ci: mitigate template injection risk in workflow

Signed-off-by: Arpit Tripathi <arpittripathiayo@gmail.com>

Author: nexpectArpit

.github/workflows/build-push.yaml

@@ -54,13 +54,16 @@ jobs:
 
       - name: Read quay image expiry
         id: quay-expiry
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          REF_TYPE: ${{ github.ref_type }}
         run: |
-          if [[ "${{ github.ref_name }}" == "main" || "${{ github.ref_type }}" == "tag" && "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-.*)?$ ]]; then
+          if [[ "$REF_NAME" == "main" || ( "$REF_TYPE" == "tag" && "$REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-.*)?$ ) ]]; then
             echo "expiry=never" >> $GITHUB_OUTPUT
-            echo "Setting expiry to 'never' for ref ${{ github.ref_name }}"
+            echo "Setting expiry to 'never' for ref $REF_NAME"
           else
             echo "expiry=3w" >> $GITHUB_OUTPUT
-            echo "Setting expiry to '3w' for ref ${{ github.ref_name }}"
+            echo "Setting expiry to '3w' for ref $REF_NAME"
           fi
 
       - name: Build and Push Image