I get scared when I see these string interpolations in GitHub Actions.

Use `env:` instead and just work with environment variables in your shell script.

Yes, you still need to vet your script. Quoting is a common source of problems. Use shellcheck. Do not call eval/source/python/perl/whatever with untrusted input.

But you removed one layer of problems already by not pasting a value into your shell script code directly.