Environment variables set on Runner deployments are not available in workflow templates

[JossWhittle]

This is a potential bug around the interaction between ARC runners and github workflows.

In the deployment of our runners we provide them with environment variables for our proxy.

spec:
  env:
    - name: HTTP_PROXY
      value: "..."
    - name: HTTPS_PROXY
      value: "..."
    - name: NO_PROXY
      value: "..."

When a workflow job executes on the runner the environment variables are available to commands executed on the runner.

jobs:

  test-env-propagation-shell:
    runs-on:
      labels: [self-hosted, linux, x64]

    steps:
      - name: see if the env variables are set
        run:  env | grep PROXY

      - name: access variables directly
        run: |
          echo "$HTTP_PROXY"
          echo "$HTTPS_PROXY"
          echo "$NO_PROXY"

# THIS SUCCEEDS

But the template engine is not aware that these variables exist.

jobs:

  test-env-propagation-template:
    runs-on:
      labels: [self-hosted, linux, x64]

    steps:
      - name: install buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            env.http_proxy=${{ env.HTTP_PROXY }}
            env.https_proxy=${{ env.HTTPS_PROXY }}
            "env.no_proxy='${{ env.NO_PROXY }}'"

# THIS FAILS, the templates resolve to empty strings!

A work around seems to be to explicitly forward the variables from the shell into the GITHUB_ENV variable which is made available to the template engine before the next step executes.

jobs:

  test-env-propagation-shell-template:
    runs-on:
      labels: [self-hosted, linux, x64]

    steps:
      - name: forward proxy settings
        run: |
          echo "HTTP_PROXY=$HTTP_PROXY" >> $GITHUB_ENV
          echo "HTTPS_PROXY=$HTTPS_PROXY" >> $GITHUB_ENV
          echo "NO_PROXY=$NO_PROXY" >> $GITHUB_ENV

      - name: install buildx
        uses: docker/setup-buildx-action@v3
        with:
          driver-opts: |
            env.http_proxy=${{ env.HTTP_PROXY }}
            env.https_proxy=${{ env.HTTPS_PROXY }}
            "env.no_proxy='${{ env.NO_PROXY }}'"

# THIS SUCCEEDS, the templates resolve to the env variables set on the runner deployment.

---

Is this by design? Is there a neater way of handling this?