Bump System.Security.Cryptography.ProtectedData from 8.0.0 to 10.0.1

---
updated-dependencies:
- dependency-name: System.Security.Cryptography.ProtectedData
  dependency-version: 10.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/build.yml

@@ -14,6 +14,9 @@ on:
     paths-ignore:
     - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -50,7 +53,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Build runner layout
     - name: Build & Layout Release
@@ -80,3 +83,48 @@ jobs:
         name: runner-package-${{ matrix.runtime }}
         path: |
           _package
+
+  docker:
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, ubuntu-24.04-arm ]
+        include:
+          - os: ubuntu-latest
+            docker_platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            docker_platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Get latest runner version
+      id: latest_runner
+      uses: actions/github-script@v8
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const release = await github.rest.repos.getLatestRelease({
+            owner: 'actions',
+            repo: 'runner',
+          });
+          const version = release.data.tag_name.replace(/^v/, '');
+          core.setOutput('version', version);
+
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: ./images
+        load: true
+        platforms: ${{ matrix.docker_platform }}
+        tags: |
+          ${{ github.sha }}:latest
+        build-args: |
+          RUNNER_VERSION=${{ steps.latest_runner.outputs.version }}
+
+    - name: Test Docker image
+      run: |
+        docker run --rm ${{ github.sha }}:latest ./run.sh --version
+  

.github/workflows/codeql.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/dependency-check.yml

@@ -29,7 +29,7 @@ jobs:
       npm-vulnerabilities: ${{ steps.check-versions.outputs.npm-vulnerabilities }}
       open-dependency-prs: ${{ steps.check-prs.outputs.open-dependency-prs }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/docker-buildx-upgrade.yml

@@ -17,7 +17,7 @@ jobs:
       BUILDX_CURRENT_VERSION: ${{ steps.check_buildx_version.outputs.CURRENT_VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Check Docker version
         id: check_docker_version
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Update Docker version
         shell: bash

.github/workflows/docker-publish.yml

@@ -0,0 +1,75 @@
+name: Publish DockerImage from Release Branch
+
+on:
+  workflow_dispatch:
+    inputs:
+      releaseBranch:
+        description: 'Release Branch (releases/mXXX)'
+        required: true
+
+jobs:
+  publish-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.releaseBranch }}
+
+      - name: Compute image version
+        id: image
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const runnerVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '');
+            console.log(`Using runner version ${runnerVersion}`);
+            if (!/^\d+\.\d+\.\d+$/.test(runnerVersion)) {
+              throw new Error(`Invalid runner version: ${runnerVersion}`);
+            }
+            core.setOutput('version', runnerVersion);
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./images
+          platforms: |
+            linux/amd64
+            linux/arm64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.image.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          build-args: |
+            RUNNER_VERSION=${{ steps.image.outputs.version }}
+          push: true
+          labels: |
+            org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
+            org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
+
+      - name: Generate attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
+          push-to-registry: true

.github/workflows/dotnet-upgrade.yml

@@ -15,7 +15,7 @@ jobs:
       DOTNET_CURRENT_MAJOR_MINOR_VERSION: ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Get current major minor version
         id: fetch_current_version
         shell: bash
@@ -89,7 +89,7 @@ jobs:
     if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
       - name: Create Pull Request

.github/workflows/node-upgrade.yml

@@ -9,7 +9,7 @@ jobs:
   update-node:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Get latest Node versions
         id: node-versions
         run: |

.github/workflows/npm-audit-typescript.yml

@@ -7,7 +7,7 @@ jobs:
   npm-audit-with-ts-fix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/npm-audit.yml

@@ -9,7 +9,7 @@ jobs:
   npm-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/release.yml

@@ -11,12 +11,12 @@ jobs:
     if: startsWith(github.ref, 'refs/heads/releases/') || github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Make sure ./releaseVersion match ./src/runnerversion
     # Query GitHub release ensure version is not used
     - name: Check version
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
@@ -86,7 +86,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Build runner layout
     - name: Build & Layout Release
@@ -129,7 +129,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Download runner package tar.gz/zip produced by 'build' job
     - name: Download Artifact (win-x64)
@@ -171,7 +171,7 @@ jobs:
     # Create ReleaseNote file
     - name: Create ReleaseNote
       id: releaseNote
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
@@ -296,11 +296,11 @@ jobs:
       IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Compute image version
         id: image
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -334,8 +334,9 @@ jobs:
           push: true
           labels: |
             org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
             org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
 
       - name: Generate attestation
         uses: actions/attest-build-provenance@v3

images/Dockerfile

@@ -1,12 +1,12 @@
 # Source: https://github.com/dotnet/dotnet-docker
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy AS build
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble AS build
 
 ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=29.0.1
+ARG DOCKER_VERSION=29.0.2
-ARG BUILDX_VERSION=0.30.0
+ARG BUILDX_VERSION=0.30.1
 
 RUN apt update -y && apt install curl unzip -y
 
@@ -33,15 +33,15 @@ RUN export RUNNER_ARCH=${TARGETARCH} \
     && rm -rf docker.tgz \
     && mkdir -p /usr/local/lib/docker/cli-plugins \
     && curl -fLo /usr/local/lib/docker/cli-plugins/docker-buildx \
-        "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
+    "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
     && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV RUNNER_MANUALLY_TRAP_SIG=1
 ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
-ENV ImageOS=ubuntu22
+ENV ImageOS=ubuntu24
 
 # 'gpg-agent' and 'software-properties-common' are needed for the 'add-apt-repository' command that follows
 RUN apt update -y \
@@ -54,8 +54,6 @@ RUN add-apt-repository ppa:git-core/ppa \
     && apt install -y git \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /home/runner
-
 RUN adduser --disabled-password --gecos "" --uid 1001 runner \
     && groupadd docker --gid 123 \
     && usermod -aG sudo runner \
@@ -64,6 +62,8 @@ RUN adduser --disabled-password --gecos "" --uid 1001 runner \
     && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers \
     && chmod 777 /home/runner
 
+WORKDIR /home/runner
+
 COPY --chown=runner:docker --from=build /actions-runner .
 COPY --from=build /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-buildx
 

src/Misc/externals.sh

@@ -6,8 +6,8 @@ NODE_URL=https://nodejs.org/dist
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.5"
+NODE20_VERSION="20.19.6"
-NODE24_VERSION="24.11.1"
+NODE24_VERSION="24.12.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args

src/Misc/layoutroot/safe_sleep.sh

@@ -1,5 +1,36 @@
 #!/bin/bash
 
+# try to use sleep if available
+if [ -x "$(command -v sleep)" ]; then
+    sleep "$1"
+    exit 0
+fi
+
+# try to use ping if available
+if [ -x "$(command -v ping)" ]; then
+    ping -c $(( $1 + 1 )) 127.0.0.1 > /dev/null
+    exit 0
+fi
+
+# try to use read -t from stdin/stdout/stderr if we are in bash
+if [ -n "$BASH_VERSION" ]; then
+    if command -v read >/dev/null 2>&1; then
+        if [ -t 0 ]; then
+            read -t "$1" -u 0 || :;
+            exit 0
+        fi
+        if [ -t 1 ]; then
+            read -t "$1" -u 1 || :;
+            exit 0
+        fi
+        if [ -t 2 ]; then
+            read -t "$1" -u 2 || :;
+            exit 0
+        fi
+    fi
+fi
+
+# fallback to a busy wait
 SECONDS=0
 while [[ $SECONDS -lt $1 ]]; do
     :

src/Runner.Worker/ActionManifestManager.cs

@@ -316,6 +316,7 @@ namespace GitHub.Runner.Worker
                 Schema = _actionManifestSchema,
                 // TODO: Switch to real tracewriter for cutover
                 TraceWriter = new GitHub.Actions.WorkflowParser.ObjectTemplating.EmptyTraceWriter(),
+                AllowCaseFunction = false,
             };
 
             // Expression values from execution context

src/Runner.Worker/ActionManifestManagerLegacy.cs

@@ -315,6 +315,7 @@ namespace GitHub.Runner.Worker
                     maxBytes: 10 * 1024 * 1024),
                 Schema = _actionManifestSchema,
                 TraceWriter = executionContext.ToTemplateTraceWriter(),
+                AllowCaseFunction = false,
             };
 
             // Expression values from execution context

src/Sdk/DTExpressions2/Expressions2/ExpressionConstants.cs

@@ -9,6 +9,7 @@ namespace GitHub.DistributedTask.Expressions2
     {
         static ExpressionConstants()
         {
+            AddFunction<Case>("case", 3, Byte.MaxValue);
             AddFunction<Contains>("contains", 2, 2);
             AddFunction<EndsWith>("endsWith", 2, 2);
             AddFunction<Format>("format", 1, Byte.MaxValue);

