workflows: hoist matrix values to job-level env, drop expression substitution in run: blocks

Eli's review flagged `${{ matrix.arch }}` in a run: block as an injectable
pattern even though the matrix values are hardcoded and not truly exploitable.
Apply the pattern consistently across the whole workflow:

- Hoist PLATFORM, ARCH, BAZEL_ARCH, REPO to job-level env so each step can
  reference them as shell variables ($ARCH etc.) rather than GitHub Actions
  expressions (${{ matrix.arch }}). Job-level env evaluates matrix context
  since the job is instantiated per matrix combination, so this DRYs up the
  per-step env blocks.
- Rewrite every `run:` block to reference the job-level env vars. No more
  `${{ ... }}` expressions inside shell scripts.
- Secret references (GITHUB_TOKEN) remain step-scoped per least-privilege.
- Minor cleanup: collapse three separate `echo ... >> $GITHUB_ENV` lines into
  a single `{ ...; } >> "$GITHUB_ENV"` block.

Addresses Eli's inline comment on line 114 of the pre-hoist file.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: harshita-gupta

.github/workflows/build-node-packages.yml

@@ -30,24 +30,29 @@ jobs:
 
     env:
       NODE_VERSION: v22.21.1
+      PLATFORM: ${{ matrix.platform }}
+      ARCH: ${{ matrix.arch }}
+      BAZEL_ARCH: ${{ matrix.bazel_arch }}
+      REPO: ${{ github.repository }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v3
 
       - name: Debug Matrix Values
         run: |
-          echo "Matrix platform: ${{ matrix.platform }}"
-          echo "Matrix arch: ${{ matrix.arch }}"
+          echo "Matrix platform: $PLATFORM"
+          echo "Matrix arch: $ARCH"
 
       - name: Download Node archive
-        run: |
-          gh release download node-${{ env.NODE_VERSION }}-release \
-            --repo asana/node \
-            --pattern "node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz"
-          mv node-${{ env.NODE_VERSION }}-${{ matrix.platform }}-${{ matrix.arch }}-LATEST.tar.xz node.tar.xz
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          ASSET="node-${NODE_VERSION}-${PLATFORM}-${ARCH}-LATEST.tar.xz"
+          gh release download "node-${NODE_VERSION}-release" \
+            --repo asana/node \
+            --pattern "$ASSET"
+          mv "$ASSET" node.tar.xz
 
       - name: Execute the Dockerfile
         run: |
@@ -70,7 +75,7 @@ jobs:
           mv node_modules/cld ./cld@2.9.1/node_modules/
           mv node_modules/unix-dgram ./unix-dgram@2.0.6/node_modules/
           mv "node_modules/@datadog/pprof" "./@datadog+pprof@5.8.0/node_modules/@datadog/"
-          tar --hard-dereference -cvzf packages_${{matrix.arch}}.tar.gz bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6 "@datadog+pprof@5.8.0"
+          tar --hard-dereference -cvzf "packages_${ARCH}.tar.gz" bcrypt@5.1.0 cld@2.9.1 unix-dgram@2.0.6 "@datadog+pprof@5.8.0"
 
       - name: Upload archive to release
         # Use `gh release upload` (first-party GitHub CLI, pre-installed on runners)
@@ -80,10 +85,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload "node-${{ env.NODE_VERSION }}-release" \
-            "packages_${{ matrix.arch }}.tar.gz" \
+          gh release upload "node-${NODE_VERSION}-release" \
+            "packages_${ARCH}.tar.gz" \
             --clobber \
-            --repo "${{ github.repository }}"
+            --repo "$REPO"
 
       # S3 upload is restricted to the protected main branch only. The IAM role
       # (push_node_gyp_packages) trusts only refs/heads/main via OIDC. To upload
@@ -106,15 +111,17 @@ jobs:
           # (disable_confusing_acls = true), which disables ACLs entirely.
           # BlockPublicAcls + IgnorePublicAcls provide additional coverage.
           # Reads come via CloudFront OAC.
-          NODE_MAJOR=$(echo "${{ env.NODE_VERSION }}" | sed 's/^v//' | cut -d. -f1)
-          SHA256=$(sha256sum "packages_${{ matrix.arch }}.tar.gz" | awk '{print $1}')
+          NODE_MAJOR=$(echo "$NODE_VERSION" | sed 's/^v//' | cut -d. -f1)
+          SHA256=$(sha256sum "packages_${ARCH}.tar.gz" | awk '{print $1}')
           SHORT_HASH=${SHA256:0:8}
-          S3_KEY="node-gyp/packages_${{ matrix.bazel_arch }}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz"
-          echo "Uploading packages_${{ matrix.arch }}.tar.gz to s3://asana-oss-cache/${S3_KEY}"
-          aws s3 cp "packages_${{ matrix.arch }}.tar.gz" "s3://asana-oss-cache/${S3_KEY}"
-          echo "S3_KEY=${S3_KEY}" >> "$GITHUB_ENV"
-          echo "SHA256=${SHA256}" >> "$GITHUB_ENV"
-          echo "NODE_MAJOR=${NODE_MAJOR}" >> "$GITHUB_ENV"
+          S3_KEY="node-gyp/packages_${BAZEL_ARCH}_node${NODE_MAJOR}-${SHORT_HASH}.tar.gz"
+          echo "Uploading packages_${ARCH}.tar.gz to s3://asana-oss-cache/$S3_KEY"
+          aws s3 cp "packages_${ARCH}.tar.gz" "s3://asana-oss-cache/$S3_KEY"
+          {
+            echo "S3_KEY=$S3_KEY"
+            echo "SHA256=$SHA256"
+            echo "NODE_MAJOR=$NODE_MAJOR"
+          } >> "$GITHUB_ENV"
 
       - name: Verify upload is reachable via CloudFront
         if: github.ref == 'refs/heads/main'
@@ -135,6 +142,6 @@ jobs:
         run: |
           echo ""
           echo "=== Update tools_repositories.bzl in codez ==="
-          echo "  name = \"node_gyp_packages_${{ matrix.bazel_arch }}_node${NODE_MAJOR}\","
-          echo "  urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/${S3_KEY}\"],"
-          echo "  sha256 = \"${SHA256}\","
+          echo "  name = \"node_gyp_packages_${BAZEL_ARCH}_node${NODE_MAJOR}\","
+          echo "  urls = [\"https://asana-oss-cache.s3.us-east-1.amazonaws.com/$S3_KEY\"],"
+          echo "  sha256 = \"$SHA256\","