ci: wrap with expression syntax for safety

Author: brc-dd

.github/workflows/cr-comment.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   cr_comment:
-    if: github.event.issue.pull_request && (github.event.comment.user.id == github.event.issue.user.id || contains('OWNER,MEMBER,COLLABORATOR', github.event.comment.author_association)) && startsWith(github.event.comment.body, '/publish')
+    if: ${{ github.event.issue.pull_request && (github.event.comment.user.id == github.event.issue.user.id || contains('OWNER,MEMBER,COLLABORATOR', github.event.comment.author_association)) && startsWith(github.event.comment.body, '/publish') }}
     runs-on: ubuntu-latest
 
     steps: