Fix shell injection: pass github.ref_name via env var in deploy workflow

Author: MichaelGHSeg

.github/workflows/deploy.yml

@@ -86,7 +86,8 @@ jobs:
       - name: Create GitHub release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          gh release create "${{ github.ref_name }}" \
-            --title "${{ github.ref_name }}" \
+          gh release create "$REF_NAME" \
+            --title "$REF_NAME" \
             --generate-notes