diff --git a/.github/scripts/update_changelog.sh b/.github/scripts/update_changelog.sh
index b7607ab..81d69b6 100755
--- a/.github/scripts/update_changelog.sh
+++ b/.github/scripts/update_changelog.sh
@@ -10,22 +10,22 @@ fi
 
 set -u
 
-SRC_DIR=$(cd $(dirname ${BASH_SOURCE:-$0})/../../; pwd)
+SRC_DIR=$(cd "$(dirname "${BASH_SOURCE:-$0}")"/../../; pwd)
 
 generate_changelog() {
-    if [ $(git tag -l "v$1") ]; then
+    if [ "$(git tag -l "v$1")" ]; then
         echo "git tag exists. re-generating CHANGELOG.md"
-        git-chglog--tag-filter-pattern="v.*\..*\..*" > CHANGELOG.md
+        git-chglog --tag-filter-pattern="v.*\..*\..*" > CHANGELOG.md
     else
-        git tag v$1
+        git tag "v$1"
         mv CHANGELOG.md CHANGELOG.md.bak
-        cat <(git-chglog --tag-filter-pattern="v.*\..*\..*" v$1)  <(cat CHANGELOG.md.bak | grep -v "\[Unreleased\]" | grep -v 'name="unreleased"') > CHANGELOG.md
+        cat <(git-chglog --tag-filter-pattern="v.*\..*\..*" "v$1")  <(cat CHANGELOG.md.bak | grep -v "\[Unreleased\]" | grep -v 'name="unreleased"') > CHANGELOG.md
         rm CHANGELOG.md.bak
-        git tag -d v$1 > /dev/null
+        git tag -d "v$1" > /dev/null
     fi
 }
 
-cd $SRC_DIR
+cd "$SRC_DIR"
 git fetch --tags -f
 git checkout main
 git pull origin main
@@ -33,4 +33,4 @@ if [[ -z "$(git tag -l)" ]]; then
     echo no tags found
     exit 1
 fi
-generate_changelog $1
\ No newline at end of file
+generate_changelog "$1"
\ No newline at end of file
diff --git a/.github/workflows/check-release-condition.yml b/.github/workflows/check-release-condition.yml
index 2fdf0b1..b74c612 100644
--- a/.github/workflows/check-release-condition.yml
+++ b/.github/workflows/check-release-condition.yml
@@ -14,28 +14,32 @@ jobs:
           PR_TITLE: ${{ github.event.pull_request.title }}
         id: release
         run: |
-          echo $PR_TITLE | grep -E "release:? v[0-9\-\.]*" || exit 1
-          VERSION=$(echo $PR_TITLE | sed -E 's/.* (v[0-9\-\.]*)/\1/g')
-          echo $VERSION
-          echo ::set-output name=version::$VERSION
+          echo "$PR_TITLE" | grep -E "^release:? v[0-9]+(\.[0-9]+)*$" || exit 1
+          VERSION=$(echo "$PR_TITLE" | sed -nE 's/^release:? (v[0-9]+(\.[0-9]+)*)$/\1/p')
+          echo "$VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
       - name: Dump poetry version
         id: poetry
         run: |
           VERSION=$(grep version pyproject.toml | sed -E 's/.* "([0-9\-\.]*)"/v\1/g')
-          echo $VERSION
-          echo ::set-output name=version::$VERSION
+          echo "$VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
       - name: Check version
+        env:
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+          POETRY_VERSION: ${{ steps.poetry.outputs.version }}
         run: |
-          if [[ "${{ steps.release.outputs.version }}" == "${{ steps.poetry.outputs.version }}" ]]; then
+          if [[ "$RELEASE_VERSION" == "$POETRY_VERSION" ]]; then
             echo "VERSION MATCH"
           else
             echo "VERSION MISMATCH"
             exit 1
           fi
       - name: Check CHANGELOG
+        env:
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
         run: |
-          
-          if [[ $(grep "${{ steps.release.outputs.version }}" CHANGELOG.md) == "" ]]; then
-            echo "VERSION MISMATCH"
+          if ! grep -Fq "$RELEASE_VERSION" CHANGELOG.md; then
+            echo "VERSION NOT FOUND IN CHANGELOG"
             exit 1
           fi
diff --git a/.github/workflows/version-tag.yml b/.github/workflows/version-tag.yml
index d59663c..460087f 100644
--- a/.github/workflows/version-tag.yml
+++ b/.github/workflows/version-tag.yml
@@ -6,12 +6,13 @@ on:
 jobs:
   version-tag:
     runs-on: ubuntu-latest
+    if: github.actor == github.repository_owner
     steps:
       - name: checkout
         uses: actions/checkout@v6
       - name: tag
         run: |
-          git remote set-url origin https://${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git
+          git remote set-url origin "https://${{ secrets.GITHUB_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git" 2>/dev/null
           git tag $(basename ${TAG%.*.*})
           git tag $(basename ${TAG%.*})
           git push origin -f --tags