/bin/lister-gen" --input-dirs "$(codegen::join , "${ALL_FQ_APIS[@]}")" --output-package "${OUTPUT_PKG}/listers" "$@"
 fi
 
 if [ "${GENS}" = "all" ] || grep -qw "informer" <<<"${GENS}"; then
   echo "Generating informers for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/informers"
-  ${GOPATH}/bin/informer-gen \
-           --input-dirs $(codegen::join , "${ALL_FQ_APIS[@]}") \
-           --versioned-clientset-package ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_VERSIONED:-versioned} \
-           --internal-clientset-package ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_INTERNAL:-internalversion} \
-           --listers-package ${OUTPUT_PKG}/listers \
-           --output-package ${OUTPUT_PKG}/informers \
+  "${GOPATH}/bin/informer-gen" \
+           --input-dirs "$(codegen::join , "${ALL_FQ_APIS[@]}")" \
+           --versioned-clientset-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_VERSIONED:-versioned}" \
+           --internal-clientset-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_INTERNAL:-internalversion}" \
+           --listers-package "${OUTPUT_PKG}/listers" \
+           --output-package "${OUTPUT_PKG}/informers" \
            "$@"
 fi
diff --git a/staging/src/k8s.io/code-generator/hack/update-codegen.sh b/staging/src/k8s.io/code-generator/hack/update-codegen.sh
index 2a14fe5277..89d84da410 100755
--- a/staging/src/k8s.io/code-generator/hack/update-codegen.sh
+++ b/staging/src/k8s.io/code-generator/hack/update-codegen.sh
@@ -22,15 +22,15 @@ set -o pipefail
 # - --output-base because this script should also be able to run inside the vendor dir of
 #   k8s.io/kubernetes. The output-base is needed for the generators to output into the vendor dir
 #   instead of the $GOPATH directly. For normal projects this can be dropped.
-$(dirname ${BASH_SOURCE})/../generate-internal-groups.sh all \
+"$(dirname "${BASH_SOURCE[0]}")"/../generate-internal-groups.sh all \
   k8s.io/code-generator/_examples/apiserver k8s.io/code-generator/_examples/apiserver/apis k8s.io/code-generator/_examples/apiserver/apis \
   "example:v1 example2:v1" \
-  --output-base "$(dirname ${BASH_SOURCE})/../../.."
-$(dirname ${BASH_SOURCE})/../generate-groups.sh all \
+  --output-base "$(dirname "${BASH_SOURCE[0]}")/../../.."
+"$(dirname "${BASH_SOURCE[0]}")"/../generate-groups.sh all \
   k8s.io/code-generator/_examples/crd k8s.io/code-generator/_examples/crd/apis \
   "example:v1 example2:v1" \
-  --output-base "$(dirname ${BASH_SOURCE})/../../.."
-  $(dirname ${BASH_SOURCE})/../generate-groups.sh all \
+  --output-base "$(dirname "${BASH_SOURCE[0]}")/../../.."
+"$(dirname "${BASH_SOURCE[0]}")"/../generate-groups.sh all \
   k8s.io/code-generator/_examples/MixedCase k8s.io/code-generator/_examples/MixedCase/apis \
   "example:v1" \
-  --output-base "$(dirname ${BASH_SOURCE})/../../.."
+  --output-base "$(dirname "${BASH_SOURCE[0]}")/../../.."
diff --git a/staging/src/k8s.io/code-generator/hack/verify-codegen.sh b/staging/src/k8s.io/code-generator/hack/verify-codegen.sh
index 497f2a484c..a03412c42f 100755
--- a/staging/src/k8s.io/code-generator/hack/verify-codegen.sh
+++ b/staging/src/k8s.io/code-generator/hack/verify-codegen.sh
@@ -18,8 +18,7 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-SCRIPT_ROOT=$(dirname "${BASH_SOURCE}")/..
-SCRIPT_BASE=${SCRIPT_ROOT}/../..
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 
 DIFFROOT="${SCRIPT_ROOT}/_examples"
 TMP_DIFFROOT="${SCRIPT_ROOT}/_tmp/_examples"
@@ -50,6 +49,6 @@ fi
 
 # smoke test
 echo "Smoke testing _example by compiling..."
-go build ./${SCRIPT_ROOT}/_examples/crd/...
-go build ./${SCRIPT_ROOT}/_examples/apiserver/...
-go build ./${SCRIPT_ROOT}/_examples/MixedCase/...
+go build "./${SCRIPT_ROOT}/_examples/crd/..."
+go build "./${SCRIPT_ROOT}/_examples/apiserver/..."
+go build "./${SCRIPT_ROOT}/_examples/MixedCase/..."