diff --git a/.github/workflows/bash_code_analysis.yaml b/.github/workflows/bash_code_analysis.yaml
index 4e0559031c..f80f9cd97b 100644
--- a/.github/workflows/bash_code_analysis.yaml
+++ b/.github/workflows/bash_code_analysis.yaml
@@ -3,7 +3,7 @@ on:
   push:
     branches:
       - develop
-  pull_request:
+  pull_request_target: # safe as long as code is not being run
 
   workflow_dispatch:
 
@@ -19,19 +19,35 @@ jobs:
       checks: write
 
     steps:
+      - name: determine hash
+        uses: haya14busa/action-cond@v1
+        id: hash
+        with:
+          cond: ${{ github.event_name == 'pull_request' }}
+          if_true: ${{ github.event.pull_request.head.sha }}
+          if_false: ''
+
       - name: checkout code
         uses: actions/checkout@v6
         with:
+          ref: ${{ steps.hash.outputs.value }}
           submodules: false
 
+      - name: determine reporter
+        uses: haya14busa/action-cond@v1
+        id: reporter
+        with:
+          cond: ${{ github.event_name == 'pull_request' }}
+          if_true: 'github-pr-review'
+          if_false: 'github-check'
+
       - name: shfmt scan
         uses: reviewdog/action-shfmt@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           filter_mode: nofilter
-          fail_level: any
           level: any
-          reviewdog_flags: '-reporter=github-pr-review'
+          reviewdog_flags: '-reporter=${{ steps.reporter.outputs.value }} -fail_level=any'
           shfmt_flags: ''
 
   shellcheck:
@@ -44,16 +60,33 @@ jobs:
       checks: write
 
     steps:
+      - name: determine hash
+        uses: haya14busa/action-cond@v1
+        id: hash
+        with:
+          cond: ${{ github.event_name == 'pull_request' }}
+          if_true: ${{ github.event.pull_request.head.sha }}
+          if_false: ''
+
       - name: checkout code
         uses: actions/checkout@v6
         with:
+          ref: ${{ steps.hash.outputs.value }}
           submodules: false
-      
+
+      - name: determine reporter
+        uses: haya14busa/action-cond@v1
+        id: reporter
+        with:
+          cond: ${{ github.event_name == 'pull_request' }}
+          if_true: 'github-pr-review'
+          if_false: 'github-check'
+
       - name: shellcheck scan
         uses: reviewdog/action-shellcheck@v1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          reporter: github-pr-review
+          reporter: ${{ steps.reporter.outputs.value }}
           filter_mode: nofilter
           fail_level: any
           level: any
diff --git a/README.md b/README.md
index 211f329d89..84f84b8bf4 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 [![Read The Docs Status](https://readthedocs.org/projects/global-workflow/badge/?badge=latest)](http://global-workflow.readthedocs.io/)
-[![shellnorms](https://github.com/NOAA-EMC/global-workflow/actions/workflows/linters.yaml/badge.svg)](https://github.com/NOAA-EMC/global-workflow/actions/workflows/linters.yaml)
-[![pynorms](https://github.com/NOAA-EMC/global-workflow/actions/workflows/pynorms.yaml/badge.svg)](https://github.com/NOAA-EMC/global-workflow/actions/workflows/pynorms.yaml)
+[![bash code analysis](https://github.com/NOAA-EMC/global-workflow/workflows/bash_code_analysis/badge.svg?branch=develop&event=push)](https://github.com/NOAA-EMC/global-workflow/actions?query=workflow%3Abash_code_analysis+event%3Apush+branch%3Adevelop)
+[![python code analysis](https://github.com/NOAA-EMC/global-workflow/workflows/python_code_analysis/badge.svg)](https://github.com/NOAA-EMC/global-workflow/actions?query=workflow%3Apython_code_analysis+event%3Apush+branch%3Adevelop)
 ![Custom badge](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/emcbot/e35aa2904a54deae6bbb1fdc2d960c71/raw/wcoss2.json)
 
 ![Custom badge](https://gist.githubusercontent.com/emcbot/66059582886cb5c2485ff64bf24e7f93/raw/ursa_pipeline_badge.svg)