One should use protected variables in my opinion. One could configure them in the pipeline settings and subsequently call them inside the pipeline. Using base64 formats should be avoided as these could be easily decrypted.
Surprisingly indeed GitLab works weirdly with the env vars.
It evaluates them internally, though it shouldn't in my view.
Value set as (in project Settings > CI/CD > Variables): 'aaa$bbb*%'
(with single quotes left!)
Couple of of proof links:
My understanding of the variable groups is that you would create this to leverage the same variables across multiple pipelines. If you needed to update the value, you'd only have to update it on the library instead of updating it on dozens of pipelines. If you are only going to use the variable group on a single pipeline definition, variables groups appear ...
Your string isn't being interpolated at the correct time because it's in single quotes. Instead it's being passed to the checkout method as an un-interpolated string. By the time the checkout method interpolates the string, the perf variable is out of scope and so interpretation of this variable falls back to a blank string. Something like this is what ...