diff --git a/.github/workflows/static-checks.yml b/.github/workflows/static-checks.yml
index 73977b59..fb3a204a 100644
--- a/.github/workflows/static-checks.yml
+++ b/.github/workflows/static-checks.yml
@@ -23,28 +23,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install flake8
-        run: sudo apt update && sudo apt -y install flake8
+        run: sudo apt update && sudo apt -y install file flake8
 
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Run Flake8
-        run: flake8 scripts/*.py
+      - name: Run Flake8 and dependencies
+        run: |
+          . scripts/functions
+          scan_files text/x-script.python flake8
 
   pylint:
     name: Install and run Pylint on Python scripts
     runs-on: ubuntu-latest
     steps:
-      - name: Install Pylint
-        run: sudo apt update && sudo apt -y install pylint
+      - name: Install Pylint and dependencies
+        run: sudo apt update && sudo apt -y install file pylint python3-voluptuous
 
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
       - name: Run Pylint (error mode)
-        run: pylint --errors-only scripts/*.py
+        run: |
+          . scripts/functions
+          scan_files text/x-script.python pylint --errors-only
 
   shellcheck:
     name: Install and run ShellCheck on shell scripts
@@ -59,12 +63,12 @@ jobs:
 
       - name: Run ShellCheck
         run: |
-          # Run shellcheck against all files outside .git/ that `file` reports
-          # as text/x-shellscript
-          #
+          . scripts/functions
+
           # Ignore the double quoting warning, script authors have better
-          # knowledge of variable contents.
-          export SHELLCHECK_OPTS="-e SC2086"
-          find . -path ./.git -prune -o -print0 | \
-            xargs -0n1 sh -c 'test "$(file --brief --mime-type "$1")" = "text/x-shellscript" && printf "%s\000" "$1"' -- | \
-            xargs -0t shellcheck
+          # knowledge of variable contents, and we accept that in practice
+          # "local" is implemented everywhere so it's OK to use even though
+          # it's not strictly POSIX.
+          export SHELLCHECK_OPTS="-e SC2086,SC3043"
+
+          scan_files text/x-shellscript shellcheck
diff --git a/ci/schemacheck.py b/ci/schemacheck.py
index e8107802..20847943 100644
--- a/ci/schemacheck.py
+++ b/ci/schemacheck.py
@@ -4,8 +4,8 @@
 import os
 import sys
 import yaml
-import voluptuous
-from lava_common.schemas import validate
+import voluptuous  # pylint: disable=import-error
+from lava_common.schemas import validate  # pylint: disable=import-error
 
 exitcode = 0
 
diff --git a/scripts/functions b/scripts/functions
new file mode 100644
index 00000000..aac97589
--- /dev/null
+++ b/scripts/functions
@@ -0,0 +1,18 @@
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# shellcheck shell=sh
+
+scan_files() {
+    # For all files under $PWD except under .git that match $mime_type, run the
+    # scanner with the remaining parameters. Return zero if all $cmd succeeded,
+    # non-zero otherwise.
+
+    local mime_type="$1"
+    shift
+
+    # shellcheck disable=SC2016
+    find . -path ./.git -prune -o -print0 | \
+      xargs -0n1 sh -c 'test "$(file --brief --mime-type "$1")" = "'"$mime_type"'" && printf "%s\000" "$1"' -- | \
+      xargs -0t -- "$@"
+}