GHA: enclose if expressions in ${{ }} where missing

Enclosing expressions in `${{ }}` is optional, but sometimes required.
It seems more straighforward to use it always rather than decide on
a case-by-case basis. Before this patch 71 `if`s were enclosed and 49
were not. Enclosing these makes it easy to grep and recognize these
whereever used.

https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/using-conditions-to-control-job-execution

Closes #17550

.github/workflows/hacktoberfest-accepted.yml

@@ -40,7 +40,7 @@ jobs:
             gh repo view --json repositoryTopics --jq '.repositoryTopics[].name' | grep '^hacktoberfest$')" >> "$GITHUB_OUTPUT"
 
       - name: Search relevant commit message lines starting with Closes/Merges
-        if: steps.check.outputs.label == 'hacktoberfest'
+        if: ${{ steps.check.outputs.label == 'hacktoberfest' }}
         env:
           GITHUB_EVENT_BEFORE: '${{ github.event.before }}'
           GITHUB_EVENT_AFTER: '${{ github.event.after }}'
@@ -49,7 +49,7 @@ jobs:
             grep -Ei '^Close[sd]? ' | sort | uniq | tee log
 
       - name: Search for Number-based PR references
-        if: steps.check.outputs.label == 'hacktoberfest'
+        if: ${{ steps.check.outputs.label == 'hacktoberfest' }}
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |
@@ -60,7 +60,7 @@ jobs:
               gh pr edit {} --add-label 'hacktoberfest-accepted'
 
       - name: Search for URL-based PR references
-        if: steps.check.outputs.label == 'hacktoberfest'
+        if: ${{ steps.check.outputs.label == 'hacktoberfest' }}
         env:
           GITHUB_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
         run: |

.github/workflows/http3-linux.yml

@@ -126,18 +126,18 @@ jobs:
 
       - id: settings
         if: |
-          steps.cache-openssl-http3.outputs.cache-hit != 'true' ||
-          steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true' ||
-          steps.cache-gnutls.outputs.cache-hit != 'true' ||
-          steps.cache-wolfssl.outputs.cache-hit != 'true' ||
-          steps.cache-nghttp3.outputs.cache-hit != 'true' ||
-          steps.cache-ngtcp2.outputs.cache-hit != 'true' ||
-          steps.cache-nghttp2.outputs.cache-hit != 'true'
+          ${{ steps.cache-openssl-http3.outputs.cache-hit != 'true' ||
+              steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true' ||
+              steps.cache-gnutls.outputs.cache-hit != 'true' ||
+              steps.cache-wolfssl.outputs.cache-hit != 'true' ||
+              steps.cache-nghttp3.outputs.cache-hit != 'true' ||
+              steps.cache-ngtcp2.outputs.cache-hit != 'true' ||
+              steps.cache-nghttp2.outputs.cache-hit != 'true' }}
 
         run: echo 'needs-build=true' >> "$GITHUB_OUTPUT"
 
       - name: 'install build prereqs'
-        if: steps.settings.outputs.needs-build == 'true'
+        if: ${{ steps.settings.outputs.needs-build == 'true' }}
         run: |
           sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
           sudo apt-get -o Dpkg::Use-Pty=0 update
@@ -153,7 +153,7 @@ jobs:
           echo 'CXX=g++-12' >> "$GITHUB_ENV"
 
       - name: 'build openssl'
-        if: steps.cache-openssl-http3.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-openssl-http3.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
@@ -163,7 +163,7 @@ jobs:
           make -j1 install_sw
 
       - name: 'build quictls'
-        if: steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-quictls-no-deprecated.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "openssl-${QUICTLS_VERSION}-quic1" https://github.com/quictls/openssl quictls
@@ -173,7 +173,7 @@ jobs:
           make -j1 install_sw
 
       - name: 'build gnutls'
-        if: steps.cache-gnutls.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-gnutls.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "${GNUTLS_VERSION}" https://github.com/gnutls/gnutls.git
@@ -187,7 +187,7 @@ jobs:
           make install
 
       - name: 'build wolfssl'
-        if: steps.cache-wolfssl.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-wolfssl.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "v${WOLFSSL_VERSION}-stable" https://github.com/wolfSSL/wolfssl.git
@@ -199,7 +199,7 @@ jobs:
           make install
 
       - name: 'build nghttp3'
-        if: steps.cache-nghttp3.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-nghttp3.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "v${NGHTTP3_VERSION}" https://github.com/ngtcp2/nghttp3
@@ -211,7 +211,7 @@ jobs:
           make install
 
       - name: 'build ngtcp2'
-        if: steps.cache-ngtcp2.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-ngtcp2.outputs.cache-hit != 'true' }}
         # building twice to get crypto libs for ossl and quictls installed
         run: |
           cd ~
@@ -228,7 +228,7 @@ jobs:
           make install
 
       - name: 'build nghttp2'
-        if: steps.cache-nghttp2.outputs.cache-hit != 'true'
+        if: ${{ steps.cache-nghttp2.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "v${NGHTTP2_VERSION}" https://github.com/nghttp2/nghttp2
@@ -347,7 +347,7 @@ jobs:
           echo 'CXX=g++-12' >> "$GITHUB_ENV"
 
       - name: 'cache openssl'
-        if: matrix.build.name == 'openssl' || matrix.build.name == 'openssl-quic'
+        if: ${{ matrix.build.name == 'openssl' || matrix.build.name == 'openssl-quic' }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-openssl-http3
         env:
@@ -368,7 +368,7 @@ jobs:
           fail-on-cache-miss: true
 
       - name: 'cache gnutls'
-        if: matrix.build.name == 'gnutls'
+        if: ${{ matrix.build.name == 'gnutls' }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-gnutls
         env:
@@ -379,7 +379,7 @@ jobs:
           fail-on-cache-miss: true
 
       - name: 'cache wolfssl'
-        if: matrix.build.name == 'wolfssl'
+        if: ${{ matrix.build.name == 'wolfssl' }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-wolfssl
         env:
@@ -420,7 +420,7 @@ jobs:
           fail-on-cache-miss: true
 
       - name: 'cache quiche'
-        if: matrix.build.name == 'quiche'
+        if: ${{ matrix.build.name == 'quiche' }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-quiche
         env:
@@ -430,7 +430,7 @@ jobs:
           key: ${{ runner.os }}-http3-build-${{ env.cache-name }}-${{ env.QUICHE_VERSION }}
 
       - name: 'build quiche and boringssl'
-        if: matrix.build.name == 'quiche' && steps.cache-quiche.outputs.cache-hit != 'true'
+        if: ${{ matrix.build.name == 'quiche' && steps.cache-quiche.outputs.cache-hit != 'true' }}
         run: |
           cd ~
           git clone --quiet --depth=1 -b "${QUICHE_VERSION}" --recursive https://github.com/cloudflare/quiche.git

.github/workflows/linux.yml

@@ -305,7 +305,7 @@ jobs:
 
     steps:
       - name: 'install prereqs'
-        if: matrix.build.container == null && !contains(matrix.build.name, 'i686')
+        if: ${{ matrix.build.container == null && !contains(matrix.build.name, 'i686') }}
         env:
           INSTALL_PACKAGES: >-
             ${{ !contains(matrix.build.install_steps, 'skipall') && !contains(matrix.build.install_steps, 'skiprun') && 'stunnel4' || '' }}
@@ -323,7 +323,7 @@ jobs:
           python3 -m venv ~/venv
 
       - name: 'install prereqs'
-        if: contains(matrix.build.name, 'i686')
+        if: ${{ contains(matrix.build.name, 'i686') }}
         run: |
           sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list
           sudo dpkg --add-architecture i386
@@ -336,7 +336,7 @@ jobs:
           python3 -m venv ~/venv
 
       - name: 'install dependencies'
-        if: startsWith(matrix.build.container, 'alpine')
+        if: ${{ startsWith(matrix.build.container, 'alpine') }}
         run: |
           apk add --no-cache build-base autoconf automake libtool perl openssl-dev \
             libssh2-dev zlib-dev brotli-dev zstd-dev libidn2-dev openldap-dev \
@@ -345,7 +345,7 @@ jobs:
             perl-time-hires openssh stunnel sudo git openssl
 
       - name: 'cache bearssl'
-        if: contains(matrix.build.install_steps, 'bearssl')
+        if: ${{ contains(matrix.build.install_steps, 'bearssl') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-bearssl
         env:
@@ -355,7 +355,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.BEARSSL_VERSION }}
 
       - name: 'build bearssl'
-        if: contains(matrix.build.install_steps, 'bearssl') && steps.cache-bearssl.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'bearssl') && steps.cache-bearssl.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://bearssl.org/bearssl-${BEARSSL_VERSION}.tar.gz" | tar -xz
@@ -366,7 +366,7 @@ jobs:
           cp build/libbearssl.* ~/bearssl/lib
 
       - name: 'cache libressl'
-        if: contains(matrix.build.install_steps, 'libressl')
+        if: ${{ contains(matrix.build.install_steps, 'libressl') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-libressl
         env:
@@ -376,7 +376,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
 
       - name: 'build libressl'
-        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" | tar -xz
@@ -385,7 +385,7 @@ jobs:
           make install
 
       - name: 'cache wolfssl (all)'
-        if: contains(matrix.build.install_steps, 'wolfssl-all')
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-wolfssl-all
         env:
@@ -395,7 +395,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
 
       - name: 'build wolfssl (all)'  # does not support `OPENSSL_COEXIST`
-        if: contains(matrix.build.install_steps, 'wolfssl-all') && steps.cache-wolfssl-all.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-all') && steps.cache-wolfssl-all.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" | tar -xz
@@ -406,7 +406,7 @@ jobs:
           make install
 
       - name: 'cache wolfssl (opensslextra)'  # does support `OPENSSL_COEXIST`
-        if: contains(matrix.build.install_steps, 'wolfssl-opensslextra')
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-wolfssl-opensslextra
         env:
@@ -416,7 +416,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSL_VERSION }}
 
       - name: 'build wolfssl (opensslextra)'
-        if: contains(matrix.build.install_steps, 'wolfssl-opensslextra') && steps.cache-wolfssl-opensslextra.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'wolfssl-opensslextra') && steps.cache-wolfssl-opensslextra.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/wolfSSL/wolfssl/archive/v${WOLFSSL_VERSION}-stable.tar.gz" | tar -xz
@@ -427,7 +427,7 @@ jobs:
           make install
 
       - name: 'cache wolfssh'
-        if: contains(matrix.build.install_steps, 'wolfssh')
+        if: ${{ contains(matrix.build.install_steps, 'wolfssh') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-wolfssh
         env:
@@ -437,7 +437,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.WOLFSSH_VERSION }}-${{ env.WOLFSSL_VERSION }}
 
       - name: 'build wolfssh'
-        if: contains(matrix.build.install_steps, 'wolfssh') && steps.cache-wolfssh.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'wolfssh') && steps.cache-wolfssh.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/wolfSSL/wolfssh/archive/v${WOLFSSH_VERSION}-stable.tar.gz" | tar -xz
@@ -448,7 +448,7 @@ jobs:
           make install
 
       - name: 'cache mbedtls'
-        if: contains(matrix.build.install_steps, 'mbedtls')
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-mbedtls
         env:
@@ -458,7 +458,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MBEDTLS_VERSION }}
 
       - name: 'build mbedtls'
-        if: contains(matrix.build.install_steps, 'mbedtls') && steps.cache-mbedtls.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'mbedtls') && steps.cache-mbedtls.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-${MBEDTLS_VERSION}/mbedtls-${MBEDTLS_VERSION}.tar.bz2" | tar -xj
@@ -471,7 +471,7 @@ jobs:
           cmake --install .
 
       - name: 'cache openssl (thread sanitizer)'
-        if: contains(matrix.build.install_steps, 'openssl-tsan')
+        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-openssl-tsan
         env:
@@ -481,7 +481,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.OPENSSL_VERSION }}
 
       - name: 'build openssl (thread sanitizer)'
-        if: contains(matrix.build.install_steps, 'openssl-tsan') && steps.cache-openssl-tsan.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'openssl-tsan') && steps.cache-openssl-tsan.outputs.cache-hit != 'true' }}
         run: |
           git clone --quiet --depth=1 -b "openssl-${OPENSSL_VERSION}" https://github.com/openssl/openssl
           cd openssl
@@ -490,7 +490,7 @@ jobs:
           make -j1 install_sw
 
       - name: 'cache quictls'
-        if: contains(matrix.build.install_steps, 'quictls')
+        if: ${{ contains(matrix.build.install_steps, 'quictls') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-quictls
         env:
@@ -500,7 +500,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.QUICTLS_VERSION }}-quic1
 
       - name: 'build quictls'
-        if: contains(matrix.build.install_steps, 'quictls') && steps.cache-quictls.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'quictls') && steps.cache-quictls.outputs.cache-hit != 'true' }}
         run: |
           git clone --quiet --depth=1 -b "openssl-${QUICTLS_VERSION}-quic1" https://github.com/quictls/openssl
           cd openssl
@@ -509,7 +509,7 @@ jobs:
           make -j1 install_sw
 
       - name: 'cache msh3'
-        if: contains(matrix.build.install_steps, 'msh3')
+        if: ${{ contains(matrix.build.install_steps, 'msh3') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-msh3
         env:
@@ -519,7 +519,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.MSH3_VERSION }}
 
       - name: 'build msh3'
-        if: contains(matrix.build.install_steps, 'msh3') && steps.cache-msh3.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'msh3') && steps.cache-msh3.outputs.cache-hit != 'true' }}
         run: |
           git clone --quiet --depth=1 -b "v${MSH3_VERSION}" --recursive https://github.com/nibanks/msh3
           cd msh3
@@ -528,7 +528,7 @@ jobs:
           cmake --install .
 
       - name: 'cache awslc'
-        if: contains(matrix.build.install_steps, 'awslc')
+        if: ${{ contains(matrix.build.install_steps, 'awslc') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-awslc
         env:
@@ -538,7 +538,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.AWSLC_VERSION }}
 
       - name: 'build awslc'
-        if: contains(matrix.build.install_steps, 'awslc') && steps.cache-awslc.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'awslc') && steps.cache-awslc.outputs.cache-hit != 'true' }}
         run: |
           curl -LOsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/awslabs/aws-lc/archive/refs/tags/v${AWSLC_VERSION}.tar.gz" | tar -xz
@@ -549,7 +549,7 @@ jobs:
           cmake --install .
 
       - name: 'cache rustls'
-        if: contains(matrix.build.install_steps, 'rustls')
+        if: ${{ contains(matrix.build.install_steps, 'rustls') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-rustls
         env:
@@ -559,7 +559,7 @@ jobs:
           key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ env.RUSTLS_VERSION }}
 
       - name: 'fetch rustls deb'
-        if: contains(matrix.build.install_steps, 'rustls') && steps.cache-rustls.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'rustls') && steps.cache-rustls.outputs.cache-hit != 'true' }}
         run: |
           mkdir -p ~/rustls
           curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
@@ -569,11 +569,11 @@ jobs:
 
       - name: 'build rustls'
         # Note: we don't check cache-hit here. If the cache is hit, we still need to dpkg install the deb.
-        if: contains(matrix.build.install_steps, 'rustls')
+        if: ${{ contains(matrix.build.install_steps, 'rustls') }}
         run: sudo dpkg -i ~/rustls/"librustls_${RUSTLS_VERSION}_amd64.deb"
 
       - name: 'install Intel compilers'
-        if: contains(matrix.build.install_steps, 'intel')
+        if: ${{ contains(matrix.build.install_steps, 'intel') }}
         run: |
           curl -sSf --compressed https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | sudo tee /etc/apt/trusted.gpg.d/intel-sw.asc >/dev/null
           sudo add-apt-repository "deb https://apt.repos.intel.com/oneapi all main"
@@ -698,13 +698,13 @@ jobs:
           fi
 
       - name: 'install pytest prereqs'
-        if: contains(matrix.build.install_steps, 'pytest')
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
         run: |
           [ -x ~/venv/bin/activate ] && source ~/venv/bin/activate
           python3 -m pip install -r tests/http/requirements.txt
 
       - name: 'run pytest'
-        if: contains(matrix.build.install_steps, 'pytest')
+        if: ${{ contains(matrix.build.install_steps, 'pytest') }}
         env:
           PYTEST_ADDOPTS: '--color=yes'
           PYTEST_XDIST_AUTO_NUM_WORKERS: 4

.github/workflows/macos.yml

@@ -368,7 +368,6 @@ jobs:
           fi
 
   combinations:  # Test buildability with host OS, Xcode / SDK, compiler, target-OS, Secure Transport/not, built tool, combinations
-    if: true  # Set to `true` to enable this test matrix. It runs quickly.
     name: "${{ matrix.build == 'cmake' && 'CM' || 'AM' }} ${{ matrix.compiler }} ${{ matrix.image }} ${{ matrix.xcode }} ${{ matrix.config }}"
     runs-on: ${{ matrix.image }}
     timeout-minutes: 10

.github/workflows/non-native.yml

@@ -333,7 +333,7 @@ jobs:
           echo '::group::brew packages installed'; ls -l /opt/homebrew/opt; echo '::endgroup::'
 
       - name: 'cache libressl'
-        if: contains(matrix.build.install_steps, 'libressl')
+        if: ${{ contains(matrix.build.install_steps, 'libressl') }}
         uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
         id: cache-libressl
         env:
@@ -343,7 +343,7 @@ jobs:
           key: iOS-${{ env.cache-name }}-${{ env.LIBRESSL_VERSION }}
 
       - name: 'build libressl'
-        if: contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true'
+        if: ${{ contains(matrix.build.install_steps, 'libressl') && steps.cache-libressl.outputs.cache-hit != 'true' }}
         run: |
           curl -LsSf --retry 6 --retry-connrefused --max-time 999 \
             "https://github.com/libressl/portable/releases/download/v${LIBRESSL_VERSION}/libressl-${LIBRESSL_VERSION}.tar.gz" | tar -x