From a53c29602d9c431cc8824239098fef4fb29a8ce5 Mon Sep 17 00:00:00 2001
From: Annie Mao <anniemao@microsoft.com>
Date: Tue, 6 Oct 2026 14:21:26 -0700
Subject: [PATCH] Fix GitHub Actions script injection

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/actions/run-test-script/action.yml    | 93 +++++++++++++------
 .../run-test-script/run-test-script.ps1       | 22 +++++
 ...auto-reset-parent-or-child-lab-machine.yml | 12 ++-
 .github/workflows/ebpf.yml                    | 13 ++-
 .github/workflows/ebpf_dynamic_vm.yml         | 13 ++-
 .github/workflows/lab-quic-callee.yml         | 53 +++++++----
 .github/workflows/msquic_kernel_bvt.yml       | 23 +++--
 .github/workflows/quic.yml                    | 64 ++++++++-----
 .github/workflows/reset-child-machine.yml     | 21 +++--
 .github/workflows/xdp.yml                     | 13 ++-
 10 files changed, 230 insertions(+), 97 deletions(-)
 create mode 100644 .github/actions/run-test-script/run-test-script.ps1

diff --git a/.github/actions/run-test-script/action.yml b/.github/actions/run-test-script/action.yml
index 41a388d97..c465e762e 100644
--- a/.github/actions/run-test-script/action.yml
+++ b/.github/actions/run-test-script/action.yml
@@ -1,8 +1,40 @@
 name: "Run Test Script [NEEDS NETPERF REPO CLONED FIRST]"
 description: "This action runs multiple steps as a composite action."
 inputs:
-  run-script-cmd:
-    description: "The serialized matrix of values to use for the composite action."
+  log-profile:
+    description: "The logging profile to use for the test."
+    type: string
+    required: true
+  msquic-commit:
+    description: "The MsQuic commit or ref to test."
+    type: string
+    required: true
+  environment:
+    description: "The test environment."
+    type: string
+    required: true
+  platform:
+    description: "The test platform."
+    type: string
+    required: true
+  os:
+    description: "The target operating system."
+    type: string
+    required: true
+  arch:
+    description: "The target architecture."
+    type: string
+    required: true
+  tls:
+    description: "The TLS provider."
+    type: string
+    required: true
+  io:
+    description: "The I/O provider."
+    type: string
+    required: true
+  filter:
+    description: "The test filter."
     type: string
     required: true
   matrix:
@@ -16,34 +48,37 @@ inputs:
 runs:
   using: "composite"
   steps:
-  - name: Set context and import the netperf-lib.psm1 library
-    id: netperf_context
-    if: ${{ env.HAS_PWSH == 'false' }}
-    shell: python
-    run: |
-      import json
-      matrix = json.loads("""${{ inputs.matrix }}""")
-      json_str = json.dumps(matrix).replace('"', '\\"').replace('\n', ' ').replace('\r', ' ')
-      prep_code = f"./netperfrepo/set-netperf-context.ps1 -Matrix '{json_str}' -SyncerSecret '${{ inputs.syncer-secret }}' -GithubRunId '${{ github.run_id }}-${{ github.run_attempt }}';"
-      prep_code += "Import-Module ./netperfrepo/netperf-lib.psm1;"
-      print(f"::set-output name=netperf_context::{prep_code}")
-  - name: Squeeze code to 1 line
-    if: ${{ env.HAS_PWSH == 'false' }}
-    id: squeeze_code
-    shell: python
-    run: |
-      run_script_powershell_code = """${{ inputs.run-script-cmd }}"""
-      squeezed_code = run_script_powershell_code.replace('\n', '').replace('\r', '').replace('`', ' ')
-      print(f"::set-output name=squeezed_code::{squeezed_code}")
-  - name: Run Pwsh Command
+  - name: Run Windows PowerShell test script
     if: ${{ env.HAS_PWSH == 'false' }}
-    run: |
-      powershell -Command "${{ steps.netperf_context.outputs.netperf_context }} ${{ steps.squeeze_code.outputs.squeezed_code }}"
     shell: cmd
-  - name: Run Pwsh Command
+    env:
+      NETPERF_MATRIX: ${{ inputs.matrix }}
+      NETPERF_SYNCER_SECRET: ${{ inputs.syncer-secret }}
+      NETPERF_GITHUB_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
+      NETPERF_LOG_PROFILE: ${{ inputs.log-profile }}
+      NETPERF_MSQUIC_COMMIT: ${{ inputs.msquic-commit }}
+      NETPERF_ENVIRONMENT: ${{ inputs.environment }}
+      NETPERF_PLATFORM: ${{ inputs.platform }}
+      NETPERF_OS: ${{ inputs.os }}
+      NETPERF_ARCH: ${{ inputs.arch }}
+      NETPERF_TLS: ${{ inputs.tls }}
+      NETPERF_IO: ${{ inputs.io }}
+      NETPERF_FILTER: ${{ inputs.filter }}
+    run: powershell -NoProfile -ExecutionPolicy Bypass -File ".\netperfrepo\.github\actions\run-test-script\run-test-script.ps1"
+  - name: Run PowerShell test script
     if: ${{ env.HAS_PWSH == 'true' }}
-    run: |
-      ./netperfrepo/set-netperf-context.ps1 -Matrix '${{ inputs.matrix }}' -SyncerSecret '${{ inputs.syncer-secret }}' -GithubRunId '${{ github.run_id }}-${{ github.run_attempt }}'
-      Import-Module ./netperfrepo/netperf-lib.psm1
-      ${{ inputs.run-script-cmd }}
     shell: pwsh
+    env:
+      NETPERF_MATRIX: ${{ inputs.matrix }}
+      NETPERF_SYNCER_SECRET: ${{ inputs.syncer-secret }}
+      NETPERF_GITHUB_RUN_ID: ${{ github.run_id }}-${{ github.run_attempt }}
+      NETPERF_LOG_PROFILE: ${{ inputs.log-profile }}
+      NETPERF_MSQUIC_COMMIT: ${{ inputs.msquic-commit }}
+      NETPERF_ENVIRONMENT: ${{ inputs.environment }}
+      NETPERF_PLATFORM: ${{ inputs.platform }}
+      NETPERF_OS: ${{ inputs.os }}
+      NETPERF_ARCH: ${{ inputs.arch }}
+      NETPERF_TLS: ${{ inputs.tls }}
+      NETPERF_IO: ${{ inputs.io }}
+      NETPERF_FILTER: ${{ inputs.filter }}
+    run: ./netperfrepo/.github/actions/run-test-script/run-test-script.ps1
diff --git a/.github/actions/run-test-script/run-test-script.ps1 b/.github/actions/run-test-script/run-test-script.ps1
new file mode 100644
index 000000000..780408efa
--- /dev/null
+++ b/.github/actions/run-test-script/run-test-script.ps1
@@ -0,0 +1,22 @@
+$ErrorActionPreference = 'Stop'
+
+./netperfrepo/set-netperf-context.ps1 `
+    -Matrix $env:NETPERF_MATRIX `
+    -SyncerSecret $env:NETPERF_SYNCER_SECRET `
+    -GithubRunId $env:NETPERF_GITHUB_RUN_ID
+
+Import-Module ./netperfrepo/netperf-lib.psm1
+
+$secNetPerfParameters = @{
+    LogProfile = $env:NETPERF_LOG_PROFILE
+    MsQuicCommit = $env:NETPERF_MSQUIC_COMMIT
+    environment = $env:NETPERF_ENVIRONMENT
+    plat = $env:NETPERF_PLATFORM
+    os = $env:NETPERF_OS
+    arch = $env:NETPERF_ARCH
+    tls = $env:NETPERF_TLS
+    io = $env:NETPERF_IO
+    filter = $env:NETPERF_FILTER
+}
+
+./scripts/secnetperf.ps1 @secNetPerfParameters
diff --git a/.github/workflows/auto-reset-parent-or-child-lab-machine.yml b/.github/workflows/auto-reset-parent-or-child-lab-machine.yml
index b1173c095..0901f8646 100644
--- a/.github/workflows/auto-reset-parent-or-child-lab-machine.yml
+++ b/.github/workflows/auto-reset-parent-or-child-lab-machine.yml
@@ -48,6 +48,8 @@ jobs:
       - name: Check_Dispatched_ID;${{ github.event.client_payload.workflow_id }}
         if: ${{ github.event_name == 'repository_dispatch' }}
         timeout-minutes: 45
+        env:
+          DISPATCH_WORKFLOW_ID: ${{ github.event.client_payload.workflow_id }}
         run: |
           $headers = @{
             "Accept" = "application/vnd.github+json"
@@ -56,7 +58,7 @@ jobs:
           }
           $url = "https://api.github.com/repos/microsoft/netperf/actions/runs?status=in_progress"
           Write-Debug "GET $url"
-          $workflow_id_that_dispatched_this_workflow = "${{ github.event.client_payload.workflow_id }}"
+          $workflow_id_that_dispatched_this_workflow = $env:DISPATCH_WORKFLOW_ID
           $stop = $true
           while ($true) {
             $stop = $true
@@ -136,14 +138,18 @@ jobs:
       - ${{ inputs.parent-or-child }}
     steps:
     - name: RESET STATE (parent or child)
+      env:
