Use env to avoid script injection in CI workflow

[timmc-edx]

I haven't tested this, and I'm not sure if the output can contain anything usable in an exploit, but using env variables for untrusted input is recommended in general:

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#example-of-a-script-injection-attack

[lorenzo]

bundled your changes with #68, thanks!