diff --git a/.github/actions/before-install/action.yml b/.github/actions/before-install/action.yml
index eeab321e02..0791e3069b 100644
--- a/.github/actions/before-install/action.yml
+++ b/.github/actions/before-install/action.yml
@@ -4,7 +4,6 @@ inputs:
   act:
     description: 'enable act debug'
     required: false
-    type: boolean
     default: 'false'
 runs:
   using: "composite"
diff --git a/.github/actions/enable-dryrun/action.yml b/.github/actions/enable-dryrun/action.yml
index 55222490ec..c59c22c40e 100644
--- a/.github/actions/enable-dryrun/action.yml
+++ b/.github/actions/enable-dryrun/action.yml
@@ -5,8 +5,7 @@ inputs:
   dry-run-flag:
     description: 'enable dryrun'
     required: false
-    type: boolean
-    default: true
+    default: 'true'
 
 outputs:
   dryrun:
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index 00f35a4057..829db22985 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -8,12 +8,10 @@ inputs:
   full-setup:
     description: 'Run git-latest-tag, npm-tag, and before-install (requires fetch-depth: 0). Set to false for matrix jobs that only need node/cache.'
     required: false
-    type: boolean
     default: 'true'
   act:
     description: 'enable act debug'
     required: false
-    type: boolean
     default: 'false'
 outputs:
   npm-tag:
diff --git a/.github/workflows/build-lib-workflow.yml b/.github/workflows/build-lib-workflow.yml
index e81e4cd8b8..e5692af49c 100644
--- a/.github/workflows/build-lib-workflow.yml
+++ b/.github/workflows/build-lib-workflow.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Build affected libs
         env:
           BASE_REF: ${{ inputs.base_ref }}
-        run: pnpm nx affected --target=build --base=origin/$BASE_REF --head=HEAD --configuration=production --exclude=stories
+        run: pnpm nx affected --target=build --base="origin/$BASE_REF" --head=HEAD --configuration=production --exclude=stories
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 371fe5e0fa..200ef445c4 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -68,16 +68,16 @@ jobs:
         run: |
           if [ "${{ github.event_name }}" != "pull_request" ]; then
             echo "Not a PR event — assuming code changed"
-            echo "code-changed=true" >> $GITHUB_OUTPUT
+            echo "code-changed=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          FILES=$(gh api /repos/$GITHUB_REPOSITORY/pulls/${{ github.event.pull_request.number }}/files --paginate --jq '.[].filename')
+          FILES=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/${{ github.event.pull_request.number }}/files" --paginate --jq '.[].filename')
 
           CODE_CHANGED="false"
           while IFS= read -r file; do
             case "$file" in
-              *.md|docs/*|.github/*.md|.github/CODEOWNERS|.github/dependabot.yml|LICENSE*|NOTICE*|.editorconfig|.gitattributes)
+              *.md|docs/*|.github/CODEOWNERS|.github/dependabot.yml|LICENSE*|NOTICE*|.editorconfig|.gitattributes)
                 ;;
               *)
                 CODE_CHANGED="true"
@@ -86,7 +86,7 @@ jobs:
             esac
           done <<< "$FILES"
 
-          echo "code-changed=$CODE_CHANGED" >> $GITHUB_OUTPUT
+          echo "code-changed=$CODE_CHANGED" >> "$GITHUB_OUTPUT"
           echo "Code changed: $CODE_CHANGED"
 
   check-if-pr-is-approved:
@@ -134,7 +134,7 @@ jobs:
             skip="true"
           fi
 
-          echo "skip=$skip" >> $GITHUB_OUTPUT
+          echo "skip=$skip" >> "$GITHUB_OUTPUT"
 
       - name: Get PR number
         if: ${{ steps.skip-check.outputs.skip != 'true' }}
@@ -146,7 +146,7 @@ jobs:
           if [ -z "$PR_NUMBER" ]; then
             PR_NUMBER=$(gh pr view --json number --jq '.number' 2>/dev/null || echo "")
           fi
-          echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
           echo "PR: $PR_NUMBER"
 
       - name: Check if PR is approved
@@ -156,7 +156,7 @@ jobs:
           PR_NUMBER: ${{ steps.pr-number.outputs.pr_number }}
         run: |
           echo "Checking approval for PR: $PR_NUMBER"
-          checkApproval=$(gh api /repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews | jq '.[] | select(.state == "APPROVED") | .user.login')
+          checkApproval=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews" | jq '.[] | select(.state == "APPROVED") | .user.login')
           if [[ $checkApproval ]]; then
             echo -e "\033[32mPR approved\033[0m"
           else
@@ -209,7 +209,7 @@ jobs:
       - name: Run lint
         env:
           BASE_REF: ${{ github.base_ref || 'develop' }}
-        run: pnpm nx affected --target=lint --base=origin/$BASE_REF --head=HEAD
+        run: pnpm nx affected --target=lint --base="origin/$BASE_REF" --head=HEAD
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache
@@ -243,7 +243,7 @@ jobs:
         env:
           BASE_REF: ${{ github.base_ref || 'develop' }}
         run: |
-          pnpm nx affected --target=build-storybook --base=origin/$BASE_REF --head=HEAD --configuration=ci
+          pnpm nx affected --target=build-storybook --base="origin/$BASE_REF" --head=HEAD --configuration=ci
       - name: Save nx cache
         if: ${{ success() }}
         uses: ./.github/actions/save-nx-cache
diff --git a/.github/workflows/unit-test-workflow.yml b/.github/workflows/unit-test-workflow.yml
index 9de5b882cd..7cb5bd7322 100644
--- a/.github/workflows/unit-test-workflow.yml
+++ b/.github/workflows/unit-test-workflow.yml
@@ -46,19 +46,19 @@ jobs:
             AFFECTED_UNIT=$(pnpm nx show projects --target=test --select=projects --plain --exclude=cli,stories,eslint-angular)
           else
             echo "Base ref is $BASE_REF"
-            AFFECTED_UNIT=$(pnpm nx show projects --affected --target=test --base=origin/$BASE_REF --head=HEAD --select=projects --plain --exclude=cli,stories,eslint-angular)
+            AFFECTED_UNIT=$(pnpm nx show projects --affected --target=test --base="origin/$BASE_REF" --head=HEAD --select=projects --plain --exclude=cli,stories,eslint-angular)
           fi
           echo "Affected projects for UNIT: $AFFECTED_UNIT"
 
           if [ -z "$AFFECTED_UNIT" ]; then
             echo "No affected projects found"
-            echo "hasProjects=false" >> $GITHUB_OUTPUT
-            echo "unitMatrix=[]" >> $GITHUB_OUTPUT
+            echo "hasProjects=false" >> "$GITHUB_OUTPUT"
+            echo "unitMatrix=[]" >> "$GITHUB_OUTPUT"
           else
             UNIT_MATRIX_JSON=$(echo "$AFFECTED_UNIT" | xargs -n1 | jq -R -s -c 'split("\n") | map(select(length > 0)) | map({ "project": . })')
             echo "Matrix UNIT: $UNIT_MATRIX_JSON"
-            echo "hasProjects=true" >> $GITHUB_OUTPUT
-            echo "unitMatrix=$UNIT_MATRIX_JSON" >> $GITHUB_OUTPUT
+            echo "hasProjects=true" >> "$GITHUB_OUTPUT"
+            echo "unitMatrix=$UNIT_MATRIX_JSON" >> "$GITHUB_OUTPUT"
           fi
       - name: Save nx cache
         if: ${{ success() }}