Expansion of environment variables as part of subject-paths does not work

[sschuberth]

We have a job-global environment variable that is successfully used in other build steps, but that does not get expanded as part of defined subject-paths, see this error.

Is some special syntax required, or is this another restriction of actions/glob?

[bdehamer]

When you have a job step which invokes a command using run you're running an instruction within a bash shell and get all of the features of the shell like environment variable expansion:

run: |
  gh release create $ORT_VERSION --notes-file RELEASE_NOTES.md \
      ./cli/build/distributions/ort-$ORT_VERSION.{tgz,zip}* \
      ./helper-cli/build/distributions/orth-$ORT_VERSION.{tgz,zip}*

When you invoke something like actions/attest-build-provenance with uses you're simply passing parameters to command and don't have the features of the bash shell available. However, you can still access environment variables using the Actions expression syntax:

- name: Attest Build Provenance
   uses: actions/attest-build-provenance@v1
   with:
     subject-path: |
       ./cli/build/distributions/ort-${{ env.ORT_VERSION }}.tgz
       ./cli/build/distributions/ort-${{ env.ORT_VERSION }}.zip
       ./helper-cli/build/distributions/orth-${{ env.ORT_VERSION }}.tgz
       ./helper-cli/build/distributions/orth-${{ env.ORT_VERSION }}.zip

[sschuberth]

My bad, you're right, thanks @bdehamer!