src/Sdk/DTExpressions2/Expressions2/ExpressionParser.cs

@@ -17,9 +17,10 @@ namespace GitHub.DistributedTask.Expressions2
             String expression,
             ITraceWriter trace,
             IEnumerable<INamedValueInfo> namedValues,
-            IEnumerable<IFunctionInfo> functions)
+            IEnumerable<IFunctionInfo> functions,
+            Boolean allowCaseFunction = true)
         {
-            var context = new ParseContext(expression, trace, namedValues, functions);
+            var context = new ParseContext(expression, trace, namedValues, functions, allowCaseFunction);
             context.Trace.Info($"Parsing expression: <{expression}>");
             return CreateTree(context);
         }
@@ -349,6 +350,10 @@ namespace GitHub.DistributedTask.Expressions2
             {
                 throw new ParseException(ParseExceptionKind.TooManyParameters, token: @operator, expression: context.Expression);
             }
+            else if (functionInfo.Name.Equals("case", StringComparison.OrdinalIgnoreCase) && function.Parameters.Count % 2 == 0)
+            {
+                throw new ParseException(ParseExceptionKind.EvenParameters, token: @operator, expression: context.Expression);
+            }
         }
 
         /// <summary>
@@ -411,6 +416,12 @@ namespace GitHub.DistributedTask.Expressions2
             String name,
             out IFunctionInfo functionInfo)
         {
+            if (String.Equals(name, "case", StringComparison.OrdinalIgnoreCase) && !context.AllowCaseFunction)
+            {
+                functionInfo = null;
+                return false;
+            }
+
             return ExpressionConstants.WellKnownFunctions.TryGetValue(name, out functionInfo) ||
                 context.ExtensionFunctions.TryGetValue(name, out functionInfo);
         }
@@ -418,6 +429,7 @@ namespace GitHub.DistributedTask.Expressions2
         private sealed class ParseContext
         {
             public Boolean AllowUnknownKeywords;
+            public Boolean AllowCaseFunction;
             public readonly String Expression;
             public readonly Dictionary<String, IFunctionInfo> ExtensionFunctions = new Dictionary<String, IFunctionInfo>(StringComparer.OrdinalIgnoreCase);
             public readonly Dictionary<String, INamedValueInfo> ExtensionNamedValues = new Dictionary<String, INamedValueInfo>(StringComparer.OrdinalIgnoreCase);
@@ -433,7 +445,8 @@ namespace GitHub.DistributedTask.Expressions2
                 ITraceWriter trace,
                 IEnumerable<INamedValueInfo> namedValues,
                 IEnumerable<IFunctionInfo> functions,
-                Boolean allowUnknownKeywords = false)
+                Boolean allowUnknownKeywords = false,
+                Boolean allowCaseFunction = true)
             {
                 Expression = expression ?? String.Empty;
                 if (Expression.Length > ExpressionConstants.MaxLength)
@@ -454,6 +467,7 @@ namespace GitHub.DistributedTask.Expressions2
 
                 LexicalAnalyzer = new LexicalAnalyzer(Expression);
                 AllowUnknownKeywords = allowUnknownKeywords;
+                AllowCaseFunction = allowCaseFunction;
             }
 
             private class NoOperationTraceWriter : ITraceWriter

src/Sdk/DTExpressions2/Expressions2/ParseException.cs

@@ -29,6 +29,9 @@ namespace GitHub.DistributedTask.Expressions2
                 case ParseExceptionKind.TooManyParameters:
                     description = "Too many parameters supplied";
                     break;
+                case ParseExceptionKind.EvenParameters:
+                    description = "Even number of parameters supplied, requires an odd number of parameters";
+                    break;
                 case ParseExceptionKind.UnexpectedEndOfExpression:
                     description = "Unexpected end of expression";
                     break;

src/Sdk/DTExpressions2/Expressions2/ParseExceptionKind.cs

@@ -6,6 +6,7 @@
         ExceededMaxLength,
         TooFewParameters,
         TooManyParameters,
+        EvenParameters,
         UnexpectedEndOfExpression,
         UnexpectedSymbol,
         UnrecognizedFunction,

src/Sdk/DTExpressions2/Expressions2/Sdk/Functions/Case.cs

@@ -0,0 +1,45 @@
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+
+using System;
+using GitHub.Actions.Expressions.Data;
+
+namespace GitHub.DistributedTask.Expressions2.Sdk.Functions
+{
+    internal sealed class Case : Function
+    {
+        protected sealed override Object EvaluateCore(
+            EvaluationContext context,
+            out ResultMemory resultMemory)
+        {
+            resultMemory = null;
+            // Validate argument count - must be odd (pairs of predicate-result plus default)
+            if (Parameters.Count % 2 == 0)
+            {
+                throw new InvalidOperationException("case requires an odd number of arguments");
+            }
+
+            // Evaluate predicate-result pairs
+            for (var i = 0; i < Parameters.Count - 1; i += 2)
+            {
+                var predicate = Parameters[i].Evaluate(context);
+
+                // Predicate must be a boolean
+                if (predicate.Kind != ValueKind.Boolean)
+                {
+                    throw new InvalidOperationException("case predicate must evaluate to a boolean value");
+                }
+
+                // If predicate is true, return the corresponding result
+                if ((Boolean)predicate.Value)
+                {
+                    var result = Parameters[i + 1].Evaluate(context);
+                    return result.Value;
+                }
+            }
+
+            // No predicate matched, return default (last argument)
+            var defaultResult = Parameters[Parameters.Count - 1].Evaluate(context);
+            return defaultResult.Value;
+        }
+    }
+}

src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateContext.cs

@@ -86,6 +86,12 @@ namespace GitHub.DistributedTask.ObjectTemplating
 
         internal ITraceWriter TraceWriter { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether the case expression function is allowed.
+        /// Defaults to true. Set to false to disable the case function.
+        /// </summary>
+        internal Boolean AllowCaseFunction { get; set; } = true;
+
         private IDictionary<String, Int32> FileIds
         {
             get

src/Sdk/DTObjectTemplating/ObjectTemplating/Tokens/TemplateToken.cs

@@ -57,7 +57,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -94,7 +94,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -123,7 +123,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -152,7 +152,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConverter.cs

@@ -663,7 +663,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
             var node = default(ExpressionNode);
             try
             {
-                node = expressionParser.CreateTree(condition, null, namedValues, functions) as ExpressionNode;
+                node = expressionParser.CreateTree(condition, null, namedValues, functions, allowCaseFunction: context.AllowCaseFunction) as ExpressionNode;
             }
             catch (Exception ex)
             {

src/Sdk/Expressions/ExpressionConstants.cs

@@ -10,6 +10,7 @@ namespace GitHub.Actions.Expressions
     {
         static ExpressionConstants()
         {
+            AddFunction<Case>("case", 3, Byte.MaxValue);
             AddFunction<Contains>("contains", 2, 2);
             AddFunction<EndsWith>("endsWith", 2, 2);
             AddFunction<Format>("format", 1, Byte.MaxValue);

src/Sdk/Expressions/ExpressionParser.cs

@@ -17,9 +17,10 @@ namespace GitHub.Actions.Expressions
             String expression,
             ITraceWriter trace,
             IEnumerable<INamedValueInfo> namedValues,
-            IEnumerable<IFunctionInfo> functions)
+            IEnumerable<IFunctionInfo> functions,
+            Boolean allowCaseFunction = true)
         {
-            var context = new ParseContext(expression, trace, namedValues, functions);
+            var context = new ParseContext(expression, trace, namedValues, functions, allowCaseFunction: allowCaseFunction);
             context.Trace.Info($"Parsing expression: <{expression}>");
             return CreateTree(context);
         }
@@ -349,6 +350,10 @@ namespace GitHub.Actions.Expressions
             {
                 throw new ParseException(ParseExceptionKind.TooManyParameters, token: @operator, expression: context.Expression);
             }
+            else if (functionInfo.Name.Equals("case", StringComparison.OrdinalIgnoreCase) && function.Parameters.Count % 2 == 0)
+            {
+                throw new ParseException(ParseExceptionKind.EvenParameters, token: @operator, expression: context.Expression);
+            }
         }
 
         /// <summary>
@@ -411,6 +416,12 @@ namespace GitHub.Actions.Expressions
             String name,
             out IFunctionInfo functionInfo)
         {
+            if (String.Equals(name, "case", StringComparison.OrdinalIgnoreCase) && !context.AllowCaseFunction)
+            {
+                functionInfo = null;
+                return false;
+            }
+
             return ExpressionConstants.WellKnownFunctions.TryGetValue(name, out functionInfo) ||
                 context.ExtensionFunctions.TryGetValue(name, out functionInfo);
         }
@@ -418,6 +429,7 @@ namespace GitHub.Actions.Expressions
         private sealed class ParseContext
         {
             public Boolean AllowUnknownKeywords;
+            public Boolean AllowCaseFunction;
             public readonly String Expression;
             public readonly Dictionary<String, IFunctionInfo> ExtensionFunctions = new Dictionary<String, IFunctionInfo>(StringComparer.OrdinalIgnoreCase);
             public readonly Dictionary<String, INamedValueInfo> ExtensionNamedValues = new Dictionary<String, INamedValueInfo>(StringComparer.OrdinalIgnoreCase);
@@ -433,7 +445,8 @@ namespace GitHub.Actions.Expressions
                 ITraceWriter trace,
                 IEnumerable<INamedValueInfo> namedValues,
                 IEnumerable<IFunctionInfo> functions,
-                Boolean allowUnknownKeywords = false)
+                Boolean allowUnknownKeywords = false,
+                Boolean allowCaseFunction = true)
             {
                 Expression = expression ?? String.Empty;
                 if (Expression.Length > ExpressionConstants.MaxLength)
@@ -454,6 +467,7 @@ namespace GitHub.Actions.Expressions
 
