ci: wrap untrusted input into variables

to avoid potential script injection

see: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

.github/workflows/ci.yml

@@ -47,7 +47,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: |
           npm config set //registry.npmjs.org/:_authToken "${NPM_TOKEN}"
-          preid=$(sed -e s:/:-:g <<<${{ github.head_ref }}).${{ github.run_number }}.${{ github.run_attempt }}
+          preid="${HEAD_REF//\//-}".${{ github.run_number }}.${{ github.run_attempt }}
           npm --no-git-tag-version version prerelease --preid="${preid}"
           pnpm publish --no-git-checks --access public --tag development