+        VM_NAME: ${{ inputs.vm-name }}
       run: |
         # TODO: Eventually, for WS 2025, we want to instead CRUD the VMs, instead of simply reseting their checkpoints here.
-        $vmName = "${{ inputs.vm-name }}"
+        $vmName = $env:VM_NAME
         $checkPointName = "LATEST"
         Restore-VMSnapshot -VMName $vmName -Name $checkPointName -Confirm:$false
     - name: Start VM, wait for online status, alert observer.
+      env:
+        VM_NAME: ${{ inputs.vm-name }}
       run: |
-        $vmName = "${{ inputs.vm-name }}"
+        $vmName = $env:VM_NAME
         if ($vmName.Contains("linux") -or $vmName.Contains("ubuntu")) {
           Restart-VM -Name $vmName -Force
         } else {
diff --git a/.github/workflows/ebpf.yml b/.github/workflows/ebpf.yml
index fa5eb78f2..ba0964730 100644
--- a/.github/workflows/ebpf.yml
+++ b/.github/workflows/ebpf.yml
@@ -51,10 +51,15 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - run: |
-        echo "guid: ${{ github.event.client_payload.guid }}"
-        echo "sha: ${{ github.event.client_payload.sha }}"
-        echo "ref: ${{ github.event.client_payload.ref }}"
-        echo "pr: ${{ github.event.client_payload.pr }}"
+        echo "guid: $DISPATCH_GUID"
+        echo "sha: $DISPATCH_SHA"
+        echo "ref: $DISPATCH_REF"
+        echo "pr: $DISPATCH_PR"
+      env:
+        DISPATCH_GUID: ${{ github.event.client_payload.guid }}
+        DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+        DISPATCH_REF: ${{ github.event.client_payload.ref }}
+        DISPATCH_PR: ${{ github.event.client_payload.pr }}
 
   build_ebpf:
     name: Build ebpf-for-windows
diff --git a/.github/workflows/ebpf_dynamic_vm.yml b/.github/workflows/ebpf_dynamic_vm.yml
index c02a113c3..e11b70f26 100644
--- a/.github/workflows/ebpf_dynamic_vm.yml
+++ b/.github/workflows/ebpf_dynamic_vm.yml
@@ -51,10 +51,15 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - run: |
-        echo "guid: ${{ github.event.client_payload.guid }}"
-        echo "sha: ${{ github.event.client_payload.sha }}"
-        echo "ref: ${{ github.event.client_payload.ref }}"
-        echo "pr: ${{ github.event.client_payload.pr }}"
+        echo "guid: $DISPATCH_GUID"
+        echo "sha: $DISPATCH_SHA"
+        echo "ref: $DISPATCH_REF"
+        echo "pr: $DISPATCH_PR"
+      env:
+        DISPATCH_GUID: ${{ github.event.client_payload.guid }}
+        DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+        DISPATCH_REF: ${{ github.event.client_payload.ref }}
+        DISPATCH_PR: ${{ github.event.client_payload.pr }}
 
   build:
     name: Build ebpf-for-windows
diff --git a/.github/workflows/lab-quic-callee.yml b/.github/workflows/lab-quic-callee.yml
index 32547daeb..b07948d61 100644
--- a/.github/workflows/lab-quic-callee.yml
+++ b/.github/workflows/lab-quic-callee.yml
@@ -10,17 +10,28 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Print input params
+        env:
+          ASSIGNED_RUNNER: ${{ github.event.client_payload.assigned_runner }}
+          UNIQUE_ENV_STR: ${{ github.event.client_payload.unique_env_str }}
+          TARGET_OS: ${{ github.event.client_payload.os }}
+          TARGET_IO: ${{ github.event.client_payload.io }}
+          TARGET_TLS: ${{ github.event.client_payload.tls }}
+          TARGET_ARCH: ${{ github.event.client_payload.arch }}
+          CALLER_ID: ${{ github.event.client_payload.caller_id }}
+          DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+          DISPATCH_REF: ${{ github.event.client_payload.ref }}
+          DISPATCH_PR: ${{ github.event.client_payload.pr }}
         run: |
-          echo "assigned_runner: ${{ github.event.client_payload.assigned_runner }}"
