wrapFlags are being evaluated by shell during build

[iynaix]

For example, the following wrapper:

inputs.wrapper-manager.lib.wrapWith pkgs {
    basePackage = pkgs.gh;
    wrapperType = "shell";
    wrapFlags = [
      "--run"
      ''export GITHUB_TOKEN=$(echo "abc")''
    ];
  };

produces:

#! /nix/store/q7sqwn7i6w2b67adw0bmix29pxg85x3w-bash-5.3p3/bin/bash -e
export GITHUB_TOKEN=abc
exec -a "$0" "/nix/store/yac2cbxia8f43mx48jfv9fip95g2m4dz-gh-2.79.0/bin/.gh-wrapped"  "$@"

Is this expected behavior? I would instead expect it to reproduce the wrapFlag verbatim, so it can be evaluated at runtime instead, i.e:

#! /nix/store/q7sqwn7i6w2b67adw0bmix29pxg85x3w-bash-5.3p3/bin/bash -e
export GITHUB_TOKEN=$(echo "abc")
exec -a "$0" "/nix/store/yac2cbxia8f43mx48jfv9fip95g2m4dz-gh-2.79.0/bin/.gh-wrapped"  "$@"

[viperML]

At some point during the refactor, this behaviour of escaping bash code was lost. We should add it back.