Nested JSON appsetting substitution not working in microsoft/variable-substitution

I am trying to replace a nested JSON object in the app setting.

Below is the expectation:

Before replacement:

{    
    "externalapp": ""    
}

After replacement:

{
    "externalapp": {
        "url":"https://external.com",
        "cleintid": "cid",
        "secret":"client secret"
    }
}

externalapp JSON ({..} including braces) is stored as a secret in GitHub environments and referenced during the workflow run.
But the problem is that the replaced JSON is appearing as a string.

Below is the actual output:

"externalapp":
    "{\n
    \"url\":\"https://external.com", \n
    \"clientid\": \"cid", \n
    \"secret\":\"client secret" \n
    \n}"

Any idea how to get rid of these additional characters (\n, \,")?

Please find the workflow code:

- name: Update Dynamics URL
  uses: microsoft/variable-substitution@v1 
  with:
    files: 'appsettings.json'
  env:
    externalapp: ${{ secrets.EXTERNAL_APP }}

Thanks in advance!

The issue is that jobs.<job_id>.steps\[*\].env loads your secret as a JSON string, which will replace your line breaks with \n and escape all your JSON key/values quotes with \".

If you don't have another reason to use microsoft/variable-substitution, just use jq to update your object. For example:

jobs:
  foo:
    runs-on: ubuntu-latest
    steps:
      - shell: bash
        run: |
          echo '{ "externalapp": ""  }' > appsettings.json
      - name: Replace secret
        shell: bash
        run: |
           cat appsettings.json | jq --argjson my_secret $MY_SECRET '.externalapp = $my_secret' > newfile.json
        env: 
          # In your case it would be:  ${{ secrets.EXTERNAL_APP }}
          MY_SECRET: '{ "url":"https://external.com", "cleintid": "cid", "secret":"client secret" }'