feat(docker-services): Add environment variable expansion for volume paths

Implement envsubst-based expansion of $VAR and ${VAR} references in volume
entries, enabling portable bind-mount paths like $GITHUB_WORKSPACE/... that
resolve at runtime. Update documentation to clarify this syntax replaces
${{ github.workspace }}, which evaluates to empty string before runner
assignment.

Author: rhblind

.github/actions/docker-services-up/action.yaml

@@ -9,7 +9,8 @@ inputs:
     description: |
       Multiline YAML list describing services to start. Each entry supports:
       name (required), image (required), ports, env, volumes, options,
-      health-cmd, health-timeout.
+      health-cmd, health-timeout. Env-var references ($VAR / ${VAR}) in
+      volume entries are expanded at runtime (e.g. $GITHUB_WORKSPACE/...).
     required: true
 
 runs:

.github/actions/docker-services-up/up.sh

@@ -11,6 +11,7 @@ fi
 
 command -v yq >/dev/null || { echo "::error::yq is required but not installed"; exit 1; }
 command -v docker >/dev/null || { echo "::error::docker is required but not installed"; exit 1; }
+command -v envsubst >/dev/null || { echo "::error::envsubst is required but not installed (usually in gettext-base)"; exit 1; }
 
 # Output one entry per line from a field that may be:
 #   - missing (no output)
@@ -80,9 +81,12 @@ for i in $(seq 0 $((count - 1))); do
     args+=(--env-file "$env_file")
   fi
 
-  # Volumes
+  # Volumes. Env-var references are expanded so callers can use
+  # `$GITHUB_WORKSPACE/...` for bind-mount paths. Only $VAR / ${VAR} forms
+  # are substituted; command substitution ($() / backticks) is not.
   while IFS= read -r vol; do
     [[ -z "$vol" ]] && continue
+    vol=$(envsubst <<<"$vol")
     args+=(-v "$vol")
   done < <(extract_lines "$i" volumes)
 

.github/workflows/elixir-test.yaml

@@ -112,6 +112,11 @@ on:
           volumes, options, health-cmd, health-timeout. Ports are published on
           localhost. Containers share the 'ci-services' network and are removed
           automatically at the end of the test job.
+          Env-var references ($VAR / ${VAR}) inside volume entries are
+          expanded at runtime, so $GITHUB_WORKSPACE/... can be used for
+          bind-mount paths. ${{ github.workspace }} is NOT a valid substitute
+          here: the expression is evaluated at workflow-call time, before any
+          runner is assigned, so it resolves to the empty string.
           Example:
             services: |
               - name: redis
@@ -121,7 +126,7 @@ on:
               - name: mosquitto
                 image: eclipse-mosquitto:2
                 ports: 1883:1883
-                volumes: ./ci/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
+                volumes: $GITHUB_WORKSPACE/ci/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
     secrets:
       hex-organization-key:
         required: false

README.md

@@ -117,7 +117,7 @@ jobs:
         - name: mosquitto
           image: eclipse-mosquitto:2
           ports: 1883:1883
-          volumes: ${{ github.workspace }}/ci/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
+          volumes: $GITHUB_WORKSPACE/ci/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro
 ```
 
 Supported per-service fields: `name` (required), `image` (required), `ports`,