diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..172bf57
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.tox
diff --git a/.zuul.yaml b/.zuul.yaml
index c8c9e97..a5f617f 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -53,9 +53,11 @@
 - project:
     check:
       jobs:
+        - openstack-tox-bashate
         - devstack-plugin-container-dsvm
         - devstack-plugin-container-k8s:
             voting: false
     gate:
       jobs:
+        - openstack-tox-bashate
         - devstack-plugin-container-dsvm
diff --git a/devstack/lib/cni/plugins b/devstack/lib/cni/plugins
index 2577a59..e28d911 100644
--- a/devstack/lib/cni/plugins
+++ b/devstack/lib/cni/plugins
@@ -77,7 +77,8 @@ function configure_cni_plugins {
     echo "Configuring CNI plugins"
 
     for plugin in ${CNI_PLUGINS_INSTALL_PLUGINS//,/ }; do
-        local source_config_file=$(ls ${CNI_PLUGINS_CONF_SOURCE_DIR}/*${plugin}.conf 2> /dev/null)
+        local source_config_file
+        source_config_file=$(ls ${CNI_PLUGINS_CONF_SOURCE_DIR}/*${plugin}.conf 2> /dev/null)
         if [ $source_config_file ]; then
             echo "Found config file for plugin: $plugin"
             sudo install -o "$STACK_USER" -m 0664 -t "$CNI_PLUGINS_CONF_DIR" -D \
diff --git a/devstack/lib/crio b/devstack/lib/crio
index b3c9f4f..21c59f9 100644
--- a/devstack/lib/crio
+++ b/devstack/lib/crio
@@ -26,10 +26,10 @@ CRIO_ENGINE_SOCKET_FILE=${CRIO_ENGINE_SOCKET_FILE:-/var/run/crio/crio.sock}
 
 function check_crio {
     if is_ubuntu; then
-       dpkg -l | grep crio-o > /dev/null 2>&1
+        dpkg -l | grep crio-o > /dev/null 2>&1
     else
-       false
-       # TODO: CentOS/Fedora support.
+        false
+        # TODO: CentOS/Fedora support.
     fi
 }
 
@@ -40,7 +40,8 @@ function install_crio {
 
     local lsb_dist=${os_VENDOR,,}
     local dist_version=${os_CODENAME}
-    local arch=$(dpkg --print-architecture)
+    local arch
+    arch=$(dpkg --print-architecture)
     if is_ubuntu; then
         apt_get install apt-transport-https ca-certificates software-properties-common
         sudo add-apt-repository -y ppa:projectatomic/ppa
diff --git a/devstack/lib/docker b/devstack/lib/docker
index 2558519..c617671 100644
--- a/devstack/lib/docker
+++ b/devstack/lib/docker
@@ -42,9 +42,9 @@ CONTAINERD_CONF=$CONTAINERD_CONF_DIR/config.toml
 
 function check_docker {
     if is_ubuntu; then
-       dpkg -s docker-engine > /dev/null 2>&1 || dpkg -s docker-ce > /dev/null 2>&1
+        dpkg -s docker-engine > /dev/null 2>&1 || dpkg -s docker-ce > /dev/null 2>&1
     else
-       rpm -q docker-engine > /dev/null 2>&1 || rpm -q docker > /dev/null 2>&1 || rpm -q docker-ce > /dev/null 2>&1
+        rpm -q docker-engine > /dev/null 2>&1 || rpm -q docker > /dev/null 2>&1 || rpm -q docker-ce > /dev/null 2>&1
     fi
 }
 
@@ -55,7 +55,8 @@ function install_docker {
 
     local lsb_dist=${os_VENDOR,,}
     local dist_version=${os_CODENAME}
-    local arch=$(dpkg --print-architecture)
+    local arch
+    arch=$(dpkg --print-architecture)
     if is_ubuntu; then
         if [[ ${dist_version} == 'trusty' ]]; then
             if uname -r | grep -q -- '-generic' && dpkg -l 'linux-image-*-generic' | grep -qE '^ii|^hi' 2>/dev/null; then
diff --git a/devstack/lib/k8s b/devstack/lib/k8s
index 7a2897a..bb06bb9 100644
--- a/devstack/lib/k8s
+++ b/devstack/lib/k8s
@@ -58,7 +58,8 @@ function install_kubeadm {
 }
 
 function kubeadm_init {
-    local kubeadm_config_file=$(mktemp)
+    local kubeadm_config_file
+    kubeadm_config_file=$(mktemp)
     cat <<EOF | sudo tee $kubeadm_config_file >/dev/null
 apiVersion: kubeadm.k8s.io/v1beta1
 kind: ClusterConfiguration
@@ -96,7 +97,8 @@ EOF
 }
 
 function kubeadm_join {
-    local kubeadm_config_file=$(mktemp)
+    local kubeadm_config_file
+    kubeadm_config_file=$(mktemp)
     cat <<EOF | sudo tee $kubeadm_config_file >/dev/null
 apiVersion: kubeadm.k8s.io/v1beta1
 kind: JoinConfiguration
diff --git a/tox.ini b/tox.ini
new file mode 100644
index 0000000..481edd1
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,35 @@
+[tox]
+minversion = 1.6
+skipsdist = True
+envlist = bashate
+
+[testenv]
+usedevelop = False
+install_command = pip install {opts} {packages}
+
+[testenv:bashate]
+basepython = python3
+# if you want to test out some changes you have made to bashate
+# against devstack, just set BASHATE_INSTALL_PATH=/path/... to your
+# modified bashate tree
+deps =
+   {env:BASHATE_INSTALL_PATH:bashate==0.5.1}
+whitelist_externals = bash
+commands = bash -c "find {toxinidir}             \
+         -not \( -type d -name .?\* -prune \)    \
+         -not \( -type d -name doc -prune \)     \
+         -not \( -type f -name localrc -prune \) \
+         -type f                                 \
+         -not -name \*~                          \
+         -not -name \*.md                        \
+         -not -name stack-screenrc               \
+         -not -name \*.orig                      \
+         -not -name \*.rej                       \
+         \(                                      \
+          -name \*.sh -or                        \
+          -name \*rc -or                         \
+          -name functions\* -or                  \
+          -wholename \*/inc/\* -or               \
+          -wholename \*/lib/\*                   \
+         \)                                      \
+         -print0 | xargs -0 bashate -v -iE006 -eE005,E042"