diff --git a/lib/roger/release/finalizers/git_branch.rb b/lib/roger/release/finalizers/git_branch.rb
index <HASH>..<HASH> 100644
--- a/lib/roger/release/finalizers/git_branch.rb
+++ b/lib/roger/release/finalizers/git_branch.rb
@@ -58,15 +58,15 @@ module Roger::Release::Finalizers
         FileUtils.cp_r @release.build_path.to_s + "/.", clone_dir.to_s
 
         commands = [
-          %w(git add .), # 4. Add all files
-          %w(git commit -q -a -m) << "Release #{@release.scm.version}" # 5. Commit
+          "git add .", # 4. Add all files
+          %(git commit -q -m "Release #{Shellwords.escape(release.scm.version)}") # 5. Commit
         ]
 
         # 6. Git push if in options
-        commands << (%w(git push origin) << branch) if @options[:push]
+        commands << ("git push origin" << Shellwords.escape(branch)) if @options[:push]
 
         commands.each do |command|
-          `#{Shellwords.join(command)}`
+          `#{command}`
         end
       end
     end
Escape user input instead of all input in git branch finalizer

This fixes the test on Windows as it would run
> git commit -q -m Release\ <I>
which does not work on Windows.

Also removed -a from commit as it does nothing after `git add .`