-          echo "unique_env_str: ${{ github.event.client_payload.unique_env_str }}"
-          echo "os: ${{ github.event.client_payload.os }}"
-          echo "io: ${{ github.event.client_payload.io }}"
-          echo "tls: ${{ github.event.client_payload.tls }}"
-          echo "arch: ${{ github.event.client_payload.arch }}"
-          echo "caller id: ${{ github.event.client_payload.caller_id }}"
-          echo "sha: ${{ github.event.client_payload.sha }}"
-          echo "ref: ${{ github.event.client_payload.ref }}"
-          echo "pr: ${{ github.event.client_payload.pr }}"
+          echo "assigned_runner: $env:ASSIGNED_RUNNER"
+          echo "unique_env_str: $env:UNIQUE_ENV_STR"
+          echo "os: $env:TARGET_OS"
+          echo "io: $env:TARGET_IO"
+          echo "tls: $env:TARGET_TLS"
+          echo "arch: $env:TARGET_ARCH"
+          echo "caller id: $env:CALLER_ID"
+          echo "sha: $env:DISPATCH_SHA"
+          echo "ref: $env:DISPATCH_REF"
+          echo "pr: $env:DISPATCH_PR"
 
   run-secnetperf:
     name: secnetperf
@@ -63,18 +74,26 @@ jobs:
     - name: Run secnetperf
       shell: pwsh
       timeout-minutes: 40
+      env:
+        NETPERF_LOG_PROFILE: ${{ github.event.client_payload.logs || 'NULL' }}
+        NETPERF_MSQUIC_COMMIT: ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }}
+        NETPERF_OS: ${{ github.event.client_payload.os }}
+        NETPERF_ARCH: ${{ github.event.client_payload.arch }}
+        NETPERF_TLS: ${{ github.event.client_payload.tls }}
+        NETPERF_IO: ${{ github.event.client_payload.io }}
+        NETPERF_FILTER: ${{ github.event.client_payload.filter || '' }}
       run: |
           $env:netperf_remote_powershell_supported = $true
           ./scripts/secnetperf.ps1 `
-          -LogProfile ${{ github.event.client_payload.logs || 'NULL' }} `
-          -MsQuicCommit ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }} `
+          -LogProfile $env:NETPERF_LOG_PROFILE `
+          -MsQuicCommit $env:NETPERF_MSQUIC_COMMIT `
           -environment lab `
           -plat ${{env.OS}} `
-          -os ${{ github.event.client_payload.os }} `
-          -arch ${{ github.event.client_payload.arch }} `
-          -tls ${{ github.event.client_payload.tls }} `
-          -io ${{ github.event.client_payload.io }} `
-          -filter '${{ github.event.client_payload.filter || '' }}'
+          -os $env:NETPERF_OS `
+          -arch $env:NETPERF_ARCH `
+          -tls $env:NETPERF_TLS `
+          -io $env:NETPERF_IO `
+          -filter $env:NETPERF_FILTER
     - name: Upload Test Results JSON
       if: ${{ always() }}
       uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
diff --git a/.github/workflows/msquic_kernel_bvt.yml b/.github/workflows/msquic_kernel_bvt.yml
index a00554af7..26bb79d90 100644
--- a/.github/workflows/msquic_kernel_bvt.yml
+++ b/.github/workflows/msquic_kernel_bvt.yml
@@ -25,14 +25,21 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Print Parameters
+      env:
+        DISPATCH_GUID: ${{ github.event.client_payload.guid }}
+        DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+        DISPATCH_REF: ${{ github.event.client_payload.ref }}
+        DISPATCH_PR: ${{ github.event.client_payload.pr }}
+        DISPATCH_LOGS: ${{ github.event.client_payload.logs }}
+        DISPATCH_FILTER: ${{ github.event.client_payload.filter }}
       run: |
         echo "Parameters from repository_dispatch:"
-        echo "guid: ${{ github.event.client_payload.guid }}"
-        echo "sha: ${{ github.event.client_payload.sha }}"
-        echo "ref: ${{ github.event.client_payload.ref }}"
-        echo "pr: ${{ github.event.client_payload.pr }}"
