fix: escape shell env vars in publish step to avoid woodpecker pre-processor

.woodpecker.yml

@@ -27,24 +27,24 @@ steps:
     image: alpine:3.20
     environment:
       REGISTRY: registry.ci.poc.mehl.mx
-      IMAGE_TAG: ${CI_COMMIT_SHA:0:8}
-      SOURCE_COMMIT: ${CI_COMMIT_SHA}
       ZOT_USERNAME:
         from_secret: zot_username
       ZOT_PASSWORD:
         from_secret: zot_password
     commands:
+      - export IMAGE_TAG=${CI_COMMIT_SHA:0:8}
+      - export SOURCE_COMMIT=${CI_COMMIT_SHA}
       - apk add --no-cache curl
       - curl -sL "https://github.com/oras-project/oras/releases/download/v1.3.4/oras_1.3.4_linux_amd64.tar.gz" -o /tmp/oras.tar.gz
       - mkdir -p /tmp/oras-install && tar -xzf /tmp/oras.tar.gz -C /tmp/oras-install
       - install /tmp/oras-install/oras /usr/local/bin/oras
       - mkdir -p /tmp/deploy-bundle
       - cp compose.yaml secrets.prod.env /tmp/deploy-bundle/
-      - echo "IMAGE_TAG=${IMAGE_TAG}" > /tmp/deploy-bundle/release.env
-      - echo "SOURCE_COMMIT=${SOURCE_COMMIT}" >> /tmp/deploy-bundle/release.env
-      - echo "REGISTRY=${REGISTRY}" >> /tmp/deploy-bundle/release.env
-      - oras login "${REGISTRY}" -u "${ZOT_USERNAME}" -p "${ZOT_PASSWORD}"
-      - cd /tmp/deploy-bundle && oras push "${REGISTRY}/poc/deploy/dummy-service:${IMAGE_TAG}" compose.yaml secrets.prod.env release.env
+      - echo "IMAGE_TAG=$${IMAGE_TAG}" > /tmp/deploy-bundle/release.env
+      - echo "SOURCE_COMMIT=$${SOURCE_COMMIT}" >> /tmp/deploy-bundle/release.env
+      - echo "REGISTRY=$${REGISTRY}" >> /tmp/deploy-bundle/release.env
+      - oras login "$${REGISTRY}" -u "$${ZOT_USERNAME}" -p "$${ZOT_PASSWORD}"
+      - cd /tmp/deploy-bundle && oras push "$${REGISTRY}/poc/deploy/dummy-service:$${IMAGE_TAG}" compose.yaml secrets.prod.env release.env
 
   - name: trigger-deployment
     image: woodpeckerci/plugin-trigger