chore: fix more issues

Author: rjaegers

.github/workflows/release-build.yml

@@ -81,7 +81,7 @@ jobs:
       - name: Update package details in release
         run: |
           set -Eeuo pipefail
-          UPDATED_NOTES=$(gh release view ${REF_NAME} --json body -q '.body')
+          UPDATED_NOTES=$(gh release view "${REF_NAME}" --json body -q '.body')
           UPDATED_NOTES=${UPDATED_NOTES//"{{ amp-devcontainer-${CONTAINER_FLAVOR}-version }}"/"${REF_NAME}"}
           UPDATED_NOTES=${UPDATED_NOTES//"{{ amp-devcontainer-${CONTAINER_FLAVOR}-sha }}"/"${DIGEST}"}
           gh release edit "${REF_NAME}" --notes "${UPDATED_NOTES}"

.github/workflows/wc-acceptance-test.yml

@@ -72,7 +72,7 @@ jobs:
           done
         env:
           GH_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
-      - run: cd test/${CONTAINER_FLAVOR}/features && npm test
+      - run: cd "test/${CONTAINER_FLAVOR}/features" && npm test
         env:
           CONTAINER_FLAVOR: ${{ inputs.flavor }}
           GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}

.github/workflows/wc-build-push.yml

@@ -48,7 +48,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ inputs.flavor }}
       # Generate image LABEL for devcontainer.metadata
       # the sed expression is a workaround for quotes being eaten in arrays (e.g. ["x", "y", "z"] -> ["x",y,"z"])
-      - run: echo "metadata=$(jq -cj '[.]' .devcontainer/${CONTAINER_FLAVOR}/devcontainer-metadata-vscode.json | sed 's/,"/, "/g')" >> "$GITHUB_OUTPUT"
+      - run: echo "metadata=$(jq -cj '[.]' ".devcontainer/${CONTAINER_FLAVOR}/devcontainer-metadata-vscode.json" | sed 's/,"/, "/g')" >> "$GITHUB_OUTPUT"
         id: devcontainer-metadata
       - run: echo "git-commit-epoch=$(git log -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
         id: devcontainer-epoch
@@ -152,7 +152,7 @@ jobs:
         id: inspect-manifest
         run: |
           set -Eeuo pipefail
-          output=$(docker buildx imagetools inspect ${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}:${{ steps.metadata.outputs.version }} --format '{{json .}}')
+          output=$(docker buildx imagetools inspect "${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}:${{ steps.metadata.outputs.version }}" --format '{{json .}}')
           echo "digest=$(echo "$output" | jq -r '.manifest.digest // .manifests[0].digest')" >> "$GITHUB_OUTPUT"
       - uses: ./.github/actions/container-size-diff
         id: container-size-diff
@@ -175,6 +175,7 @@ jobs:
           show-summary: false
           push-to-registry: true
       - name: Verify attestation
-        run: gh attestation verify --repo ${{ github.repository }} oci://${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}@${{ steps.inspect-manifest.outputs.digest }}
+        run: gh attestation verify --repo ${{ github.repository }} "oci://${REGISTRY}/${{ github.repository }}-${CONTAINER_FLAVOR}@${DIGEST}"
         env:
+          DIGEST: ${{ steps.inspect-manifest.outputs.digest }}
           GH_TOKEN: ${{ github.token }}

.github/workflows/wc-integration-test.yml

@@ -33,7 +33,7 @@ jobs:
         with:
           path: ${{ runner.temp }}
           pattern: digests-${{ inputs.flavor }}-${{ steps.runner-arch.outputs.arch }}
-      - run: echo "container=$(printf 'ghcr.io/${{ github.repository }}-${CONTAINER_FLAVOR}@sha256:%s ' *)" >> "$GITHUB_OUTPUT"
+      - run: echo "container=$(printf "ghcr.io/${{ github.repository }}-${CONTAINER_FLAVOR}@sha256:%s " *)" >> "$GITHUB_OUTPUT"
         working-directory: ${{ runner.temp }}/digests-${{ inputs.flavor }}-${{ steps.runner-arch.outputs.arch }}
         id: set-container
   run-test:
@@ -54,7 +54,7 @@ jobs:
           key: xwin-cache-${{ inputs.runner }}
           restore-keys: |
             xwin-cache
-      - run: bats --formatter junit test/${CONTAINER_FLAVOR}/integration-tests.bats | tee test-report-${CONTAINER_FLAVOR}-${RUNNER}.xml
+      - run: bats --formatter junit "test/${CONTAINER_FLAVOR}/integration-tests.bats" | tee "test-report-${CONTAINER_FLAVOR}-${RUNNER}.xml"
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with: