Fix potential Actions injection

[jorgectf]

Branch names are user-controlled values that can store special characters like ; allowing for command injection. By storing the branch names as environment variables, the interpolation is not done at the workflow level, instead, it's treated like a variable by bash.