-        echo "logs: ${{ github.event.client_payload.logs }}"
-        echo "filter: ${{ github.event.client_payload.filter }}"
+        echo "guid: $DISPATCH_GUID"
+        echo "sha: $DISPATCH_SHA"
+        echo "ref: $DISPATCH_REF"
+        echo "pr: $DISPATCH_PR"
+        echo "logs: $DISPATCH_LOGS"
+        echo "filter: $DISPATCH_FILTER"
 
   build-windows-kernel:
     name: Build WinKernel
@@ -121,7 +128,9 @@ jobs:
     - name: Test
       shell: pwsh
       timeout-minutes: 90
-      run: scripts/test.ps1 -Config ${{ matrix.vec.config }} -Arch ${{ matrix.vec.arch }} -Tls ${{ matrix.vec.tls }} -OsRunner ${{ matrix.vec.os }} -GHA -LogProfile Full.Light -GenerateXmlResults -Kernel -Filter ${{ github.event.client_payload.filter || inputs.filter || '' }}
+      env:
+        TEST_FILTER: ${{ github.event.client_payload.filter || inputs.filter || '' }}
+      run: scripts/test.ps1 -Config ${{ matrix.vec.config }} -Arch ${{ matrix.vec.arch }} -Tls ${{ matrix.vec.tls }} -OsRunner ${{ matrix.vec.os }} -GHA -LogProfile Full.Light -GenerateXmlResults -Kernel -Filter $env:TEST_FILTER
     - name: Upload on Failure
       uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       if: failure()
diff --git a/.github/workflows/quic.yml b/.github/workflows/quic.yml
index c43b1d9c2..f26925b45 100644
--- a/.github/workflows/quic.yml
+++ b/.github/workflows/quic.yml
@@ -85,32 +85,48 @@ jobs:
     steps:
     - name: Print Parameters
       if: ${{ github.event_name == 'repository_dispatch' }}
+      env:
+        DISPATCH_GUID: ${{ github.event.client_payload.guid }}
+        DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+        DISPATCH_REF: ${{ github.event.client_payload.ref }}
+        DISPATCH_PR: ${{ github.event.client_payload.pr }}
+        DISPATCH_LOGS: ${{ github.event.client_payload.logs }}
+        DISPATCH_FILTER: ${{ github.event.client_payload.filter }}
       run: |
         echo "Parameters from repository_dispatch:"
-        echo "guid: ${{ github.event.client_payload.guid }}"
-        echo "sha: ${{ github.event.client_payload.sha }}"
-        echo "ref: ${{ github.event.client_payload.ref }}"
-        echo "pr: ${{ github.event.client_payload.pr }}"
-        echo "logs: ${{ github.event.client_payload.logs }}"
-        echo "filter: ${{ github.event.client_payload.filter }}"
+        echo "guid: $DISPATCH_GUID"
+        echo "sha: $DISPATCH_SHA"
+        echo "ref: $DISPATCH_REF"
+        echo "pr: $DISPATCH_PR"
+        echo "logs: $DISPATCH_LOGS"
+        echo "filter: $DISPATCH_FILTER"
     - name: Validate inputs for workflow dispatch
       if: ${{ github.event_name == 'workflow_dispatch' }}
+      env:
+        COMMIT_RESULTS: ${{ inputs.commit }}
+        TEST_REF: ${{ inputs.ref }}
       run: |
-        if [ "${{ inputs.commit }}" = "true" ] && [ "${{ inputs.ref }}" = "main" ]; then
+        if [ "$COMMIT_RESULTS" = "true" ] && [ "$TEST_REF" = "main" ]; then
           echo "Error: If commit is set to true, ref should not be 'main'"
           exit 1
         fi
     - name: Validate inputs for workflow call
       if: ${{ github.event_name == 'workflow_call' }}
+      env:
+        COMMIT_RESULTS: ${{ inputs.commit }}
+        TEST_REF: ${{ inputs.ref }}
       run: |
-        if [ "${{ inputs.commit }}" = "true" ] && [ "${{ inputs.ref }}" = "main" ]; then
+        if [ "$COMMIT_RESULTS" = "true" ] && [ "$TEST_REF" = "main" ]; then
           echo "Error: If commit is set to true, ref should not be 'main'"
           exit 1
         fi
     - name: Validate inputs for repository dispatch
       if: ${{ github.event_name == 'repository_dispatch' }}
+      env:
+        DISPATCH_REF: ${{ github.event.client_payload.ref }}
+        DISPATCH_PR: ${{ github.event.client_payload.pr }}
       run: |
-        if [ "${{ github.event.client_payload.ref }}" = "main" ] && [ '${{ github.event.client_payload.pr }}' = '' ]; then
+        if [ "$DISPATCH_REF" = "main" ] && [ -z "$DISPATCH_PR" ]; then
           echo "Repository dispatch on merge events must have ref set to a SHA instead of a branch name."
           exit 1
         fi
@@ -222,17 +238,15 @@ jobs:
       timeout-minutes: 40
       uses: ./netperfrepo/.github/actions/run-test-script
       with:
-        run-script-cmd: |
-          ./scripts/secnetperf.ps1 `
-          -LogProfile ${{ github.event.client_payload.logs || inputs.logprofile || 'NULL' }} `
-          -MsQuicCommit ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }} `
-          -environment ${{ matrix.env }} `
-          -plat ${{env.OS}} `
-          -os ${{ matrix.os }} `
-          -arch ${{ matrix.arch }} `
-          -tls ${{ matrix.tls }} `
-          -io ${{ matrix.io }} `
-          -filter '${{ github.event.client_payload.filter || inputs.filter || '' }}'
+        log-profile: ${{ github.event.client_payload.logs || inputs.logprofile || 'NULL' }}
+        msquic-commit: ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }}
+        environment: ${{ matrix.env }}
+        platform: ${{ env.OS }}
+        os: ${{ matrix.os }}
+        arch: ${{ matrix.arch }}
+        tls: ${{ matrix.tls }}
+        io: ${{ matrix.io }}
+        filter: ${{ github.event.client_payload.filter || inputs.filter || '' }}
         matrix: '${{ toJson(matrix) }}'
         syncer-secret: ${{ secrets.NETPERF_SYNCER_SECRET }}
     - name: Stop 1ES Machine
@@ -313,19 +327,23 @@ jobs:
     - name: Run secnetperf
       shell: pwsh
       timeout-minutes: 80
+      env:
+        NETPERF_LOG_PROFILE: ${{ github.event.client_payload.logs || inputs.logprofile || 'NULL' }}
+        NETPERF_MSQUIC_COMMIT: ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }}
+        NETPERF_FILTER: ${{ github.event.client_payload.filter || inputs.filter || '' }}
       run: |
           Import-Module ./netperfrepo/netperf-lib.psm1
           $env:netperf_remote_powershell_supported = $true
           ./scripts/secnetperf.ps1 `
-          -LogProfile ${{ github.event.client_payload.logs || inputs.logprofile || 'NULL' }} `
-          -MsQuicCommit ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }} `
+          -LogProfile $env:NETPERF_LOG_PROFILE `
+          -MsQuicCommit $env:NETPERF_MSQUIC_COMMIT `
           -environment ${{ matrix.env }} `
           -plat ${{env.OS}} `
           -os ${{ matrix.os }} `
           -arch ${{ matrix.arch }} `
           -tls ${{ matrix.tls }} `
           -io ${{ matrix.io }} `
-          -filter '${{ github.event.client_payload.filter || inputs.filter || '' }}'
+          -filter $env:NETPERF_FILTER
     - name: Upload Test Results JSON
       if: ${{ always() }}
       uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
diff --git a/.github/workflows/reset-child-machine.yml b/.github/workflows/reset-child-machine.yml
index 940eec429..e6cd729d8 100644
--- a/.github/workflows/reset-child-machine.yml
+++ b/.github/workflows/reset-child-machine.yml
@@ -10,10 +10,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Print input params
+        env:
+          PARENT_ID: ${{ github.event.client_payload.parent_id }}
+          TARGET_OS: ${{ github.event.client_payload.os }}
+          UNIQUE_ENV_STR: ${{ github.event.client_payload.unique_env_str }}
         run: |
-          echo "parent_id: ${{ github.event.client_payload.parent_id }}" # child id is parent id - 1.
