I have the following steps

      - name: create the template for mdm file
        shell: bash
        run: | 
          cat > mdm.xml.template <<EOF
          <dict>
            <key>organization</key>
            <string>myorg</string>
            <key>auth_client_id</key>
            <string>${CLIENT_ID}</string>
            <key>auth_client_secret</key>
            <string>${CLIENT_SECRET}</string>
          </dict>
          EOF

      - name: create the actual template file
        shell: bash
        env:
          CLIENT_ID: FOO
          CLIENT_SECRET: BAR
        run: |
          envsubst < mdm.xml.template > mdm.xml
          mkdir -p /var/lib/cloudflare-warp
          sudo mv mdm.xml /var/lib/cloudflare-warp/mdm.xml

      - name: cat file
        shell: bash
        run: | 
          sudo ls -al /var/lib/cloudflare-warp/
          sudo cat /var/lib/cloudflare-warp/mdm.xml

However when I cat the file:

<dict>
  <key>organization</key>
  <string>myorg</string>
  <key>auth_client_id</key>
  <string></string>
  <key>auth_client_secret</key>
  <string></string>
</dict>

What am I missing?

The same commands work as expected locally on my machine, once I perform

export CLIENT_ID=FOO
export CLIENT_SECRET=BAR

>Solution :

Environment variables are replaced at the time when using here document. No need to use envsubst then, just set the variables when using a here document. Or use <<'EOF' to prevent shell from replacing.