diff --git a/.github/actions/build_and_publish_image/action.yaml b/.github/actions/build_and_publish_image/action.yaml
index 14e9b2bc..4632b8d0 100644
--- a/.github/actions/build_and_publish_image/action.yaml
+++ b/.github/actions/build_and_publish_image/action.yaml
@@ -47,16 +47,16 @@ runs:
     - shell: bash
       run: |
         set -x
-        echo ${{ inputs.github_personal_access_token }} | docker login ghcr.io -u ${{ inputs.github_username }} --password-stdin
+        echo "${{ inputs.github_personal_access_token }}" | docker login ghcr.io -u "${{ inputs.github_username }}" --password-stdin
         export BUILD_ARGS=""
         if [[ -n "${{ inputs.build_args }}" ]]; then
           IFS=";" read -ra args <<< "${{ inputs.build_args }}"
           for arg in ${args[@]}; do
             BUILD_ARGS+="--build-arg $arg "
-            if [[ $arg =~ UBUNTU_RELEASE ]]; then
+            if [[ "$arg" =~ "UBUNTU_RELEASE" ]]; then
               # pull latest base image
               eval "export $arg"
-              docker pull ubuntu:${UBUNTU_RELEASE?}
+              docker pull "ubuntu:${UBUNTU_RELEASE?}"
             fi
           done
         fi
@@ -64,19 +64,19 @@ runs:
         export IMAGE_TAG_URL_PREFIX=ghcr.io/selkies-project/selkies-gstreamer/
         export IMAGE_TAG_1="${IMAGE_TAG_URL_PREFIX}${{ inputs.image_name }}:${{ inputs.image_version_1 }}"
         if [[ "${{ inputs.use_cache }}" == "true" ]]; then
-          docker pull $IMAGE_TAG_1 || true
-          (cd ${{ inputs.image_source_directory }} && docker build $BUILD_ARGS -f ${{ inputs.dockerfile }} --cache-from $IMAGE_TAG_1 -t $IMAGE_TAG_1 .)
+          docker pull "$IMAGE_TAG_1" || true
+          (cd "${{ inputs.image_source_directory" }} && docker build $BUILD_ARGS -f "${{ inputs.dockerfile }}" --cache-from "$IMAGE_TAG_1" -t "$IMAGE_TAG_1" .)
         else
-          (cd ${{ inputs.image_source_directory }} && docker build $BUILD_ARGS -f ${{ inputs.dockerfile }} -t $IMAGE_TAG_1 .)
+          (cd "${{ inputs.image_source_directory" }} && docker build $BUILD_ARGS -f "${{ inputs.dockerfile }}" -t "$IMAGE_TAG_1" .)
         fi
         if [[ "${{ inputs.push_image }}" == "true" ]]; then
-          docker push $IMAGE_TAG_1
+          docker push "$IMAGE_TAG_1"
         fi
 
-        if [ '${{ inputs.image_version_2 }}' != '' ]; then
+        if [[ ! -z "${{ inputs.image_version_2 }}" ]]; then
           export IMAGE_TAG_2="${IMAGE_TAG_URL_PREFIX}${{ inputs.image_name }}:${{ inputs.image_version_2 }}"
-          docker tag $IMAGE_TAG_1 $IMAGE_TAG_2
+          docker tag "$IMAGE_TAG_1" "$IMAGE_TAG_2"
           if [[ "${{ inputs.push_image }}" == "true" ]]; then
-            docker push $IMAGE_TAG_2
+            docker push "$IMAGE_TAG_2"
           fi
         fi
diff --git a/.github/workflows/publish_release.yaml b/.github/workflows/publish_release.yaml
index 79acc6a4..9f9fa09b 100644
--- a/.github/workflows/publish_release.yaml
+++ b/.github/workflows/publish_release.yaml
@@ -21,10 +21,10 @@ jobs:
         run: |
           # If ref name does not match semver, default to 0.0.0.
           # This happens when running from a branch name like main.
-          if [[ ${RELEASE_VERSION} =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
-            echo semver=${RELEASE_VERSION/v/} >> $GITHUB_OUTPUT
+          if [[ "${RELEASE_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+            echo "semver=${RELEASE_VERSION/v/}" >> "$GITHUB_OUTPUT"
           else
-            echo semver=0.0.0 >> $GITHUB_OUTPUT
+            echo "semver=0.0.0" >> "$GITHUB_OUTPUT"
           fi
 
   # Note: When modifying this job, copy modifications to all other workflows' image jobs.
@@ -222,31 +222,30 @@ jobs:
     steps:
       - id: extract
         run: |
-          echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
           cat - > /tmp/sa_key.json <<EOF
           ${{ secrets.GCP_ACTIONS_SA_KEY }}
           EOF
           gcloud -q auth activate-service-account --key-file /tmp/sa_key.json
 
-          docker create --name copy ${{ matrix.image_tag }}
-          TARGET_PATH=${{ matrix.target_directory }}/${{ matrix.target_name }}
-          if [[ ${{ matrix.source_path }} == *\.whl || ${{ matrix.source_path }} == *\.tgz ]]
-          then
-            docker cp copy:${{ matrix.source_path }} $TARGET_PATH
+          docker create --name copy "${{ matrix.image_tag }}"
+          TARGET_PATH="${{ matrix.target_directory }}/${{ matrix.target_name }}"
+          if [[ -f "${{ matrix.source_path }}" ]]; then
+            docker cp "copy:${{ matrix.source_path }}" "$TARGET_PATH"
           else
             (
-              cd ${{ matrix.target_directory }} &&
-              docker cp copy:${{ matrix.source_path }} ./temp &&
-              tar -zcvf $TARGET_PATH temp
+              cd "${{ matrix.target_directory }}" &&
+              docker cp "copy:${{ matrix.source_path }}" ./temp &&
+              tar -zcvf "$TARGET_PATH" temp
             )
           fi
           docker rm copy
-          gsutil cp $TARGET_PATH ${{ matrix.upload_bucket_path }}
+          gsutil cp "$TARGET_PATH" "${{ matrix.upload_bucket_path }}"
 
-          echo ${{ matrix.id }}_cache_key=${{ matrix.cache_key }} >> $GITHUB_OUTPUT
-          echo ${{ matrix.id }}_mimetype=${{ matrix.mimetype }} >> $GITHUB_OUTPUT
-          echo ${{ matrix.id }}_name=${{ matrix.target_name }} >> $GITHUB_OUTPUT
-          echo ${{ matrix.id }}_path=$TARGET_PATH >> $GITHUB_OUTPUT
+          echo "${{ matrix.id }}_cache_key=${{ matrix.cache_key }}" >> "$GITHUB_OUTPUT"
+          echo "${{ matrix.id }}_mimetype=${{ matrix.mimetype }}" >> "$GITHUB_OUTPUT"
+          echo "${{ matrix.id }}_name=${{ matrix.target_name }}" >> "$GITHUB_OUTPUT"
+          echo "${{ matrix.id }}_path=$TARGET_PATH" >> "$GITHUB_OUTPUT"
 
       - uses: actions/cache@v3
         with: