fix: apply JJB 6 deprecation resolutions

As of [Jenkins Job Builder 6][1], jobs are expanded the same way as
job templates, which means that braces become meaningful.

To fix the breakages that this causes in our jobs, we need to double-up
braces where they do not represent valid template expansions, which this
change actions.

[1]: https://jenkins-job-builder.readthedocs.io/en/latest/changelog.html#release-6-0-0

Change-Id: I171c60a14c24023042f5645be4f0403678ccee82
Signed-off-by: Chris Kay <chris.kay@arm.com>
diff --git a/arm-xlat-main.yaml b/arm-xlat-main.yaml
index 06186c9..6ae5af0 100644
--- a/arm-xlat-main.yaml
+++ b/arm-xlat-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_XLAT_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_XLAT_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_XLAT_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_XLAT_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_XLAT_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-xlat
                 TEST_REPO_PROJECT=rust-spmc
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-cci-main.yaml b/crate-arm-cci-main.yaml
index d922038..d793f0e 100644
--- a/crate-arm-cci-main.yaml
+++ b/crate-arm-cci-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_CCI_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_CCI_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_CCI_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_CCI_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_CCI_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-cci
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-ffa-main.yaml b/crate-arm-ffa-main.yaml
index 2212006..7c0635c 100644
--- a/crate-arm-ffa-main.yaml
+++ b/crate-arm-ffa-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_FFA_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_FFA_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_FFA_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_FFA_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_FFA_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-ffa
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-fvp-base-pac-main.yaml b/crate-arm-fvp-base-pac-main.yaml
index ce937a8..3c0322c 100644
--- a/crate-arm-fvp-base-pac-main.yaml
+++ b/crate-arm-fvp-base-pac-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_FVP_BASE_PAC_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_FVP_BASE_PAC_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_FVP_BASE_PAC_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_FVP_BASE_PAC_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_FVP_BASE_PAC_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-fvp-base-pac
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-generic-timer-main.yaml b/crate-arm-generic-timer-main.yaml
index 8f75fbb..ff534ce 100644
--- a/crate-arm-generic-timer-main.yaml
+++ b/crate-arm-generic-timer-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_GENERIC_TIMER_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_GENERIC_TIMER_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_GENERIC_TIMER_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_GENERIC_TIMER_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_GENERIC_TIMER_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-generic-timer
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-gic-main.yaml b/crate-arm-gic-main.yaml
index cc3220f..834548d 100644
--- a/crate-arm-gic-main.yaml
+++ b/crate-arm-gic-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_GIC_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_GIC_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_GIC_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_GIC_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_GIC_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
diff --git a/crate-arm-mhu-main.yaml b/crate-arm-mhu-main.yaml
index a44d2db..966be2b 100644
--- a/crate-arm-mhu-main.yaml
+++ b/crate-arm-mhu-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_MHU_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -80,7 +80,7 @@
           description: Features the arm-mhu crate will be tested against
       - string:
           name: SHARE_FOLDER
-          default: /srv/shared/${JOB_NAME}/${BUILD_NUMBER}
+          default: /srv/shared/${{JOB_NAME}}/${{BUILD_NUMBER}}
           description: Folder containing shared repositories for downstream pipeline jobs
       - string:
           name: CLONE_REPOS
@@ -97,14 +97,14 @@
       - workspace-cleanup
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_MHU_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_MHU_GERRIT_REFSPEC=${GERRIT_REFSPEC}
-          SHARE_FOLDER=${SHARE_FOLDER}
+          ARM_MHU_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_MHU_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
+          SHARE_FOLDER=${{SHARE_FOLDER}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -116,5 +116,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-mhu
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-pl011-uart-main.yaml b/crate-arm-pl011-uart-main.yaml
index 11f9f34..5bdfddd 100644
--- a/crate-arm-pl011-uart-main.yaml
+++ b/crate-arm-pl011-uart-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_PL011_UART_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_PL011_UART_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_PL011_UART_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_PL011_UART_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_PL011_UART_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-pl011-uart
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-pl061.yaml b/crate-arm-pl061.yaml
index f933b26..23fb528 100644
--- a/crate-arm-pl061.yaml
+++ b/crate-arm-pl061.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_PL061_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_PL061_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_PL061_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_PL061_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_PL061_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-pl061
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-psci-main.yaml b/crate-arm-psci-main.yaml
index 555f56f..4535fe9 100644
--- a/crate-arm-psci-main.yaml
+++ b/crate-arm-psci-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_PSCI_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_PSCI_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_PSCI_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_PSCI_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_PSCI_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-psci
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-scmi-main.yaml b/crate-arm-scmi-main.yaml
index 0f984e7..8d52eb0 100644
--- a/crate-arm-scmi-main.yaml
+++ b/crate-arm-scmi-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_SCMI_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -80,7 +80,7 @@
           description: Features the arm-scmi crate will be tested against
       - string:
           name: SHARE_FOLDER
-          default: /srv/shared/${JOB_NAME}/${BUILD_NUMBER}
+          default: /srv/shared/${{JOB_NAME}}/${{BUILD_NUMBER}}
           description: Folder containing shared repositories for downstream pipeline jobs
       - string:
           name: CLONE_REPOS
@@ -97,14 +97,14 @@
       - workspace-cleanup
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_SCMI_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_SCMI_GERRIT_REFSPEC=${GERRIT_REFSPEC}
-          SHARE_FOLDER=${SHARE_FOLDER}
+          ARM_SCMI_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_SCMI_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
+          SHARE_FOLDER=${{SHARE_FOLDER}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -116,5 +116,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-scmi
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-sp805-main.yaml b/crate-arm-sp805-main.yaml
index 1997bfc..503b1af 100644
--- a/crate-arm-sp805-main.yaml
+++ b/crate-arm-sp805-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_SP805_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_SP805_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_SP805_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_SP805_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_SP805_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-sp805
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/crate-arm-sysregs-main.yaml b/crate-arm-sysregs-main.yaml
index be49e6a..548ea04 100644
--- a/crate-arm-sysregs-main.yaml
+++ b/crate-arm-sysregs-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_SYSREGS_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -80,7 +80,7 @@
           description: Features the arm-sysregs crate will be tested against
       - string:
           name: SHARE_FOLDER
-          default: /srv/shared/${JOB_NAME}/${BUILD_NUMBER}
+          default: /srv/shared/${{JOB_NAME}}/${{BUILD_NUMBER}}
           description: Folder containing shared repositories for downstream pipeline jobs
       - string:
           name: CLONE_REPOS
@@ -97,14 +97,14 @@
       - workspace-cleanup
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_SCMI_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_SCMI_GERRIT_REFSPEC=${GERRIT_REFSPEC}
-          SHARE_FOLDER=${SHARE_FOLDER}
+          ARM_SCMI_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_SCMI_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
+          SHARE_FOLDER=${{SHARE_FOLDER}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -116,6 +116,6 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-sysregs
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
 
diff --git a/crate-arm-tzc-main.yaml b/crate-arm-tzc-main.yaml
index d026117..3f69d94 100644
--- a/crate-arm-tzc-main.yaml
+++ b/crate-arm-tzc-main.yaml
@@ -29,7 +29,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_TZC_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -59,13 +59,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_TZC_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_TZC_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_TZC_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_TZC_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -77,5 +77,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=arm-tzc
                 TEST_REPO_PROJECT=arm-firmware-crates
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/firmware-development-guide-main.yaml b/firmware-development-guide-main.yaml
index b47afeb..2827d17 100644
--- a/firmware-development-guide-main.yaml
+++ b/firmware-development-guide-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: ARM_FW_DEV_GUIDE_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          ARM_FW_DEV_GUIDE_GERRIT_PROJECT=${GERRIT_PROJECT}
-          ARM_FW_DEV_GUIDE_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          ARM_FW_DEV_GUIDE_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          ARM_FW_DEV_GUIDE_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=firmware-development-guide
                 TEST_REPO_PROJECT=rust-spmc
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/generic-lib-testing.yaml b/generic-lib-testing.yaml
index 7e9c5eb..6be206d 100644
--- a/generic-lib-testing.yaml
+++ b/generic-lib-testing.yaml
@@ -59,23 +59,23 @@
           timeout: 240
           fail: true
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PROJECT=${RF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${GERRIT_BRANCH}
-          GERRIT_REFSPEC=${RFA_REFSPEC}
+          GERRIT_PROJECT=${{RF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{RFA_REFSPEC}}
           EOF
 
-          cd ${WORKSPACE}
+          cd ${{WORKSPACE}}
           # Executed project-related next checks: platform independent tests with a generic platform.
-          IS_CONTINUOUS_INTEGRATION=1 ${WORKSPACE}/tf-a-ci-scripts/script/next-checks/next-checks-generic-tests.sh \
-            ${TEST_REPO_PROJECT} ${TEST_REPO_NAME}
+          IS_CONTINUOUS_INTEGRATION=1 ${{WORKSPACE}}/tf-a-ci-scripts/script/next-checks/next-checks-generic-tests.sh \
+            ${{TEST_REPO_PROJECT}} ${{TEST_REPO_NAME}}
     publishers:
       - archive:
           artifacts: next-generic-checks.log
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - generic-lib-testing/postbuild.groovy
diff --git a/libeventlog-patch-gate.yaml b/libeventlog-patch-gate.yaml
index 546f202..bb3b832 100644
--- a/libeventlog-patch-gate.yaml
+++ b/libeventlog-patch-gate.yaml
@@ -20,11 +20,11 @@
             block: true
             current-parameters: true
             predefined-parameters: |
-              URL=https://${GERRIT_HOST}/${GERRIT_PROJECT}
-              REFSPEC=${GERRIT_REFSPEC}
-              REFNAME=${GERRIT_PATCHSET_REVISION}
-              BASE_REFSPEC=${GERRIT_REFSPEC}
-              BASE_REFNAME=${GERRIT_PATCHSET_REVISION}^
+              URL=https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}}
+              REFSPEC=${{GERRIT_REFSPEC}}
+              REFNAME=${{GERRIT_PATCHSET_REVISION}}
+              BASE_REFSPEC=${{GERRIT_REFSPEC}}
+              BASE_REFNAME=${{GERRIT_PATCHSET_REVISION}}^
 
     triggers:
       - gerrit:
diff --git a/libeventlog-pipeline.yaml b/libeventlog-pipeline.yaml
index c5d278e..439b1ee 100644
--- a/libeventlog-pipeline.yaml
+++ b/libeventlog-pipeline.yaml
@@ -5,4 +5,4 @@
       style, and building the module.
     project-type: pipeline
     sandbox: true
-    dsl: !include-raw: libeventlog-pipeline/Jenkinsfile
+    dsl: !include-raw-verbatim: libeventlog-pipeline/Jenkinsfile
diff --git a/libtl-patch-gate.yaml b/libtl-patch-gate.yaml
index cfe00d6..d01e07c 100644
--- a/libtl-patch-gate.yaml
+++ b/libtl-patch-gate.yaml
@@ -18,22 +18,22 @@
             block: true
             current-parameters: true
             predefined-parameters: |
-              URL=https://${GERRIT_HOST}/${GERRIT_PROJECT}
-              REFSPEC=${GERRIT_REFSPEC}
-              REFNAME=${GERRIT_PATCHSET_REVISION}
-              BASE_REFSPEC=${GERRIT_REFSPEC}
-              BASE_REFNAME=${GERRIT_PATCHSET_REVISION}^
+              URL=https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}}
+              REFSPEC=${{GERRIT_REFSPEC}}
+              REFNAME=${{GERRIT_PATCHSET_REVISION}}
+              BASE_REFSPEC=${{GERRIT_REFSPEC}}
+              BASE_REFNAME=${{GERRIT_PATCHSET_REVISION}}^
       - trigger-builds:
           - project:
               - tlc-pipeline
             block: true
             current-parameters: true
             predefined-parameters: |
-              URL=https://${GERRIT_HOST}/${GERRIT_PROJECT}
-              REFSPEC=${GERRIT_REFSPEC}
-              REFNAME=${GERRIT_PATCHSET_REVISION}
-              BASE_REFSPEC=${GERRIT_REFSPEC}
-              BASE_REFNAME=${GERRIT_PATCHSET_REVISION}^
+              URL=https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}}
+              REFSPEC=${{GERRIT_REFSPEC}}
+              REFNAME=${{GERRIT_PATCHSET_REVISION}}
+              BASE_REFSPEC=${{GERRIT_REFSPEC}}
+              BASE_REFNAME=${{GERRIT_PATCHSET_REVISION}}^
 
     triggers:
       - gerrit:
diff --git a/libtl-pipeline.yaml b/libtl-pipeline.yaml
index 27efbe7..227626e 100644
--- a/libtl-pipeline.yaml
+++ b/libtl-pipeline.yaml
@@ -5,4 +5,4 @@
       style, building the module, and running unit tests.
     project-type: pipeline
     sandbox: true
-    dsl: !include-raw: libtl-pipeline/Jenkinsfile
+    dsl: !include-raw-verbatim: libtl-pipeline/Jenkinsfile
diff --git a/libtpm-patch-gate.yaml b/libtpm-patch-gate.yaml
index 30cc5d9..3cd6dbf 100644
--- a/libtpm-patch-gate.yaml
+++ b/libtpm-patch-gate.yaml
@@ -18,11 +18,11 @@
             block: true
             current-parameters: true
             predefined-parameters: |
-              URL=https://${GERRIT_HOST}/${GERRIT_PROJECT}
-              REFSPEC=${GERRIT_REFSPEC}
-              REFNAME=${GERRIT_PATCHSET_REVISION}
-              BASE_REFSPEC=${GERRIT_REFSPEC}
-              BASE_REFNAME=${GERRIT_PATCHSET_REVISION}^
+              URL=https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}}
+              REFSPEC=${{GERRIT_REFSPEC}}
+              REFNAME=${{GERRIT_PATCHSET_REVISION}}
+              BASE_REFSPEC=${{GERRIT_REFSPEC}}
+              BASE_REFNAME=${{GERRIT_PATCHSET_REVISION}}^
 
     triggers:
       - gerrit:
diff --git a/rf-a-builder.yaml b/rf-a-builder.yaml
index 2753cd9..3225139 100644
--- a/rf-a-builder.yaml
+++ b/rf-a-builder.yaml
@@ -57,7 +57,7 @@
           default: https://github.com/Mbed-TLS/mbedtls/archive/mbedtls-3.6.5.tar.gz
       - string:
           name: DOCKER_REGISTRY
-          default: ${PRIVATE_CONTAINER_REGISTRY}
+          default: ${{PRIVATE_CONTAINER_REGISTRY}}
           description: PRIVATE_CONTAINER_REGISTRY is a system-wide environment variable
       - string:
           name: GERRIT_PATCHSET_NUMBER
@@ -113,13 +113,13 @@
     builders:
       - shell: |
           aarch64-none-elf-gcc -v || true
-      - shell: !include-raw: scripts/clone.sh
-      - shell: !include-raw: tf-a-builder/builders.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
+      - shell: !include-raw-verbatim: tf-a-builder/builders.sh
       - inject:
           properties-file: artefacts/env
       - shell: |
-          ln -s "artefacts/${BIN_MODE:-release}" "artefacts-lava"
-          echo ${BIN_MODE:-release} >lava-binmode.txt
+          ln -s "artefacts/${{BIN_MODE:-release}}" "artefacts-lava"
+          echo ${{BIN_MODE:-release}} >lava-binmode.txt
       - conditional-step:
           condition-kind: file-exists
           on-evaluation-failure: dont-run
@@ -130,10 +130,10 @@
                 #!/bin/bash
                 set -e
                 DEVICE_TYPE=fvp
-                CUSTOM_YAML_URL=${BUILD_URL}/artifact/artefacts-lava/job.yaml
-                DEVICE_TYPE=$(awk -F': ' '/device_type/ {print $2}' ${WORKSPACE}/artefacts-lava/job.yaml)
-                cat << EOF > ${WORKSPACE}/lava.param
-                DEVICE_TYPE=${DEVICE_TYPE}
+                CUSTOM_YAML_URL=${{BUILD_URL}}/artifact/artefacts-lava/job.yaml
+                DEVICE_TYPE=$(awk -F': ' '/device_type/ {{print $2}}' ${{WORKSPACE}}/artefacts-lava/job.yaml)
+                cat << EOF > ${{WORKSPACE}}/lava.param
+                DEVICE_TYPE=${{DEVICE_TYPE}}
                 LAVA_SERVER=tf.validation.linaro.org
                 EOF
     publishers:
@@ -156,7 +156,7 @@
                         - SUCCESS
                       build-steps:
                         - inject:
-                            properties-file: ${WORKSPACE}/lava.param
+                            properties-file: ${{WORKSPACE}}/lava.param
                         - shell: |
                             #!/bin/bash -x
 
@@ -194,5 +194,5 @@
           latest-only: false
           allow-empty: true
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - rf-a-builder/postbuild.groovy
diff --git a/rf-a-ci-gateway.yaml b/rf-a-ci-gateway.yaml
index 53d8270..a1836ca 100644
--- a/rf-a-ci-gateway.yaml
+++ b/rf-a-ci-gateway.yaml
@@ -84,11 +84,11 @@
           description: |
             Optional arg to clone only specific projects from default list (tf-a-ci-scripts,trusted-firmware-a,tf-a-tests,spm,tf-m-tests,tf-m-extras)
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -114,10 +114,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/rf-a-commitlint.yaml b/rf-a-commitlint.yaml
index faff583..20417b2 100644
--- a/rf-a-commitlint.yaml
+++ b/rf-a-commitlint.yaml
@@ -3,7 +3,7 @@
     description: Lint commit messages
     project-type: pipeline
     sandbox: true
-    dsl: !include-raw: rf-a-static/Jenkinsfile
+    dsl: !include-raw-verbatim: rf-a-static/Jenkinsfile
     properties:
       - build-discarder:
           days-to-keep: 14
diff --git a/rf-a-main.yaml b/rf-a-main.yaml
index 979f7bd..f9370d4 100644
--- a/rf-a-main.yaml
+++ b/rf-a-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: RFA_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -97,17 +97,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          RF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          RFA_REFSPEC=${RFA_REFSPEC}
-          GERRIT_REFSPEC=${GERRIT_REFSPEC}
-          GERRIT_BRANCH=${GERRIT_BRANCH}
+          RF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          RFA_REFSPEC=${{RFA_REFSPEC}}
+          GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
+          GERRIT_BRANCH=${{GERRIT_BRANCH}}
           TF_GERRIT_PROJECT=TF-A/trusted-firmware-a
-          TF_GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          TF_GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Lint commit messages
@@ -116,9 +116,9 @@
             - name: rf-a-commitlint
               kill-phase-on: NEVER
               predefined-parameters: |
-                REFSPEC=${GERRIT_REFSPEC}
-                REFNAME=${GERRIT_PATCHSET_REVISION}
-                REFNAME_BASE=origin/${GERRIT_BRANCH}
+                REFSPEC=${{GERRIT_REFSPEC}}
+                REFNAME=${{GERRIT_PATCHSET_REVISION}}
+                REFNAME_BASE=origin/${{GERRIT_BRANCH}}
       - multijob:
           name: Code formatting, static checks and lints
           condition: COMPLETED
@@ -127,9 +127,9 @@
               current-parameters: true
               kill-phase-on: NEVER
               predefined-parameters: |
-                GERRIT_BRANCH=${GERRIT_BRANCH}
-                RFA_REFSPEC=${RFA_REFSPEC}
-                GERRIT_REFSPEC=${GERRIT_REFSPEC}
+                GERRIT_BRANCH=${{GERRIT_BRANCH}}
+                RFA_REFSPEC=${{RFA_REFSPEC}}
+                GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
               property-file: tf-a-env.param
       - multijob:
           name: Platform independent tests
@@ -142,7 +142,7 @@
                 TEST_REPO_NAME=rusted-firmware-a
                 TEST_REPO_PROJECT=RF-A
                 RFA_REFSPEC=$RFA_REFSPEC
-                GERRIT_REFSPEC=${GERRIT_REFSPEC}
+                GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
               property-file: tf-a-env.param
       - multijob:
           name: Build Rusted Firmware A
diff --git a/rf-a-static.yaml b/rf-a-static.yaml
index 382b424..1ab319c 100644
--- a/rf-a-static.yaml
+++ b/rf-a-static.yaml
@@ -61,22 +61,22 @@
           timeout: 240
           fail: true
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          RFA_REFSPEC=${RFA_REFSPEC}
-          GERRIT_REFSPEC=${GERRIT_REFSPEC}
-          GERRIT_BRANCH=${GERRIT_BRANCH}
+          RFA_REFSPEC=${{RFA_REFSPEC}}
+          GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
+          GERRIT_BRANCH=${{GERRIT_BRANCH}}
           EOF
-          cd ${WORKSPACE}/rusted-firmware-a
+          cd ${{WORKSPACE}}/rusted-firmware-a
           # Executed project-related static checks: copyright, unix line endings,
           # formatting and lints
-          IS_CONTINUOUS_INTEGRATION=1 ${WORKSPACE}/tf-a-ci-scripts/script/next-checks/next-checks.sh
+          IS_CONTINUOUS_INTEGRATION=1 ${{WORKSPACE}}/tf-a-ci-scripts/script/next-checks/next-checks.sh
     publishers:
       - archive:
           artifacts: rusted-firmware-a/next-checks.log
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - rf-a-static/postbuild.groovy
diff --git a/rf-a-unsafe.yaml b/rf-a-unsafe.yaml
index e3a08ec..0ac9dac 100644
--- a/rf-a-unsafe.yaml
+++ b/rf-a-unsafe.yaml
@@ -45,7 +45,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: RFA_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -75,19 +75,19 @@
           timeout: 240
           fail: true
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -ex
           cat << EOF > tf-a-env.param
-          RF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          RFA_REFSPEC=${GERRIT_REFSPEC}
+          RF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          RFA_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
 
-          cd ${WORKSPACE}/rusted-firmware-a
+          cd ${{WORKSPACE}}/rusted-firmware-a
 
           git fetch --unshallow --update-shallow origin
-          git fetch --unshallow --update-shallow origin ${GERRIT_BRANCH} ${GERRIT_REFSPEC}
+          git fetch --unshallow --update-shallow origin ${{GERRIT_BRANCH}} ${{GERRIT_REFSPEC}}
 
           # Vote Unsafe-Review+1 on patches not touching any unsafe code
 
@@ -103,7 +103,7 @@
 
           # 2. Cast the Unsafe-Review +1 vote if the patch does NOT touch unsafe code:
 
-          SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 29418 -i ${CI_BOT_KEY}"
+          SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 29418 -i ${{CI_BOT_KEY}}"
           GERRIT_URL="review.trustedfirmware.org"
-          SET_SAFE_CMD="${SSH_PARAMS} ${CI_BOT_USERNAME}@${GERRIT_URL} gerrit review --label Unsafe-Review=1 -m Safe"
-          ssh ${SET_SAFE_CMD} ${GERRIT_CHANGE_NUMBER},${GERRIT_PATCHSET_NUMBER}
+          SET_SAFE_CMD="${{SSH_PARAMS}} ${{CI_BOT_USERNAME}}@${{GERRIT_URL}} gerrit review --label Unsafe-Review=1 -m Safe"
+          ssh ${{SET_SAFE_CMD}} ${{GERRIT_CHANGE_NUMBER}},${{GERRIT_PATCHSET_NUMBER}}
diff --git a/tf-a-arm-weekly.yaml b/tf-a-arm-weekly.yaml
index d5aaca1..edb6702 100644
--- a/tf-a-arm-weekly.yaml
+++ b/tf-a-arm-weekly.yaml
@@ -69,19 +69,19 @@
     wrappers:
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: TFTF Fuzzing
diff --git a/tf-a-artifacts-cleanup.yaml b/tf-a-artifacts-cleanup.yaml
index dde96ee..36603de 100644
--- a/tf-a-artifacts-cleanup.yaml
+++ b/tf-a-artifacts-cleanup.yaml
@@ -19,4 +19,4 @@
       - shell: |
           #!/bin/bash
 
-          find /var/lib/jenkins/jobs/tf-a-builder/builds -name build.log -mtime +5 | head -n1000 | xargs -i -n1 bash -c "echo {}; gzip -9 {}"
+          find /var/lib/jenkins/jobs/tf-a-builder/builds -name build.log -mtime +5 | head -n1000 | xargs -i -n1 bash -c "echo {{}}; gzip -9 {{}}"
diff --git a/tf-a-builder.yaml b/tf-a-builder.yaml
index 72cc361..a37511c 100644
--- a/tf-a-builder.yaml
+++ b/tf-a-builder.yaml
@@ -55,7 +55,7 @@
             tf-a-job-configs refspec to use. The master branch is used by default.
       - string:
           name: DOCKER_REGISTRY
-          default: ${PRIVATE_CONTAINER_REGISTRY}
+          default: ${{PRIVATE_CONTAINER_REGISTRY}}
           description: PRIVATE_CONTAINER_REGISTRY is a system-wide environment variable
       - string:
           name: JUNO_ROOTFS_URL
@@ -112,13 +112,13 @@
     builders:
       - shell: |
           aarch64-none-elf-gcc -v || true
-      - shell: !include-raw: scripts/clone.sh
-      - shell: !include-raw: tf-a-builder/builders.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
+      - shell: !include-raw-verbatim: tf-a-builder/builders.sh
       - inject:
           properties-file: artefacts/env
       - shell: |
-          ln -s "artefacts/${BIN_MODE:-release}" "artefacts-lava"
-          echo ${BIN_MODE:-release} >lava-binmode.txt
+          ln -s "artefacts/${{BIN_MODE:-release}}" "artefacts-lava"
+          echo ${{BIN_MODE:-release}} >lava-binmode.txt
       - conditional-step:
           condition-kind: file-exists
           on-evaluation-failure: dont-run
@@ -129,10 +129,10 @@
                 #!/bin/bash
                 set -e
                 DEVICE_TYPE=fvp
-                CUSTOM_YAML_URL=${BUILD_URL}/artifact/artefacts-lava/job.yaml
-                DEVICE_TYPE=$(awk -F': ' '/device_type/ {print $2}' ${WORKSPACE}/artefacts-lava/job.yaml)
-                cat << EOF > ${WORKSPACE}/lava.param
-                DEVICE_TYPE=${DEVICE_TYPE}
+                CUSTOM_YAML_URL=${{BUILD_URL}}/artifact/artefacts-lava/job.yaml
+                DEVICE_TYPE=$(awk -F': ' '/device_type/ {{print $2}}' ${{WORKSPACE}}/artefacts-lava/job.yaml)
+                cat << EOF > ${{WORKSPACE}}/lava.param
+                DEVICE_TYPE=${{DEVICE_TYPE}}
                 LAVA_SERVER=tf.validation.linaro.org
                 EOF
     publishers:
@@ -155,7 +155,7 @@
                         - SUCCESS
                       build-steps:
                         - inject:
-                            properties-file: ${WORKSPACE}/lava.param
+                            properties-file: ${{WORKSPACE}}/lava.param
                         - shell: |
                             #!/bin/bash -x
 
@@ -221,5 +221,5 @@
           latest-only: false
           allow-empty: true
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-builder/postbuild.groovy
diff --git a/tf-a-ci-coverage-gateway.yaml b/tf-a-ci-coverage-gateway.yaml
index 3f772f9..0a58974 100644
--- a/tf-a-ci-coverage-gateway.yaml
+++ b/tf-a-ci-coverage-gateway.yaml
@@ -84,11 +84,11 @@
           name: QA_TOOLS_BRANCH
           default: master
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -114,10 +114,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-ci-gateway.yaml b/tf-a-ci-gateway.yaml
index 33fc96d..fbe8076 100644
--- a/tf-a-ci-gateway.yaml
+++ b/tf-a-ci-gateway.yaml
@@ -94,11 +94,11 @@
           description: |
             Whether to submit FVP tests via TuxSuite (instead of LAVA)
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -124,10 +124,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-commitlint.yaml b/tf-a-commitlint.yaml
index af53f1a..d756be1 100644
--- a/tf-a-commitlint.yaml
+++ b/tf-a-commitlint.yaml
@@ -3,7 +3,7 @@
     description: Lint commit messages.
     project-type: pipeline
     sandbox: true
-    dsl: !include-raw: tf-a-commitlint/Jenkinsfile
+    dsl: !include-raw-verbatim: tf-a-commitlint/Jenkinsfile
     properties:
       - build-discarder:
           days-to-keep: 14
diff --git a/tf-a-coverity.yaml b/tf-a-coverity.yaml
index 7b5c521..2bb0225 100644
--- a/tf-a-coverity.yaml
+++ b/tf-a-coverity.yaml
@@ -49,45 +49,45 @@
               credential-id: TF-COVERITY-SCAN-TOKEN
               variable: TF_COVERITY_SCAN_TOKEN
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           set -x
 
           # Fetch coverity tool and untar it
-          cd ${WORKSPACE}
-          wget ${DOWNLOAD_SERVER_URL}/tf-a/tf-a-coverity/coverity_tool.tgz
+          cd ${{WORKSPACE}}
+          wget ${{DOWNLOAD_SERVER_URL}}/tf-a/tf-a-coverity/coverity_tool.tgz
           tar -xzf coverity_tool.tgz
-          mv cov-analysis-linux64-${COVERITY_VERSION} coverity
-          export PATH=${WORKSPACE}/coverity/bin:${PATH}
+          mv cov-analysis-linux64-${{COVERITY_VERSION}} coverity
+          export PATH=${{WORKSPACE}}/coverity/bin:${{PATH}}
 
           # Run coverity
-          cd ${WORKSPACE}/trusted-firmware-a
-          ${WORKSPACE}/tf-a-ci-scripts/script/tf-coverity/run_coverity_on_tf.py --tf $(pwd)
+          cd ${{WORKSPACE}}/trusted-firmware-a
+          ${{WORKSPACE}}/tf-a-ci-scripts/script/tf-coverity/run_coverity_on_tf.py --tf $(pwd)
       - conditional-step:
           condition-kind: boolean-expression
-          condition-expression: ${UPLOAD_TO_COVERITY_SCAN_ONLINE}
+          condition-expression: ${{UPLOAD_TO_COVERITY_SCAN_ONLINE}}
           on-evaluation-failure: dont-run
           steps:
             - shell: |
                 #!/bin/bash
                 set -e
 
-                cd ${WORKSPACE}/trusted-firmware-a
+                cd ${{WORKSPACE}}/trusted-firmware-a
                 GIT_COMMIT=$(git rev-parse HEAD)
 
                 echo "Uploading tarball to Coverity Scan Online..."
                 curl \
-                  --form token="${TF_COVERITY_SCAN_TOKEN}" \
+                  --form token="${{TF_COVERITY_SCAN_TOKEN}}" \
                   --form email=sandrine.bailleux@arm.com \
                   --form file=@"arm-tf-coverity-results.tgz" \
-                  --form version="Commit ${GIT_COMMIT}" \
-                  --form description="Build ${BUILD_DISPLAY_NAME}" \
+                  --form version="Commit ${{GIT_COMMIT}}" \
+                  --form description="Build ${{BUILD_DISPLAY_NAME}}" \
                   https://scan.coverity.com/builds?project=ARM-software%2Farm-trusted-firmware
     publishers:
       - archive:
           artifacts: trusted-firmware-a/arm-tf-coverity-results.tgz, trusted-firmware-a/tf_coverage.log
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-coverity/postbuild.groovy
diff --git a/tf-a-daily.yaml b/tf-a-daily.yaml
index d9f0c98..7cdbf77 100644
--- a/tf-a-daily.yaml
+++ b/tf-a-daily.yaml
@@ -55,7 +55,7 @@
     wrappers:
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
diff --git a/tf-a-docs-watcher.yaml b/tf-a-docs-watcher.yaml
index 30784b1..a08fbda 100644
--- a/tf-a-docs-watcher.yaml
+++ b/tf-a-docs-watcher.yaml
@@ -11,9 +11,9 @@
           echo "Trigger ReadTheDocs build on the $RTD_BRANCHES branch and the latest version"
           RTD_API="https://readthedocs.org/api/v3/projects/trustedfirmware-a"
           echo "Trigger build $RTD_BRANCHES branch"
-          curl -s -X POST -H "Authorization: Token ${RTD_TOKEN}" ${RTD_API}/versions/$RTD_BRANCHES/builds/ | jq .
+          curl -s -X POST -H "Authorization: Token ${{RTD_TOKEN}}" ${{RTD_API}}/versions/$RTD_BRANCHES/builds/ | jq .
           echo "Trigger build latest version"
-          curl -s -X POST -H "Authorization: Token ${RTD_TOKEN}" ${RTD_API}/versions/latest/builds/ | jq .
+          curl -s -X POST -H "Authorization: Token ${{RTD_TOKEN}}" ${{RTD_API}}/versions/latest/builds/ | jq .
     properties:
       - build-discarder:
           days-to-keep: 60
diff --git a/tf-a-eclair-daily.yaml b/tf-a-eclair-daily.yaml
index a85ea5c..7c26158 100644
--- a/tf-a-eclair-daily.yaml
+++ b/tf-a-eclair-daily.yaml
@@ -81,16 +81,16 @@
           git clone https://git.trustedfirmware.org/ci/tf-a-ci-scripts.git
           git clone https://git.trustedfirmware.org/ci/tf-ci-scripts.git
 
-          git clone --recurse-submodules https://${GERRIT_HOST}/${GERRIT_PROJECT} -b ${GERRIT_REFNAME}
+          git clone --recurse-submodules https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}} -b ${{GERRIT_REFNAME}}
           ls -l
-          if [ -n "${GERRIT_NEWREV}" ]; then
-              (cd $(basename ${GERRIT_PROJECT}); git checkout ${GERRIT_NEWREV})
+          if [ -n "${{GERRIT_NEWREV}}" ]; then
+              (cd $(basename ${{GERRIT_PROJECT}}); git checkout ${{GERRIT_NEWREV}})
           else
               # Checkout last commit from yesterday, to have a stable commit for
               # multiple builds.
-              (cd $(basename ${GERRIT_PROJECT}); git checkout $(git rev-list -n1 --before="today" HEAD))
+              (cd $(basename ${{GERRIT_PROJECT}}); git checkout $(git rev-list -n1 --before="today" HEAD))
           fi
-          (cd $(basename ${GERRIT_PROJECT}); git log -n1)
+          (cd $(basename ${{GERRIT_PROJECT}}); git log -n1)
 
           export ECLAIR_CONFIG_DIR=$PWD/tf-a-ci-scripts/eclair
           . tf-ci-scripts/eclair/utils.sh
@@ -100,7 +100,7 @@
           . tf-a-ci-scripts/eclair/eclair_vars.sh
 
           # retry detachLicense as LM client may not be ready initially
-          for i in {1..10}; do
+          for i in {{1..10}}; do
             detachLicense 600 && break
             echo "Attempt $i failed, retrying in 10s..."
             sleep 10
diff --git a/tf-a-eclair-delta.yaml b/tf-a-eclair-delta.yaml
index 636d408..413a2e8 100644
--- a/tf-a-eclair-delta.yaml
+++ b/tf-a-eclair-delta.yaml
@@ -102,11 +102,11 @@
           git clone https://git.trustedfirmware.org/ci/tf-a-ci-scripts.git
           git clone https://git.trustedfirmware.org/ci/tf-ci-scripts.git
 
-          git clone --recurse-submodules https://${GERRIT_HOST}/${GERRIT_PROJECT} -b ${GERRIT_BRANCH}
-          if [ -n "${GERRIT_REFSPEC}" ]; then
+          git clone --recurse-submodules https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}} -b ${{GERRIT_BRANCH}}
+          if [ -n "${{GERRIT_REFSPEC}}" ]; then
           (
-              cd $(basename ${GERRIT_PROJECT})
-              git fetch https://${GERRIT_HOST}/${GERRIT_PROJECT} ${GERRIT_REFSPEC} && git checkout FETCH_HEAD
+              cd $(basename ${{GERRIT_PROJECT}})
+              git fetch https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}} ${{GERRIT_REFSPEC}} && git checkout FETCH_HEAD
           )
           fi
           (cd trusted-firmware-a; git log --oneline -n5)
@@ -130,7 +130,7 @@
           echo "========= Building base revision ========="
 
           (
-              cd $(basename ${GERRIT_PROJECT})
+              cd $(basename ${{GERRIT_PROJECT}})
               git checkout HEAD^
               git log --oneline -n5
           )
diff --git a/tf-a-gerrit-tforg-l1.yaml b/tf-a-gerrit-tforg-l1.yaml
index a5747a7..7195fed 100644
--- a/tf-a-gerrit-tforg-l1.yaml
+++ b/tf-a-gerrit-tforg-l1.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -73,17 +73,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Lint commit messages
@@ -92,10 +92,10 @@
             - name: tf-a-commitlint
               kill-phase-on: NEVER
               predefined-parameters: |
-                URL=https://review.trustedfirmware.org/${GERRIT_PROJECT}
-                REFSPEC=${GERRIT_REFSPEC}
-                REFNAME=${GERRIT_PATCHSET_REVISION}
-                REFNAME_BASE=origin/${GERRIT_BRANCH}
+                URL=https://review.trustedfirmware.org/${{GERRIT_PROJECT}}
+                REFSPEC=${{GERRIT_REFSPEC}}
+                REFNAME=${{GERRIT_PATCHSET_REVISION}}
+                REFNAME_BASE=origin/${{GERRIT_BRANCH}}
       - multijob:
           condition: COMPLETED
           name: Build and static checks
diff --git a/tf-a-gerrit-tforg-l2.yaml b/tf-a-gerrit-tforg-l2.yaml
index 06c7d9a..201debb 100644
--- a/tf-a-gerrit-tforg-l2.yaml
+++ b/tf-a-gerrit-tforg-l2.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -78,17 +78,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-libtpm-pipeline.yaml b/tf-a-libtpm-pipeline.yaml
index cecafe1..24735ff 100644
--- a/tf-a-libtpm-pipeline.yaml
+++ b/tf-a-libtpm-pipeline.yaml
@@ -5,4 +5,4 @@
       style, and building the module.
     project-type: pipeline
     sandbox: true
-    dsl: !include-raw: libtpm-pipeline/Jenkinsfile
+    dsl: !include-raw-verbatim: libtpm-pipeline/Jenkinsfile
diff --git a/tf-a-lts-automation.yaml b/tf-a-lts-automation.yaml
index 090e58d..d8061b3 100644
--- a/tf-a-lts-automation.yaml
+++ b/tf-a-lts-automation.yaml
@@ -56,70 +56,70 @@
           set -ex
 
           SANDBOX_RUN="false"
-          REF="${GERRIT_REFNAME:-${UPSTREAM_REFNAME:-}}"
-          echo ${REF} | grep -q "^sandbox/" && SANDBOX_RUN="true" && echo "*** Sandbox run ***"
+          REF="${{GERRIT_REFNAME:-${{UPSTREAM_REFNAME:-}}}}"
+          echo ${{REF}} | grep -q "^sandbox/" && SANDBOX_RUN="true" && echo "*** Sandbox run ***"
           SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa"
-          export GIT_SSH_COMMAND="ssh -p 29418 -i $CI_BOT_KEY ${SSH_PARAMS}"
-          GERRIT_HOST=${GERRIT_HOST:-review.trustedfirmware.org}
-          gerrit_host="ssh://${CI_BOT_USERNAME}@${GERRIT_HOST}:29418"
-          new_branch=${REF}
-          forked_tag=${new_branch##*-}
-          [ "${SANDBOX_RUN}" = "true" ] && forked_tag="sandbox/${forked_tag}"
+          export GIT_SSH_COMMAND="ssh -p 29418 -i $CI_BOT_KEY ${{SSH_PARAMS}}"
+          GERRIT_HOST=${{GERRIT_HOST:-review.trustedfirmware.org}}
+          gerrit_host="ssh://${{CI_BOT_USERNAME}}@${{GERRIT_HOST}}:29418"
+          new_branch=${{REF}}
+          forked_tag=${{new_branch##*-}}
+          [ "${{SANDBOX_RUN}}" = "true" ] && forked_tag="sandbox/${{forked_tag}}"
 
           _workdir=$(mktemp -d)
           rm -f email.txt || true
-          trap '[ -d "${_workdir}" ] && rm -rf "${_workdir}"' EXIT
-          git -C "${_workdir}" init > /dev/null 2>&1
+          trap '[ -d "${{_workdir}}" ] && rm -rf "${{_workdir}}"' EXIT
+          git -C "${{_workdir}}" init > /dev/null 2>&1
 
           # Check if the job is triggered by a new LTS branch creation
-          if [ -n "${UPSTREAM_REFNAME:-}" ]; then
+          if [ -n "${{UPSTREAM_REFNAME:-}}" ]; then
             # Triggered by hafnium-lts-automation
             echo "Triggered by hafnium-lts-automation"
-            echo "New LTS branch created: ${new_branch}"
+            echo "New LTS branch created: ${{new_branch}}"
             MAIN_PROJ="TF-A/trusted-firmware-a"
-          elif [ "${GERRIT_EVENT_TYPE:-}" = "ref-updated" -a \
-                 "${GERRIT_OLDREV:-}" = "0000000000000000000000000000000000000000" ]; then
+          elif [ "${{GERRIT_EVENT_TYPE:-}}" = "ref-updated" -a \
+                 "${{GERRIT_OLDREV:-}}" = "0000000000000000000000000000000000000000" ]; then
             # Triggered from new LTS branch creation
-            echo "New branch created: ${new_branch}"
+            echo "New branch created: ${{new_branch}}"
           else
             echo "Not a new LTS branch event! exit job"
           	exit 0
           fi
 
           # Create new LTS branch to related repositories
-          repos="${MAIN_PROJ:-} TF-A/tf-a-tests ci/tf-a-ci-scripts ci/tf-a-job-configs"
-          for r in ${repos};
+          repos="${{MAIN_PROJ:-}} TF-A/tf-a-tests ci/tf-a-ci-scripts ci/tf-a-job-configs"
+          for r in ${{repos}};
           do
-              echo "Create branch \"${new_branch}\" from tag \"${forked_tag}\" in the \"${r}\" project"
-              if ! git ls-remote --exit-code "${gerrit_host}/${r}" "refs/heads/${new_branch}"; then
-                git -C "${_workdir}" fetch ${gerrit_host}/${r} ${forked_tag} || \
-                (echo "Can not find \"${forked_tag}\" tag on ${r} repository"; exit 1)
-                git -C "${_workdir}" push ${gerrit_host}/${r} FETCH_HEAD^{commit}:refs/heads/${new_branch}
+              echo "Create branch \"${{new_branch}}\" from tag \"${{forked_tag}}\" in the \"${{r}}\" project"
+              if ! git ls-remote --exit-code "${{gerrit_host}}/${{r}}" "refs/heads/${{new_branch}}"; then
+                git -C "${{_workdir}}" fetch ${{gerrit_host}}/${{r}} ${{forked_tag}} || \
+                (echo "Can not find \"${{forked_tag}}\" tag on ${{r}} repository"; exit 1)
+                git -C "${{_workdir}}" push ${{gerrit_host}}/${{r}} FETCH_HEAD^{{commit}}:refs/heads/${{new_branch}}
               fi
           done
 
           # Create new download space
-          echo "Create new download space for \"${new_branch}\""
-          if [ "${SANDBOX_RUN}" = "false" ]; then
-            aws s3 sync s3://trustedfirmware-prod-storage/tf-a s3://openci-trustedfirmware-storage-prod/tf-a-${new_branch}
+          echo "Create new download space for \"${{new_branch}}\""
+          if [ "${{SANDBOX_RUN}}" = "false" ]; then
+            aws s3 sync s3://trustedfirmware-prod-storage/tf-a s3://openci-trustedfirmware-storage-prod/tf-a-${{new_branch}}
           fi
 
-          echo "CI Environment Setup for ${new_branch} branch Completed" > subject.txt
+          echo "CI Environment Setup for ${{new_branch}} branch Completed" > subject.txt
           cat << EOF >email.txt
           Hello,
-          The new LTS branch "${new_branch}" has been created in the following repositoris
-          ${repos}
+          The new LTS branch "${{new_branch}}" has been created in the following repositoris
+          ${{repos}}
 
-          And the new download space is ready on ${DOWNLOAD_SERVER_URL}/tf-a-${new_branch}
+          And the new download space is ready on ${{DOWNLOAD_SERVER_URL}}/tf-a-${{new_branch}}
 
           Please check the job log for the details
-          ${BUILD_URL}console
+          ${{BUILD_URL}}console
 
           EOF
 
           echo "--------- email body ----------"
           cat email.txt
-          [ "${SANDBOX_RUN}" = "true" ] && rm -f email.txt
+          [ "${{SANDBOX_RUN}}" = "true" ] && rm -f email.txt
 
       - conditional-step:
           condition-kind: shell
@@ -127,19 +127,19 @@
             set -eux
 
             COUNTERPART_PROJ="hafnium/hafnium"
-            GERRIT_HOST=${GERRIT_HOST:-review.trustedfirmware.org}
-            GERRIT_SERVER="https://${GERRIT_HOST}"
-            REF="${GERRIT_REFNAME:-}"
-            echo ${REF} | grep -q "^sandbox/" && echo "*** Sandbox run ***"
-            BRANCH="${REF#refs/heads/}"
+            GERRIT_HOST=${{GERRIT_HOST:-review.trustedfirmware.org}}
+            GERRIT_SERVER="https://${{GERRIT_HOST}}"
+            REF="${{GERRIT_REFNAME:-}}"
+            echo ${{REF}} | grep -q "^sandbox/" && echo "*** Sandbox run ***"
+            BRANCH="${{REF#refs/heads/}}"
 
             # Must be a Gerrit ref-updated new-branch event
-            [ "${GERRIT_EVENT_TYPE:-}" = "ref-updated" -a \
-              "${GERRIT_OLDREV:-}" = "0000000000000000000000000000000000000000" ] || exit 1
+            [ "${{GERRIT_EVENT_TYPE:-}}" = "ref-updated" -a \
+              "${{GERRIT_OLDREV:-}}" = "0000000000000000000000000000000000000000" ] || exit 1
 
             # Check if branch exists already in TF-A
-            if git ls-remote --exit-code "${GERRIT_SERVER}/${COUNTERPART_PROJ}" "refs/heads/${BRANCH}"; then
-              echo "Branch exists in ${COUNTERPART_PROJ}, do not trigger counterpart"
+            if git ls-remote --exit-code "${{GERRIT_SERVER}}/${{COUNTERPART_PROJ}}" "refs/heads/${{BRANCH}}"; then
+              echo "Branch exists in ${{COUNTERPART_PROJ}}, do not trigger counterpart"
               exit 1
             fi
             echo "Branch missing, trigger hafnium-lts-automation"
@@ -148,7 +148,7 @@
             - trigger-builds:
                 - project: "hafnium-lts-automation"
                   block: false
-                  predefined-parameters: "UPSTREAM_REFNAME=${GERRIT_REFNAME}"
+                  predefined-parameters: "UPSTREAM_REFNAME=${{GERRIT_REFNAME}}"
 
     publishers:
       - conditional-publisher:
@@ -159,6 +159,6 @@
             action:
               - email-ext:
                   always: true
-                  recipients: ${EMAIL_RECIPIENT}
-                  subject: ${FILE,path="subject.txt"}
-                  body: ${FILE,path="email.txt"}
+                  recipients: ${{EMAIL_RECIPIENT}}
+                  subject: ${{FILE,path="subject.txt"}}
+                  body: ${{FILE,path="email.txt"}}
diff --git a/tf-a-lts-create-release.yaml b/tf-a-lts-create-release.yaml
index b5ecdb3..39f7a47 100644
--- a/tf-a-lts-create-release.yaml
+++ b/tf-a-lts-create-release.yaml
@@ -76,11 +76,11 @@
           RELEASE=$(grep release docs/conf.py | sed -r -e 's/release = "(.*)"/\1/')
 
           git diff
-          git commit -a -s -m "docs(changelog): changelog for lts-v${RELEASE} release"
+          git commit -a -s -m "docs(changelog): changelog for lts-v${{RELEASE}} release"
           if [ "$SANDBOX_RUN" == "true" ]; then
-              TAG="sandbox/lts-v${RELEASE}-$(date +%Y%m%dT%H%M)"
+              TAG="sandbox/lts-v${{RELEASE}}-$(date +%Y%m%dT%H%M)"
           else
-              TAG="lts-v${RELEASE}"
+              TAG="lts-v${{RELEASE}}"
           fi
           git tag $TAG
 
@@ -99,9 +99,9 @@
               # model Gerrit uses: it resolve tag to a branch it belongs to, then
               # checks ACLs on branch to see if a user has access to it; no branch
               # == problems).
-              git push ssh://${CI_BOT_USERNAME}@${GERRIT_HOST}:29418/${GERRIT_PROJECT} HEAD:refs/heads/${TAG}-br
+              git push ssh://${{CI_BOT_USERNAME}}@${{GERRIT_HOST}}:29418/${{GERRIT_PROJECT}} HEAD:refs/heads/${{TAG}}-br
           fi
           # Push tag
           git push ssh://$CI_BOT_USERNAME@$GERRIT_HOST:29418/$GERRIT_PROJECT $TAG
 
-          echo Release tag is created. Further processing happens in the job ${JENKINS_PUBLIC_URL}job/tf-a-lts-release-tagged
+          echo Release tag is created. Further processing happens in the job ${{JENKINS_PUBLIC_URL}}job/tf-a-lts-release-tagged
diff --git a/tf-a-lts-patch-stack-watcher.yaml b/tf-a-lts-patch-stack-watcher.yaml
index 9fa9301..7ac2484 100644
--- a/tf-a-lts-patch-stack-watcher.yaml
+++ b/tf-a-lts-patch-stack-watcher.yaml
@@ -22,7 +22,7 @@
             To trigger Allow-CI+1 or Allow-CI+2 job when a new patch is created
           default: Allow-CI=2
     builders:
-      - shell: !include-raw: scripts/tf-a-lts-patch-stack-watcher.sh
+      - shell: !include-raw-verbatim: scripts/tf-a-lts-patch-stack-watcher.sh
     properties:
       - build-discarder:
           days-to-keep: 60
diff --git a/tf-a-lts-release-docs.yaml b/tf-a-lts-release-docs.yaml
index 4b17a72..11b75de 100644
--- a/tf-a-lts-release-docs.yaml
+++ b/tf-a-lts-release-docs.yaml
@@ -63,4 +63,4 @@
               credential-id: PFALCON_RTD_WEBHOOK_SECRET
               variable: PFALCON_RTD_WEBHOOK_SECRET
     builders:
-      - shell: !include-raw: scripts/tf-a-lts-docs-watcher.sh
+      - shell: !include-raw-verbatim: scripts/tf-a-lts-docs-watcher.sh
diff --git a/tf-a-lts-release-mail.yaml b/tf-a-lts-release-mail.yaml
index 9ec5c0c..fd7b2d7 100644
--- a/tf-a-lts-release-mail.yaml
+++ b/tf-a-lts-release-mail.yaml
@@ -59,8 +59,8 @@
           set -ex
 
           git clone https://git.trustedfirmware.org/ci/tf-a-ci-scripts.git
-          ./tf-a-ci-scripts/lts/lts-release-mail.py --url https://${GERRIT_HOST}/${GERRIT_PROJECT} --branch "${GERRIT_BRANCH}" ${RELEASE_TAG} >email.txt
-          awk -F": " '/Subject:/ {print $2}' email.txt >subject.txt
+          ./tf-a-ci-scripts/lts/lts-release-mail.py --url https://${{GERRIT_HOST}}/${{GERRIT_PROJECT}} --branch "${{GERRIT_BRANCH}}" ${{RELEASE_TAG}} >email.txt
+          awk -F": " '/Subject:/ {{print $2}}' email.txt >subject.txt
           # Remove email headers, put in a seperate file.
           sed '0,/^$/d' email.txt >body.txt
 
@@ -89,6 +89,6 @@
             action:
               - email-ext:
                   always: true
-                  subject: ${FILE, path="subject.txt"}
-                  body: ${FILE, path="body.txt"}
-                  recipients: ${FILE, path="recipients.txt"}
+                  subject: ${{FILE, path="subject.txt"}}
+                  body: ${{FILE, path="body.txt"}}
+                  recipients: ${{FILE, path="recipients.txt"}}
diff --git a/tf-a-lts-release-tagged.yaml b/tf-a-lts-release-tagged.yaml
index a73c444..f012f69 100644
--- a/tf-a-lts-release-tagged.yaml
+++ b/tf-a-lts-release-tagged.yaml
@@ -40,8 +40,8 @@
               echo Not a tag event
               exit
           fi
-          echo "RELEASE_TAG=${GERRIT_REFNAME#refs/tags/}" >subjob.param
-          if echo ${GERRIT_REFNAME} | grep -q "sandbox/"; then
+          echo "RELEASE_TAG=${{GERRIT_REFNAME#refs/tags/}}" >subjob.param
+          if echo ${{GERRIT_REFNAME}} | grep -q "sandbox/"; then
               echo "SANDBOX_RUN=true" >>subjob.param
           else
               echo "SANDBOX_RUN=false" >>subjob.param
diff --git a/tf-a-lts-triage-v2.yaml b/tf-a-lts-triage-v2.yaml
index a2f05e7..b168c17 100644
--- a/tf-a-lts-triage-v2.yaml
+++ b/tf-a-lts-triage-v2.yaml
@@ -49,25 +49,25 @@
           LTS_TMP_DIR=$(mktemp -d -p ./)
           cd $LTS_TMP_DIR
 
-          git clone ${TFA_CI_SCRIPT_REPO}
+          git clone ${{TFA_CI_SCRIPT_REPO}}
 
           TFA_TMP_DIR=$(mktemp -d -p ./)
-          cd ${TFA_TMP_DIR}
-          git clone ${TFA_REPO} -b integration ./
+          cd ${{TFA_TMP_DIR}}
+          git clone ${{TFA_REPO}} -b integration ./
           LTS_REPO_PATH=$(pwd)
           cd -
-          for b in ${LTS_BRANCHES};
+          for b in ${{LTS_BRANCHES}};
           do
-              CSV_REPORT="${b}_${DATE}.csv"
-              git -C ${LTS_REPO_PATH} checkout -b ${b} origin/${b}
+              CSV_REPORT="${{b}}_${{DATE}}.csv"
+              git -C ${{LTS_REPO_PATH}} checkout -b ${{b}} origin/${{b}}
 
-              python3 tf-a-ci-scripts/lts/lts-triage-v2.py --repo ${LTS_REPO_PATH} --csv_path ${START_PATH}/${CSV_REPORT} \
-              --lts ${b} --gerrit_user ${CI_BOT_USERNAME} --ssh_keyfile ${CI_BOT_KEY} --debug
-              [ -f "${START_PATH}/${CSV_REPORT}" ] && echo "${CSV_REPORT}" >> ${START_PATH}/got_report.txt
+              python3 tf-a-ci-scripts/lts/lts-triage-v2.py --repo ${{LTS_REPO_PATH}} --csv_path ${{START_PATH}}/${{CSV_REPORT}} \
+              --lts ${{b}} --gerrit_user ${{CI_BOT_USERNAME}} --ssh_keyfile ${{CI_BOT_KEY}} --debug
+              [ -f "${{START_PATH}}/${{CSV_REPORT}}" ] && echo "${{CSV_REPORT}}" >> ${{START_PATH}}/got_report.txt
           done
 
-          cd ${START_PATH}
-          rm -rf ${LTS_TMP_DIR}
+          cd ${{START_PATH}}
+          rm -rf ${{LTS_TMP_DIR}}
     publishers:
       - conditional-publisher:
           - condition-kind: file-exists
diff --git a/tf-a-lts-verified-propagater.yaml b/tf-a-lts-verified-propagater.yaml
index 010a726..aab493a 100644
--- a/tf-a-lts-verified-propagater.yaml
+++ b/tf-a-lts-verified-propagater.yaml
@@ -23,44 +23,44 @@
           env |grep '^GERRIT'
           echo "########################################################################"
 
-          SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 29418 -i ${CI_BOT_KEY}"
+          SSH_PARAMS="-o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 29418 -i ${{CI_BOT_KEY}}"
           GERRIT_URL="review.trustedfirmware.org"
           GERRIT_QUERY_PARAMS="--dependencies --submit-records --format=JSON change:"
-          QUERY_CMD="${SSH_PARAMS} ${CI_BOT_USERNAME}@${GERRIT_URL} gerrit query ${GERRIT_QUERY_PARAMS}"
-          QUERY_CHANGE_DEPENDS_CMD="${QUERY_CMD}${GERRIT_CHANGE_NUMBER}"
-          REVIEW_MESSAGE="Propagated verified from ${GERRIT_CHANGE_URL}. By ${BUILD_URL}"
-          SET_VERIFIED_CMD="${SSH_PARAMS} ${CI_BOT_USERNAME}@${GERRIT_URL} gerrit review --verified"
+          QUERY_CMD="${{SSH_PARAMS}} ${{CI_BOT_USERNAME}}@${{GERRIT_URL}} gerrit query ${{GERRIT_QUERY_PARAMS}}"
+          QUERY_CHANGE_DEPENDS_CMD="${{QUERY_CMD}}${{GERRIT_CHANGE_NUMBER}}"
+          REVIEW_MESSAGE="Propagated verified from ${{GERRIT_CHANGE_URL}}. By ${{BUILD_URL}}"
+          SET_VERIFIED_CMD="${{SSH_PARAMS}} ${{CI_BOT_USERNAME}}@${{GERRIT_URL}} gerrit review --verified"
 
-          change_url_base=${GERRIT_CHANGE_URL%/*}
+          change_url_base=${{GERRIT_CHANGE_URL%/*}}
           # Check this example https://ci.trustedfirmware.org/view/TF-A/job/tf-a-lts-verified-propagater/14/console
           # for what we get from gerrit query command
-          patch_query=$(ssh ${QUERY_CHANGE_DEPENDS_CMD} | jq .)
-          dependsOn=$(echo ${patch_query} | jq -r 'select(.dependsOn)')
+          patch_query=$(ssh ${{QUERY_CHANGE_DEPENDS_CMD}} | jq .)
+          dependsOn=$(echo ${{patch_query}} | jq -r 'select(.dependsOn)')
           # Normally, there would be just one dependent patch
           # (and that patch would in turn has another dependent patch, that's how a dependency chain is structured)
           # But Gerrit data model has a list of dependent patches, so we process all just in case
-          dependsOn_rev=($(echo ${dependsOn} | jq -r '.dependsOn[].revision'))
-          dependsOn_no=($(echo ${dependsOn} | jq -r '.dependsOn[].number'))
-          verified_status=$(echo ${patch_query} | jq -r 'select(.submitRecords) | .submitRecords[0].labels[] | select(.label == "Verified") | .status')
+          dependsOn_rev=($(echo ${{dependsOn}} | jq -r '.dependsOn[].revision'))
+          dependsOn_no=($(echo ${{dependsOn}} | jq -r '.dependsOn[].number'))
+          verified_status=$(echo ${{patch_query}} | jq -r 'select(.submitRecords) | .submitRecords[0].labels[] | select(.label == "Verified") | .status')
           # Verified label status and value mapping
           # REJECT: -1
           # OK: 1
           verified_value=0
-          if [ "${verified_status}" == "REJECT" ]; then
+          if [ "${{verified_status}}" == "REJECT" ]; then
               verified_value=-1
-          elif [ "${verified_status}" == "OK" ]; then
+          elif [ "${{verified_status}}" == "OK" ]; then
               verified_value=1
           fi
           # Vote the same Verified score to the dependent patch by loop
-          for ((i=0; i<${#dependsOn_rev[@]}; i++))
+          for ((i=0; i<${{#dependsOn_rev[@]}}; i++))
           do
               # Need to check the .status before set verified score
-              if [ $(ssh ${QUERY_CMD}${dependsOn_no[$i]} | jq -r 'select(.status)|.status') == "MERGED" ]; then
-              	echo "The dependent patch ${change_url_base}${dependsOn_no[$i]} has been merged. Don't set Verified score to it!"
+              if [ $(ssh ${{QUERY_CMD}}${{dependsOn_no[$i]}} | jq -r 'select(.status)|.status') == "MERGED" ]; then
+              	echo "The dependent patch ${{change_url_base}}${{dependsOn_no[$i]}} has been merged. Don't set Verified score to it!"
                   continue
               else
-              	echo "Set Verified ${verified_value} to: ${change_url_base}/${dependsOn_no[$i]}"
-              	ssh ${SET_VERIFIED_CMD} ${verified_value}  -m \'\"${REVIEW_MESSAGE}\"\' ${dependsOn_rev[$i]}
+              	echo "Set Verified ${{verified_value}} to: ${{change_url_base}}/${{dependsOn_no[$i]}}"
+              	ssh ${{SET_VERIFIED_CMD}} ${{verified_value}}  -m \'\"${{REVIEW_MESSAGE}}\"\' ${{dependsOn_rev[$i]}}
               fi
           done
     properties:
diff --git a/tf-a-lts2.10-builder.yaml b/tf-a-lts2.10-builder.yaml
index 1e5fa7f..f45522a 100644
--- a/tf-a-lts2.10-builder.yaml
+++ b/tf-a-lts2.10-builder.yaml
@@ -54,7 +54,7 @@
             tf-a-job-configs refspec to use. The master branch is used by default.
       - string:
           name: DOCKER_REGISTRY
-          default: ${PRIVATE_CONTAINER_REGISTRY}
+          default: ${{PRIVATE_CONTAINER_REGISTRY}}
           description: PRIVATE_CONTAINER_REGISTRY is a system-wide environment variable
       - string:
           name: JUNO_ROOTFS_URL
@@ -111,13 +111,13 @@
     builders:
       - shell: |
           aarch64-none-elf-gcc -v || true
-      - shell: !include-raw: scripts/clone.sh
-      - shell: !include-raw: tf-a-builder/lts-builders.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
+      - shell: !include-raw-verbatim: tf-a-builder/lts-builders.sh
       - inject:
           properties-file: artefacts/env
       - shell: |
-          ln -s "artefacts/${BIN_MODE:-release}" "artefacts-lava"
-          echo ${BIN_MODE:-release} >lava-binmode.txt
+          ln -s "artefacts/${{BIN_MODE:-release}}" "artefacts-lava"
+          echo ${{BIN_MODE:-release}} >lava-binmode.txt
       - conditional-step:
           condition-kind: file-exists
           on-evaluation-failure: dont-run
@@ -128,10 +128,10 @@
                 #!/bin/bash
                 set -e
                 DEVICE_TYPE=fvp
-                CUSTOM_YAML_URL=${BUILD_URL}/artifact/artefacts-lava/job.yaml
-                DEVICE_TYPE=$(awk -F': ' '/device_type/ {print $2}' ${WORKSPACE}/artefacts-lava/job.yaml)
-                cat << EOF > ${WORKSPACE}/lava.param
-                DEVICE_TYPE=${DEVICE_TYPE}
+                CUSTOM_YAML_URL=${{BUILD_URL}}/artifact/artefacts-lava/job.yaml
+                DEVICE_TYPE=$(awk -F': ' '/device_type/ {{print $2}}' ${{WORKSPACE}}/artefacts-lava/job.yaml)
+                cat << EOF > ${{WORKSPACE}}/lava.param
+                DEVICE_TYPE=${{DEVICE_TYPE}}
                 LAVA_SERVER=tf.validation.linaro.org
                 EOF
     publishers:
@@ -153,7 +153,7 @@
                         - SUCCESS
                       build-steps:
                         - inject:
-                            properties-file: ${WORKSPACE}/lava.param
+                            properties-file: ${{WORKSPACE}}/lava.param
                         - shell: |
                             #!/bin/bash -x
 
@@ -191,5 +191,5 @@
           latest-only: false
           allow-empty: true
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-builder/postbuild.groovy
diff --git a/tf-a-lts2.10-ci-gateway.yaml b/tf-a-lts2.10-ci-gateway.yaml
index 2780ce0..6816b38 100644
--- a/tf-a-lts2.10-ci-gateway.yaml
+++ b/tf-a-lts2.10-ci-gateway.yaml
@@ -84,11 +84,11 @@
           description: |
             Whether to submit FVP tests via TuxSuite (instead of LAVA)
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -114,10 +114,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-lts2.10-gerrit-tforg-l1.yaml b/tf-a-lts2.10-gerrit-tforg-l1.yaml
index 0ed14db..c250401 100644
--- a/tf-a-lts2.10-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.10-gerrit-tforg-l1.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -68,17 +68,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Lint commit messages
@@ -87,10 +87,10 @@
             - name: tf-a-commitlint
               kill-phase-on: NEVER
               predefined-parameters: |
-                URL=https://review.trustedfirmware.org/${GERRIT_PROJECT}
-                REFSPEC=${GERRIT_REFSPEC}
-                REFNAME=${GERRIT_PATCHSET_REVISION}
-                REFNAME_BASE=origin/${GERRIT_BRANCH}
+                URL=https://review.trustedfirmware.org/${{GERRIT_PROJECT}}
+                REFSPEC=${{GERRIT_REFSPEC}}
+                REFNAME=${{GERRIT_PATCHSET_REVISION}}
+                REFNAME_BASE=origin/${{GERRIT_BRANCH}}
       - multijob:
           condition: COMPLETED
           name: Build and static checks
diff --git a/tf-a-lts2.10-gerrit-tforg-l2.yaml b/tf-a-lts2.10-gerrit-tforg-l2.yaml
index 5abfcca..0291e51 100644
--- a/tf-a-lts2.10-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.10-gerrit-tforg-l2.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -73,17 +73,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.10-main.yaml b/tf-a-lts2.10-main.yaml
index 2bd1b5a..b4463f4 100644
--- a/tf-a-lts2.10-main.yaml
+++ b/tf-a-lts2.10-main.yaml
@@ -85,21 +85,21 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
-      - shell: !include-raw: scripts/lts-check-last-commit.sh
+      - shell: !include-raw-verbatim: scripts/lts-check-last-commit.sh
       - conditional-step:
           condition-kind: file-exists
           condition-filename: TO_BUILD
@@ -333,7 +333,7 @@
                   - name: tf-a-test-result-visualization
                     current-parameters: true
                     kill-phase-on: NEVER
-                    predefined-parameters: TARGET_BUILD=${JOB_NAME}/${BUILD_NUMBER}
+                    predefined-parameters: TARGET_BUILD=${{JOB_NAME}}/${{BUILD_NUMBER}}
                     property-file: tf-a-env.param
             # Run the unstable TF-A Tests at the end but do not let their results
             # participate in the job's success/failure.
@@ -352,7 +352,7 @@
       - conditional-publisher:
           - condition-kind: shell
             condition-command: |
-              ! test -f ${WORKSPACE}/TO_BUILD
+              ! test -f ${{WORKSPACE}}/TO_BUILD
             action:
               - groovy-postbuild:
                   script: |
diff --git a/tf-a-lts2.10-tftf-gerrit-tforg-l1.yaml b/tf-a-lts2.10-tftf-gerrit-tforg-l1.yaml
index 0d1debf..c957d7c 100644
--- a/tf-a-lts2.10-tftf-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.10-tftf-gerrit-tforg-l1.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -67,17 +67,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.10-tftf-gerrit-tforg-l2.yaml b/tf-a-lts2.10-tftf-gerrit-tforg-l2.yaml
index bdcf932..dacf394 100644
--- a/tf-a-lts2.10-tftf-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.10-tftf-gerrit-tforg-l2.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -67,17 +67,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.12-builder.yaml b/tf-a-lts2.12-builder.yaml
index f5da3f7..dd89f8e 100644
--- a/tf-a-lts2.12-builder.yaml
+++ b/tf-a-lts2.12-builder.yaml
@@ -54,7 +54,7 @@
             tf-a-job-configs refspec to use. The master branch is used by default.
       - string:
           name: DOCKER_REGISTRY
-          default: ${PRIVATE_CONTAINER_REGISTRY}
+          default: ${{PRIVATE_CONTAINER_REGISTRY}}
           description: PRIVATE_CONTAINER_REGISTRY is a system-wide environment variable
       - string:
           name: JUNO_ROOTFS_URL
@@ -111,13 +111,13 @@
     builders:
       - shell: |
           aarch64-none-elf-gcc -v || true
-      - shell: !include-raw: scripts/clone.sh
-      - shell: !include-raw: tf-a-builder/lts-builders.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
+      - shell: !include-raw-verbatim: tf-a-builder/lts-builders.sh
       - inject:
           properties-file: artefacts/env
       - shell: |
-          ln -s "artefacts/${BIN_MODE:-release}" "artefacts-lava"
-          echo ${BIN_MODE:-release} >lava-binmode.txt
+          ln -s "artefacts/${{BIN_MODE:-release}}" "artefacts-lava"
+          echo ${{BIN_MODE:-release}} >lava-binmode.txt
       - conditional-step:
           condition-kind: file-exists
           on-evaluation-failure: dont-run
@@ -128,10 +128,10 @@
                 #!/bin/bash
                 set -e
                 DEVICE_TYPE=fvp
-                CUSTOM_YAML_URL=${BUILD_URL}/artifact/artefacts-lava/job.yaml
-                DEVICE_TYPE=$(awk -F': ' '/device_type/ {print $2}' ${WORKSPACE}/artefacts-lava/job.yaml)
-                cat << EOF > ${WORKSPACE}/lava.param
-                DEVICE_TYPE=${DEVICE_TYPE}
+                CUSTOM_YAML_URL=${{BUILD_URL}}/artifact/artefacts-lava/job.yaml
+                DEVICE_TYPE=$(awk -F': ' '/device_type/ {{print $2}}' ${{WORKSPACE}}/artefacts-lava/job.yaml)
+                cat << EOF > ${{WORKSPACE}}/lava.param
+                DEVICE_TYPE=${{DEVICE_TYPE}}
                 LAVA_SERVER=tf.validation.linaro.org
                 EOF
     publishers:
@@ -153,7 +153,7 @@
                         - SUCCESS
                       build-steps:
                         - inject:
-                            properties-file: ${WORKSPACE}/lava.param
+                            properties-file: ${{WORKSPACE}}/lava.param
                         - shell: |
                             #!/bin/bash -x
 
@@ -191,5 +191,5 @@
           latest-only: false
           allow-empty: true
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-builder/postbuild.groovy
diff --git a/tf-a-lts2.12-ci-gateway.yaml b/tf-a-lts2.12-ci-gateway.yaml
index a8bc2ba..653f52c 100644
--- a/tf-a-lts2.12-ci-gateway.yaml
+++ b/tf-a-lts2.12-ci-gateway.yaml
@@ -84,11 +84,11 @@
           description: |
             Whether to submit FVP tests via TuxSuite (instead of LAVA)
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -114,10 +114,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-lts2.12-gerrit-tforg-l1.yaml b/tf-a-lts2.12-gerrit-tforg-l1.yaml
index 127fa68..52cc3dc 100644
--- a/tf-a-lts2.12-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.12-gerrit-tforg-l1.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -68,17 +68,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Lint commit messages
@@ -87,10 +87,10 @@
             - name: tf-a-commitlint
               kill-phase-on: NEVER
               predefined-parameters: |
-                URL=https://review.trustedfirmware.org/${GERRIT_PROJECT}
-                REFSPEC=${GERRIT_REFSPEC}
-                REFNAME=${GERRIT_PATCHSET_REVISION}
-                REFNAME_BASE=origin/${GERRIT_BRANCH}
+                URL=https://review.trustedfirmware.org/${{GERRIT_PROJECT}}
+                REFSPEC=${{GERRIT_REFSPEC}}
+                REFNAME=${{GERRIT_PATCHSET_REVISION}}
+                REFNAME_BASE=origin/${{GERRIT_BRANCH}}
       - multijob:
           condition: COMPLETED
           name: Build and static checks
diff --git a/tf-a-lts2.12-gerrit-tforg-l2.yaml b/tf-a-lts2.12-gerrit-tforg-l2.yaml
index c9d3276..170f7b9 100644
--- a/tf-a-lts2.12-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.12-gerrit-tforg-l2.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -73,17 +73,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.12-main.yaml b/tf-a-lts2.12-main.yaml
index e0e69c1..c07cf13 100644
--- a/tf-a-lts2.12-main.yaml
+++ b/tf-a-lts2.12-main.yaml
@@ -85,21 +85,21 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
-      - shell: !include-raw: scripts/lts-check-last-commit.sh
+      - shell: !include-raw-verbatim: scripts/lts-check-last-commit.sh
       - conditional-step:
           condition-kind: file-exists
           condition-filename: TO_BUILD
@@ -333,7 +333,7 @@
                   - name: tf-a-test-result-visualization
                     current-parameters: true
                     kill-phase-on: NEVER
-                    predefined-parameters: TARGET_BUILD=${JOB_NAME}/${BUILD_NUMBER}
+                    predefined-parameters: TARGET_BUILD=${{JOB_NAME}}/${{BUILD_NUMBER}}
                     property-file: tf-a-env.param
             # Run the unstable TF-A Tests at the end but do not let their results
             # participate in the job's success/failure.
@@ -352,7 +352,7 @@
       - conditional-publisher:
           - condition-kind: shell
             condition-command: |
-              ! test -f ${WORKSPACE}/TO_BUILD
+              ! test -f ${{WORKSPACE}}/TO_BUILD
             action:
               - groovy-postbuild:
                   script: |
diff --git a/tf-a-lts2.12-tftf-gerrit-tforg-l1.yaml b/tf-a-lts2.12-tftf-gerrit-tforg-l1.yaml
index d3ef343..30f8d9c 100644
--- a/tf-a-lts2.12-tftf-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.12-tftf-gerrit-tforg-l1.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -67,17 +67,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.12-tftf-gerrit-tforg-l2.yaml b/tf-a-lts2.12-tftf-gerrit-tforg-l2.yaml
index 2e4d6c8..037c39c 100644
--- a/tf-a-lts2.12-tftf-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.12-tftf-gerrit-tforg-l2.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -67,17 +67,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.14-builder.yaml b/tf-a-lts2.14-builder.yaml
index 059d0e4..e802858 100644
--- a/tf-a-lts2.14-builder.yaml
+++ b/tf-a-lts2.14-builder.yaml
@@ -60,7 +60,7 @@
             tf-a-job-configs refspec to use. The master branch is used by default.
       - string:
           name: DOCKER_REGISTRY
-          default: ${PRIVATE_CONTAINER_REGISTRY}
+          default: ${{PRIVATE_CONTAINER_REGISTRY}}
           description: PRIVATE_CONTAINER_REGISTRY is a system-wide environment variable
       - string:
           name: JUNO_ROOTFS_URL
@@ -117,13 +117,13 @@
     builders:
       - shell: |
           aarch64-none-elf-gcc -v || true
-      - shell: !include-raw: scripts/clone.sh
-      - shell: !include-raw: tf-a-builder/builders.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
+      - shell: !include-raw-verbatim: tf-a-builder/builders.sh
       - inject:
           properties-file: artefacts/env
       - shell: |
-          ln -s "artefacts/${BIN_MODE:-release}" "artefacts-lava"
-          echo ${BIN_MODE:-release} >lava-binmode.txt
+          ln -s "artefacts/${{BIN_MODE:-release}}" "artefacts-lava"
+          echo ${{BIN_MODE:-release}} >lava-binmode.txt
       - conditional-step:
           condition-kind: file-exists
           on-evaluation-failure: dont-run
@@ -134,10 +134,10 @@
                 #!/bin/bash
                 set -e
                 DEVICE_TYPE=fvp
-                CUSTOM_YAML_URL=${BUILD_URL}/artifact/artefacts-lava/job.yaml
-                DEVICE_TYPE=$(awk -F': ' '/device_type/ {print $2}' ${WORKSPACE}/artefacts-lava/job.yaml)
-                cat << EOF > ${WORKSPACE}/lava.param
-                DEVICE_TYPE=${DEVICE_TYPE}
+                CUSTOM_YAML_URL=${{BUILD_URL}}/artifact/artefacts-lava/job.yaml
+                DEVICE_TYPE=$(awk -F': ' '/device_type/ {{print $2}}' ${{WORKSPACE}}/artefacts-lava/job.yaml)
+                cat << EOF > ${{WORKSPACE}}/lava.param
+                DEVICE_TYPE=${{DEVICE_TYPE}}
                 LAVA_SERVER=tf.validation.linaro.org
                 EOF
     publishers:
@@ -160,7 +160,7 @@
                         - SUCCESS
                       build-steps:
                         - inject:
-                            properties-file: ${WORKSPACE}/lava.param
+                            properties-file: ${{WORKSPACE}}/lava.param
                         - shell: |
                             #!/bin/bash -x
 
@@ -226,5 +226,5 @@
           latest-only: false
           allow-empty: true
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-builder/postbuild.groovy
diff --git a/tf-a-lts2.14-ci-gateway.yaml b/tf-a-lts2.14-ci-gateway.yaml
index b9c64fc..7feb51d 100644
--- a/tf-a-lts2.14-ci-gateway.yaml
+++ b/tf-a-lts2.14-ci-gateway.yaml
@@ -94,11 +94,11 @@
           description: |
             Whether to submit FVP tests via TuxSuite (instead of LAVA)
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -124,10 +124,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-lts2.14-gerrit-tforg-l1.yaml b/tf-a-lts2.14-gerrit-tforg-l1.yaml
index 0d6d6f7..229cb14 100644
--- a/tf-a-lts2.14-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.14-gerrit-tforg-l1.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -73,17 +73,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Lint commit messages
@@ -92,10 +92,10 @@
             - name: tf-a-commitlint
               kill-phase-on: NEVER
               predefined-parameters: |
-                URL=https://review.trustedfirmware.org/${GERRIT_PROJECT}
-                REFSPEC=${GERRIT_REFSPEC}
-                REFNAME=${GERRIT_PATCHSET_REVISION}
-                REFNAME_BASE=origin/${GERRIT_BRANCH}
+                URL=https://review.trustedfirmware.org/${{GERRIT_PROJECT}}
+                REFSPEC=${{GERRIT_REFSPEC}}
+                REFNAME=${{GERRIT_PATCHSET_REVISION}}
+                REFNAME_BASE=origin/${{GERRIT_BRANCH}}
       - multijob:
           condition: COMPLETED
           name: Build and static checks
diff --git a/tf-a-lts2.14-gerrit-tforg-l2.yaml b/tf-a-lts2.14-gerrit-tforg-l2.yaml
index ec614fa..b215b81 100644
--- a/tf-a-lts2.14-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.14-gerrit-tforg-l2.yaml
@@ -32,7 +32,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -78,17 +78,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.14-main.yaml b/tf-a-lts2.14-main.yaml
index ead668b..ef8d370 100644
--- a/tf-a-lts2.14-main.yaml
+++ b/tf-a-lts2.14-main.yaml
@@ -80,21 +80,21 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
-      - shell: !include-raw: scripts/lts-check-last-commit.sh
+      - shell: !include-raw-verbatim: scripts/lts-check-last-commit.sh
       - conditional-step:
           condition-kind: file-exists
           condition-filename: TO_BUILD
@@ -344,7 +344,7 @@
                   - name: tf-a-test-result-visualization
                     current-parameters: true
                     kill-phase-on: NEVER
-                    predefined-parameters: TARGET_BUILD=${JOB_NAME}/${BUILD_NUMBER}
+                    predefined-parameters: TARGET_BUILD=${{JOB_NAME}}/${{BUILD_NUMBER}}
                     property-file: tf-a-env.param
             # Run the unstable TF-A Tests at the end but do not let their results
             # participate in the job's success/failure.
@@ -363,7 +363,7 @@
       - conditional-publisher:
           - condition-kind: shell
             condition-command: |
-              ! test -f ${WORKSPACE}/TO_BUILD
+              ! test -f ${{WORKSPACE}}/TO_BUILD
             action:
               - groovy-postbuild:
                   script: |
diff --git a/tf-a-lts2.14-tftf-gerrit-tforg-l1.yaml b/tf-a-lts2.14-tftf-gerrit-tforg-l1.yaml
index 86230a9..18499b8 100644
--- a/tf-a-lts2.14-tftf-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.14-tftf-gerrit-tforg-l1.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -72,17 +72,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.14-tftf-gerrit-tforg-l2.yaml b/tf-a-lts2.14-tftf-gerrit-tforg-l2.yaml
index 847cb55..78e19f7 100644
--- a/tf-a-lts2.14-tftf-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.14-tftf-gerrit-tforg-l2.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -72,17 +72,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.8-builder.yaml b/tf-a-lts2.8-builder.yaml
index 3dfd703..0496e41 100644
--- a/tf-a-lts2.8-builder.yaml
+++ b/tf-a-lts2.8-builder.yaml
@@ -54,7 +54,7 @@
             tf-a-job-configs refspec to use. The master branch is used by default.
       - string:
           name: DOCKER_REGISTRY
-          default: ${PRIVATE_CONTAINER_REGISTRY}
+          default: ${{PRIVATE_CONTAINER_REGISTRY}}
           description: PRIVATE_CONTAINER_REGISTRY is a system-wide environment variable
       - string:
           name: JUNO_ROOTFS_URL
@@ -111,13 +111,13 @@
     builders:
       - shell: |
           aarch64-none-elf-gcc -v || true
-      - shell: !include-raw: scripts/clone.sh
-      - shell: !include-raw: tf-a-builder/lts-builders.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
+      - shell: !include-raw-verbatim: tf-a-builder/lts-builders.sh
       - inject:
           properties-file: artefacts/env
       - shell: |
-          ln -s "artefacts/${BIN_MODE:-release}" "artefacts-lava"
-          echo ${BIN_MODE:-release} >lava-binmode.txt
+          ln -s "artefacts/${{BIN_MODE:-release}}" "artefacts-lava"
+          echo ${{BIN_MODE:-release}} >lava-binmode.txt
       - conditional-step:
           condition-kind: file-exists
           on-evaluation-failure: dont-run
@@ -128,10 +128,10 @@
                 #!/bin/bash
                 set -e
                 DEVICE_TYPE=fvp
-                CUSTOM_YAML_URL=${BUILD_URL}/artifact/artefacts-lava/job.yaml
-                DEVICE_TYPE=$(awk -F': ' '/device_type/ {print $2}' ${WORKSPACE}/artefacts-lava/job.yaml)
-                cat << EOF > ${WORKSPACE}/lava.param
-                DEVICE_TYPE=${DEVICE_TYPE}
+                CUSTOM_YAML_URL=${{BUILD_URL}}/artifact/artefacts-lava/job.yaml
+                DEVICE_TYPE=$(awk -F': ' '/device_type/ {{print $2}}' ${{WORKSPACE}}/artefacts-lava/job.yaml)
+                cat << EOF > ${{WORKSPACE}}/lava.param
+                DEVICE_TYPE=${{DEVICE_TYPE}}
                 LAVA_SERVER=tf.validation.linaro.org
                 EOF
     publishers:
@@ -153,7 +153,7 @@
                         - SUCCESS
                       build-steps:
                         - inject:
-                            properties-file: ${WORKSPACE}/lava.param
+                            properties-file: ${{WORKSPACE}}/lava.param
                         - shell: |
                             #!/bin/bash -x
 
@@ -191,5 +191,5 @@
           latest-only: false
           allow-empty: true
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-builder/postbuild.groovy
diff --git a/tf-a-lts2.8-ci-gateway.yaml b/tf-a-lts2.8-ci-gateway.yaml
index 5474838..1f52920 100644
--- a/tf-a-lts2.8-ci-gateway.yaml
+++ b/tf-a-lts2.8-ci-gateway.yaml
@@ -84,11 +84,11 @@
           description: |
             Whether to submit FVP tests via TuxSuite (instead of LAVA)
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          CI_ROOT=${PWD}/tf-a-ci-scripts
+          CI_ROOT=${{PWD}}/tf-a-ci-scripts
           export workspace=$PWD
           export test_groups=$TEST_GROUPS
           $CI_ROOT/script/gen_test_desc.py
@@ -114,10 +114,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh"
       - archive:
           artifacts: report.json, report.html, merge/outdir/**
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-lts2.8-gerrit-tforg-l1.yaml b/tf-a-lts2.8-gerrit-tforg-l1.yaml
index 498240a..1d941ab 100644
--- a/tf-a-lts2.8-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.8-gerrit-tforg-l1.yaml
@@ -33,7 +33,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -69,17 +69,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Lint commit messages
@@ -88,10 +88,10 @@
             - name: tf-a-commitlint
               kill-phase-on: NEVER
               predefined-parameters: |
-                URL=https://review.trustedfirmware.org/${GERRIT_PROJECT}
-                REFSPEC=${GERRIT_REFSPEC}
-                REFNAME=${GERRIT_PATCHSET_REVISION}
-                REFNAME_BASE=origin/${GERRIT_BRANCH}
+                URL=https://review.trustedfirmware.org/${{GERRIT_PROJECT}}
+                REFSPEC=${{GERRIT_REFSPEC}}
+                REFNAME=${{GERRIT_PATCHSET_REVISION}}
+                REFNAME_BASE=origin/${{GERRIT_BRANCH}}
       - multijob:
           condition: COMPLETED
           name: Build and static checks
diff --git a/tf-a-lts2.8-gerrit-tforg-l2.yaml b/tf-a-lts2.8-gerrit-tforg-l2.yaml
index ac85ff1..0a67e43 100644
--- a/tf-a-lts2.8-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.8-gerrit-tforg-l2.yaml
@@ -33,7 +33,7 @@
           default: ""
       - string:
           name: TF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: TFTF_GERRIT_PROJECT
@@ -74,17 +74,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.8-main.yaml b/tf-a-lts2.8-main.yaml
index 00705ac..929ce91 100644
--- a/tf-a-lts2.8-main.yaml
+++ b/tf-a-lts2.8-main.yaml
@@ -75,21 +75,21 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
-      - shell: !include-raw: scripts/lts-check-last-commit.sh
+      - shell: !include-raw-verbatim: scripts/lts-check-last-commit.sh
       - conditional-step:
           condition-kind: file-exists
           condition-filename: TO_BUILD
@@ -308,7 +308,7 @@
                   - name: tf-a-test-result-visualization
                     current-parameters: true
                     kill-phase-on: NEVER
-                    predefined-parameters: TARGET_BUILD=${JOB_NAME}/${BUILD_NUMBER}
+                    predefined-parameters: TARGET_BUILD=${{JOB_NAME}}/${{BUILD_NUMBER}}
                     property-file: tf-a-env.param
             # Run the unstable TF-A Tests at the end but do not let their results
             # participate in the job's success/failure.
@@ -327,7 +327,7 @@
       - conditional-publisher:
           - condition-kind: shell
             condition-command: |
-              ! test -f ${WORKSPACE}/TO_BUILD
+              ! test -f ${{WORKSPACE}}/TO_BUILD
             action:
               - groovy-postbuild:
                   script: |
diff --git a/tf-a-lts2.8-tftf-gerrit-tforg-l1.yaml b/tf-a-lts2.8-tftf-gerrit-tforg-l1.yaml
index c600119..d452f6b 100644
--- a/tf-a-lts2.8-tftf-gerrit-tforg-l1.yaml
+++ b/tf-a-lts2.8-tftf-gerrit-tforg-l1.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -67,17 +67,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-lts2.8-tftf-gerrit-tforg-l2.yaml b/tf-a-lts2.8-tftf-gerrit-tforg-l2.yaml
index 03f0395..4763a79 100644
--- a/tf-a-lts2.8-tftf-gerrit-tforg-l2.yaml
+++ b/tf-a-lts2.8-tftf-gerrit-tforg-l2.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -67,17 +67,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-main.yaml b/tf-a-main.yaml
index e0c79d0..40e869c 100644
--- a/tf-a-main.yaml
+++ b/tf-a-main.yaml
@@ -72,19 +72,19 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Run static checks on the code
@@ -330,7 +330,7 @@
             - name: tf-a-test-result-visualization
               current-parameters: true
               kill-phase-on: NEVER
-              predefined-parameters: TARGET_BUILD=${JOB_NAME}/${BUILD_NUMBER}
+              predefined-parameters: TARGET_BUILD=${{JOB_NAME}}/${{BUILD_NUMBER}}
               property-file: tf-a-env.param
       # Run the unstable TF-A Tests at the end but do not let their results
       # participate in the job's success/failure.
@@ -354,12 +354,12 @@
             - shell: |-
                 #!/bin/bash
                 #
-                if echo ${JENKINS_PUBLIC_URL} | grep -q "ci.trustedfirmware.org"; then
+                if echo ${{JENKINS_PUBLIC_URL}} | grep -q "ci.trustedfirmware.org"; then
                     # Only do it on the OpenCI production site
                     echo "It's running on the OpenCI procution site"
                     if [ $MULTIJOB_FAILED -eq 0 ]; then
                         echo "Proceed with integration->master fast-forward merge"
-                        bash "${WORKSPACE}/tf-a-ci-scripts/script/scratch_scripts/fast-forward-master.sh"
+                        bash "${{WORKSPACE}}/tf-a-ci-scripts/script/scratch_scripts/fast-forward-master.sh"
                     else
                         echo "Do not proceed with integration->master merge as sub-jobs failed"
                     fi
diff --git a/tf-a-sloc-visualization.yaml b/tf-a-sloc-visualization.yaml
index 2ee0e90..fcfc9be 100644
--- a/tf-a-sloc-visualization.yaml
+++ b/tf-a-sloc-visualization.yaml
@@ -29,12 +29,12 @@
           default: . ./drivers ./plat ./tools
           description: List of directories to analyze.
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           mkdir -p output
 
           cd trusted-firmware-a &&
-            bash ../tf-a-ci-scripts/script/graphs/sloc-viz.bash ${DIRECTORIES} \
+            bash ../tf-a-ci-scripts/script/graphs/sloc-viz.bash ${{DIRECTORIES}} \
               > ../output.png 2> ../output.tsv
     publishers:
       - archive:
diff --git a/tf-a-static-checks.yaml b/tf-a-static-checks.yaml
index 0085ae9..284f71d 100644
--- a/tf-a-static-checks.yaml
+++ b/tf-a-static-checks.yaml
@@ -61,22 +61,22 @@
           timeout: 240
           fail: true
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
-          if [[ "${REPO_UNDER_TEST}" == trusted-firmware-a ]]; then
+          if [[ "${{REPO_UNDER_TEST}}" == trusted-firmware-a ]]; then
           cat <<EOF > env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           TEST_GROUPS=tf-l2-scan-build
           EOF
           fi
-          cd ${WORKSPACE}/${REPO_UNDER_TEST}
+          cd ${{WORKSPACE}}/${{REPO_UNDER_TEST}}
           # Executed project-related static checks: copyright presence, headers in alphabetical order,
           # line endings, coding style and banned API.
-          IS_CONTINUOUS_INTEGRATION=1 ${WORKSPACE}/tf-a-ci-scripts/script/static-checks/static-checks.sh
+          IS_CONTINUOUS_INTEGRATION=1 ${{WORKSPACE}}/tf-a-ci-scripts/script/static-checks/static-checks.sh
       - trigger-builds:
           - project: tf-a-ci-gateway
             block: true
@@ -87,7 +87,7 @@
             property-file-fail-on-missing: True
     publishers:
       - archive:
-          artifacts: ${REPO_UNDER_TEST}/static-checks.log
+          artifacts: ${{REPO_UNDER_TEST}}/static-checks.log
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-static-checks/postbuild.groovy
diff --git a/tf-a-test-category-visualization.yaml b/tf-a-test-category-visualization.yaml
index 0cf4497..05dd937 100644
--- a/tf-a-test-category-visualization.yaml
+++ b/tf-a-test-category-visualization.yaml
@@ -20,12 +20,12 @@
           default:
           description: Optional job/group filter string (e.g. <code>juno</code>).
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           mkdir -p output
 
           cd tf-a-ci-scripts &&
-            bash script/graphs/categorize-tests.bash ${FILTER} \
+            bash script/graphs/categorize-tests.bash ${{FILTER}} \
               > ../output.png 2> ../output.tsv
     publishers:
       - archive:
diff --git a/tf-a-test-result-visualization.yaml b/tf-a-test-result-visualization.yaml
index 3d5e061..741772f 100644
--- a/tf-a-test-result-visualization.yaml
+++ b/tf-a-test-result-visualization.yaml
@@ -40,12 +40,12 @@
           default: tf-a-main/1
           description: Target build to analyze.
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
 
-          bash ${WORKSPACE}/tf-a-ci-scripts/script/graphs/tf-main-results.bash \
-              "${JENKINS_PUBLIC_URL}job/${TARGET_BUILD}"
+          bash ${{WORKSPACE}}/tf-a-ci-scripts/script/graphs/tf-main-results.bash \
+              "${{JENKINS_PUBLIC_URL}}job/${{TARGET_BUILD}}"
     publishers:
       - postbuildscript:
           builders:
@@ -59,10 +59,10 @@
               build-steps:
                 - shell: |-
                     #!/bin/bash -e
-                    export CI_ROOT=${PWD}/tf-a-ci-scripts
+                    export CI_ROOT=${{PWD}}/tf-a-ci-scripts
                     bash "$CI_ROOT/job/tf-ci-gateway/generate_report.sh" -t
       - archive:
           artifacts: report.html, tf-a-main*.png, tf-a-main*.csv
       - groovy-postbuild:
-          script: !include-raw:
+          script: !include-raw-verbatim:
             - tf-a-ci-gateway/postbuild.groovy
diff --git a/tf-a-tftf-docs-watcher.yaml b/tf-a-tftf-docs-watcher.yaml
index ab8a763..2a1ed77 100644
--- a/tf-a-tftf-docs-watcher.yaml
+++ b/tf-a-tftf-docs-watcher.yaml
@@ -10,9 +10,9 @@
           #!/bin/bash -e
           echo "Trigger ReadTheDocs build on the $RTD_BRANCHES branch and the latest version"
           RTD_API="https://readthedocs.org/api/v3/projects/trustedfirmware-a-tests"
-          curl -s -X POST -H "Authorization: Token ${RTD_TOKEN}" ${RTD_API}/versions/$RTD_BRANCHES/builds/ | jq .
+          curl -s -X POST -H "Authorization: Token ${{RTD_TOKEN}}" ${{RTD_API}}/versions/$RTD_BRANCHES/builds/ | jq .
           echo "Trigger build latest version"
-          curl -s -X POST -H "Authorization: Token ${RTD_TOKEN}" ${RTD_API}/versions/latest/builds/ | jq .
+          curl -s -X POST -H "Authorization: Token ${{RTD_TOKEN}}" ${{RTD_API}}/versions/latest/builds/ | jq .
     properties:
       - build-discarder:
           days-to-keep: 7
diff --git a/tf-a-tftf-gerrit-tforg-l1.yaml b/tf-a-tftf-gerrit-tforg-l1.yaml
index 03a969b..c47ae39 100644
--- a/tf-a-tftf-gerrit-tforg-l1.yaml
+++ b/tf-a-tftf-gerrit-tforg-l1.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -72,17 +72,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-tftf-gerrit-tforg-l2.yaml b/tf-a-tftf-gerrit-tforg-l2.yaml
index d566c6f..8e22f5d 100644
--- a/tf-a-tftf-gerrit-tforg-l2.yaml
+++ b/tf-a-tftf-gerrit-tforg-l2.yaml
@@ -40,7 +40,7 @@
           description: Git refspec for Trusted Firmware-A.
       - string:
           name: TFTF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: Parameter only used by the clone script
       - string:
           name: SPM_REFSPEC
@@ -72,17 +72,17 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > env.param
-          GERRIT_PATCHSET_NUMBER=${GERRIT_PATCHSET_NUMBER}
-          GERRIT_CHANGE_NUMBER=${GERRIT_CHANGE_NUMBER}
-          GERRIT_HOST=${GERRIT_HOST}
-          TFTF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TFTF_GERRIT_BRANCH=${GERRIT_BRANCH}
-          TFTF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          GERRIT_PATCHSET_NUMBER=${{GERRIT_PATCHSET_NUMBER}}
+          GERRIT_CHANGE_NUMBER=${{GERRIT_CHANGE_NUMBER}}
+          GERRIT_HOST=${{GERRIT_HOST}}
+          TFTF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TFTF_GERRIT_BRANCH=${{GERRIT_BRANCH}}
+          TFTF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           condition: COMPLETED
diff --git a/tf-a-tfut-weekly.yaml b/tf-a-tfut-weekly.yaml
index d4fba7b..a297ae6 100644
--- a/tf-a-tfut-weekly.yaml
+++ b/tf-a-tfut-weekly.yaml
@@ -74,19 +74,19 @@
     wrappers:
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: TFA UNIT TESTS
diff --git a/tf-a-weekly.yaml b/tf-a-weekly.yaml
index f2a49e1..9cdb12b 100644
--- a/tf-a-weekly.yaml
+++ b/tf-a-weekly.yaml
@@ -69,19 +69,19 @@
     wrappers:
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          GERRIT_PROJECT=${TF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TF_GERRIT_REFSPEC}}
           EOF
           cat << EOF > tf-a-tests-env.param
-          GERRIT_PROJECT=${TFTF_GERRIT_PROJECT}
-          GERRIT_BRANCH=${TFTF_GERRIT_BRANCH}
-          GERRIT_REFSPEC=${TFTF_GERRIT_REFSPEC}
+          GERRIT_PROJECT=${{TFTF_GERRIT_PROJECT}}
+          GERRIT_BRANCH=${{TFTF_GERRIT_BRANCH}}
+          GERRIT_REFSPEC=${{TFTF_GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: TFTF Fuzzing
diff --git a/tf-a-windows-builder.yaml b/tf-a-windows-builder.yaml
index ebefd5a..368261f 100644
--- a/tf-a-windows-builder.yaml
+++ b/tf-a-windows-builder.yaml
@@ -60,10 +60,10 @@
           excludes: build/**/*.o,build/**/*.d
     scm:
       - git:
-          url: ${TF_SRC_REPO_URL}
-          refspec: ${TF_GERRIT_REFSPEC}
+          url: ${{TF_SRC_REPO_URL}}
+          refspec: ${{TF_GERRIT_REFSPEC}}
           branches:
-            - ${TF_GERRIT_BRANCH}
+            - ${{TF_GERRIT_BRANCH}}
           choosing-strategy: gerrit
           skip-tag: true
           shallow-clone: true
diff --git a/tf-firmware-handoff-main.yaml b/tf-firmware-handoff-main.yaml
index 318934a..0ce78fe 100644
--- a/tf-firmware-handoff-main.yaml
+++ b/tf-firmware-handoff-main.yaml
@@ -62,7 +62,7 @@
             'e.g. refs/changes/13/31138/1'
       - string:
           name: TF_FIRMWARE_HANDOFF_GERRIT_REFSPEC
-          default: ${GERRIT_REFSPEC}
+          default: ${{GERRIT_REFSPEC}}
           description: |
             'do-not-amend: used by scripts/clone.sh to fetch the correct Gerrit patchset - use GERRIT_REFSPEC instead'
       - string:
@@ -92,13 +92,13 @@
               passphrase-variable: ""
       - timestamps
     builders:
-      - shell: !include-raw: scripts/clone.sh
+      - shell: !include-raw-verbatim: scripts/clone.sh
       - shell: |
           #!/bin/bash
           set -e
           cat << EOF > tf-a-env.param
-          TF_FIRMWARE_HANDOFF_GERRIT_PROJECT=${GERRIT_PROJECT}
-          TF_FIRMWARE_HANDOFF_GERRIT_REFSPEC=${GERRIT_REFSPEC}
+          TF_FIRMWARE_HANDOFF_GERRIT_PROJECT=${{GERRIT_PROJECT}}
+          TF_FIRMWARE_HANDOFF_GERRIT_REFSPEC=${{GERRIT_REFSPEC}}
           EOF
       - multijob:
           name: Platform independent tests
@@ -110,5 +110,5 @@
               predefined-parameters: |
                 TEST_REPO_NAME=tf-firmware-handoff
                 TEST_REPO_PROJECT=shared
-                TEST_FEATURES=${TEST_FEATURES}
+                TEST_FEATURES=${{TEST_FEATURES}}
               property-file: tf-a-env.param
diff --git a/tlc-pipeline.yaml b/tlc-pipeline.yaml
index 884625e..ef99151 100644
--- a/tlc-pipeline.yaml
+++ b/tlc-pipeline.yaml
@@ -5,4 +5,4 @@
       style, running unit tests, and building the package.
     project-type: pipeline
     sandbox: true
-    dsl: !include-raw: tlc-pipeline/Jenkinsfile
+    dsl: !include-raw-verbatim: tlc-pipeline/Jenkinsfile