                 LexicalAnalyzer = new LexicalAnalyzer(Expression);
                 AllowUnknownKeywords = allowUnknownKeywords;
+                AllowCaseFunction = allowCaseFunction;
             }
 
             private class NoOperationTraceWriter : ITraceWriter

src/Sdk/Expressions/ParseException.cs

@@ -29,6 +29,9 @@ namespace GitHub.Actions.Expressions
                 case ParseExceptionKind.TooManyParameters:
                     description = "Too many parameters supplied";
                     break;
+                case ParseExceptionKind.EvenParameters:
+                    description = "Even number of parameters supplied, requires an odd number of parameters";
+                    break;
                 case ParseExceptionKind.UnexpectedEndOfExpression:
                     description = "Unexpected end of expression";
                     break;

src/Sdk/Expressions/ParseExceptionKind.cs

@@ -6,6 +6,7 @@ namespace GitHub.Actions.Expressions
         ExceededMaxLength,
         TooFewParameters,
         TooManyParameters,
+        EvenParameters,
         UnexpectedEndOfExpression,
         UnexpectedSymbol,
         UnrecognizedFunction,

src/Sdk/Expressions/Sdk/Functions/Case.cs

@@ -0,0 +1,45 @@
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+
+using System;
+using GitHub.Actions.Expressions.Data;
+
+namespace GitHub.Actions.Expressions.Sdk.Functions
+{
+    internal sealed class Case : Function
+    {
+        protected sealed override Object EvaluateCore(
+            EvaluationContext context,
+            out ResultMemory resultMemory)
+        {
+            resultMemory = null;
+            // Validate argument count - must be odd (pairs of predicate-result plus default)
+            if (Parameters.Count % 2 == 0)
+            {
+                throw new InvalidOperationException("case requires an odd number of arguments");
+            }
+
+            // Evaluate predicate-result pairs
+            for (var i = 0; i < Parameters.Count - 1; i += 2)
+            {
+                var predicate = Parameters[i].Evaluate(context);
+
+                // Predicate must be a boolean
+                if (predicate.Kind != ValueKind.Boolean)
+                {
+                    throw new InvalidOperationException("case predicate must evaluate to a boolean value");
+                }
+
+                // If predicate is true, return the corresponding result
+                if ((Boolean)predicate.Value)
+                {
+                    var result = Parameters[i + 1].Evaluate(context);
+                    return result.Value;
+                }
+            }
+
+            // No predicate matched, return default (last argument)
+            var defaultResult = Parameters[Parameters.Count - 1].Evaluate(context);
+            return defaultResult.Value;
+        }
+    }
+}

src/Sdk/Sdk.csproj

@@ -24,7 +24,7 @@
         <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
         <PackageReference Include="System.Security.Cryptography.Cng" Version="5.0.0" />
         <PackageReference Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
-        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
+        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.1" />
         <PackageReference Include="Minimatch" Version="2.0.0" />
         <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
         <PackageReference Include="System.Net.Http" Version="4.3.4" />

src/Sdk/WorkflowParser/Conversion/WorkflowTemplateConverter.cs

@@ -1775,7 +1775,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
             var node = default(ExpressionNode);
             try
             {
-                node = expressionParser.CreateTree(condition, null, namedValues, functions) as ExpressionNode;
+                node = expressionParser.CreateTree(condition, null, namedValues, functions, allowCaseFunction: context.AllowCaseFunction) as ExpressionNode;
             }
             catch (Exception ex)
             {

src/Sdk/WorkflowParser/ObjectTemplating/TemplateContext.cs

@@ -113,6 +113,12 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating
         /// </summary>
         internal Boolean StrictJsonParsing { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether the case expression function is allowed.
+        /// Defaults to true. Set to false to disable the case function.
+        /// </summary>
+        internal Boolean AllowCaseFunction { get; set; } = true;
+
         internal ITraceWriter TraceWriter { get; set; }
 
         private IDictionary<String, Int32> FileIds

src/Sdk/WorkflowParser/ObjectTemplating/Tokens/TemplateToken.cs

@@ -55,7 +55,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -93,7 +93,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -123,7 +123,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -153,7 +153,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,