diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3acd3eb..54763d8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,11 @@ on:
 env:
   TEST_IMAGE_NAME: hadolint-action:${{github.sha}}
 
+permissions:
+  contents: write
+  issues: write # Used by Release step to update "The automated release is failing" issue
+  pull-requests: write # Used by ShellCheck Action to add comments on PR
+
 jobs:
   lint:
     name: Lint
@@ -21,9 +26,6 @@ jobs:
   shellcheck:
     name: ShellCheck
     runs-on: ubuntu-20.04
-    permissions:
-      contents: read
-      pull-requests: write
     steps:
       - uses: actions/checkout@v3
       - name: Run ShellCheck
@@ -120,8 +122,6 @@ jobs:
     name: Release
     runs-on: ubuntu-20.04
     needs: integration-tests
-    permissions:
-      contents: write
     steps:
       - uses: actions/checkout@v2
       - uses: cycjimmy/semantic-release-action@v3
diff --git a/hadolint.sh b/hadolint.sh
index d0024ff..d28035d 100755
--- a/hadolint.sh
+++ b/hadolint.sh
@@ -5,14 +5,14 @@
 
 PROBLEM_MATCHER_FILE="/problem-matcher.json"
 if [ -f "$PROBLEM_MATCHER_FILE" ]; then
-    cp "$PROBLEM_MATCHER_FILE" "$HOME/"
+  cp "$PROBLEM_MATCHER_FILE" "$HOME/"
 fi
 # After the run has finished we remove the problem-matcher.json from
 # the repository so we don't leave the checkout dirty. We also remove
 # the matcher so it won't take effect in later steps.
 # shellcheck disable=SC2317
 cleanup() {
-    echo "::remove-matcher owner=brpaz/hadolint-action::"
+  echo "::remove-matcher owner=brpaz/hadolint-action::"
 }
 trap cleanup EXIT
 
@@ -23,7 +23,7 @@ if [ -n "$HADOLINT_CONFIG" ]; then
 fi
 
 if [ -z "$HADOLINT_TRUSTED_REGISTRIES" ]; then
-  unset HADOLINT_TRUSTED_REGISTRIES;
+  unset HADOLINT_TRUSTED_REGISTRIES
 fi
 
 COMMAND="hadolint $HADOLINT_CONFIG"
@@ -32,7 +32,6 @@ if [ "$HADOLINT_RECURSIVE" = "true" ]; then
   shopt -s globstar
 
   filename="${!#}"
-
   flags="${*:1:$#-1}"
 
   RESULTS=$(eval "$COMMAND $flags" -- **/"$filename")
@@ -46,14 +45,22 @@ if [ -n "$HADOLINT_OUTPUT" ]; then
   if [ -f "$HADOLINT_OUTPUT" ]; then
     HADOLINT_OUTPUT="$TMP_FOLDER/$HADOLINT_OUTPUT"
   fi
-  echo "$RESULTS" > "$HADOLINT_OUTPUT"
+  echo "$RESULTS" >"$HADOLINT_OUTPUT"
 fi
 
 RESULTS="${RESULTS//$'\\n'/''}"
 
-{ echo "results<<EOF"; echo "$RESULTS"; echo "EOF"; } >> "$GITHUB_OUTPUT"
+{
+  echo "results<<EOF"
+  echo "$RESULTS"
+  echo "EOF"
+} >>"$GITHUB_OUTPUT"
 
-{ echo "HADOLINT_RESULTS<<EOF"; echo "$RESULTS"; echo "EOF"; } >> "$GITHUB_ENV"
+{
+  echo "HADOLINT_RESULTS<<EOF"
+  echo "$RESULTS"
+  echo "EOF"
+} >>"$GITHUB_ENV"
 
 [ -z "$HADOLINT_OUTPUT" ] || echo "Hadolint output saved to: $HADOLINT_OUTPUT"