-          echo "os: ${{ github.event.client_payload.os }}"
-          echo "unique_env_str: ${{ github.event.client_payload.unique_env_str }}"
+          echo "parent_id: $PARENT_ID" # child id is parent id - 1.
+          echo "os: $TARGET_OS"
+          echo "unique_env_str: $UNIQUE_ENV_STR"
 
   do-reset:
     name: Reset child Machine
@@ -22,14 +26,19 @@ jobs:
       - parent=${{ github.event.client_payload.parent_id }}
     steps:
       - name: RESET STATE (child)
+        env:
+          TARGET_OS: ${{ github.event.client_payload.os }}
         run: |
           # TODO: Eventually, for WS 2025, we want to instead CRUD the VMs, instead of simply reseting their checkpoints here.
-          $vmName = "netperf-${{ github.event.client_payload.os }}-client"
+          $vmName = "netperf-$($env:TARGET_OS)-client"
           $checkPointName = "LATEST"
           Restore-VMSnapshot -VMName $vmName -Name $checkPointName -Confirm:$false
       - name: Start VM, wait for online status, alert observer.
+        env:
+          TARGET_OS: ${{ github.event.client_payload.os }}
+          UNIQUE_ENV_STR: ${{ github.event.client_payload.unique_env_str }}
         run: |
-          $vmName = "netperf-${{ github.event.client_payload.os }}-client"
+          $vmName = "netperf-$($env:TARGET_OS)-client"
           Start-VM -Name $vmName
           while (-not (Get-VMNetworkAdapter -VMName $vmName).IPAddresses) {
             Write-Host "Waiting for VM to be online..."
@@ -47,7 +56,7 @@ jobs:
           $headers = @{
             "secret" = "${{ secrets.NETPERF_SYNCER_SECRET }}"
           }
-          $key = "${{ github.event.client_payload.unique_env_str }}_child_reset_done"
+          $key = "$($env:UNIQUE_ENV_STR)_child_reset_done"
           $value = whoami
           $api = "https://netperfapi.azurewebsites.net/setkeyvalue?key=$key&value=$value"
 
diff --git a/.github/workflows/xdp.yml b/.github/workflows/xdp.yml
index 145da4e9f..800ee8fd5 100644
--- a/.github/workflows/xdp.yml
+++ b/.github/workflows/xdp.yml
@@ -32,10 +32,15 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - run: |
-        echo "guid: ${{ github.event.client_payload.guid }}"
-        echo "sha: ${{ github.event.client_payload.sha }}"
-        echo "ref: ${{ github.event.client_payload.ref }}"
-        echo "pr: ${{ github.event.client_payload.pr }}"
+        echo "guid: $DISPATCH_GUID"
+        echo "sha: $DISPATCH_SHA"
+        echo "ref: $DISPATCH_REF"
+        echo "pr: $DISPATCH_PR"
+      env:
+        DISPATCH_GUID: ${{ github.event.client_payload.guid }}
+        DISPATCH_SHA: ${{ github.event.client_payload.sha }}
+        DISPATCH_REF: ${{ github.event.client_payload.ref }}
+        DISPATCH_PR: ${{ github.event.client_payload.pr }}
 
   build:
     name: Build XDP