Fix expression parsing (partially)

fix double output + masking
Phase 5 done
2026-01-16 00:35:13 +08:00 · 2026-01-15 16:05:01 +00:00 · 2026-01-15 13:52:24 +00:00 · 2026-01-14 21:24:59 +00:00 · 2026-01-14 21:14:10 +00:00 · 2026-01-14 21:05:55 +00:00
50 changed files with 4326 additions and 106 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,6 +14,9 @@ on:
    paths-ignore:
    - '**.md'

+permissions:
+  contents: read
+
 jobs:
  build:
    strategy:
@@ -50,7 +53,7 @@ jobs:

    runs-on: ${{ matrix.os }}
    steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6

    # Build runner layout
    - name: Build & Layout Release
@@ -75,8 +78,53 @@ jobs:
    # Upload runner package tar.gz/zip as artifact
    - name: Publish Artifact
      if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
      with:
        name: runner-package-${{ matrix.runtime }}
        path: |
          _package
+
+  docker:
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, ubuntu-24.04-arm ]
+        include:
+          - os: ubuntu-latest
+            docker_platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            docker_platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Get latest runner version
+      id: latest_runner
+      uses: actions/github-script@v8
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const release = await github.rest.repos.getLatestRelease({
+            owner: 'actions',
+            repo: 'runner',
+          });
+          const version = release.data.tag_name.replace(/^v/, '');
+          core.setOutput('version', version);
+
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v6
+      with:
+        context: ./images
+        load: true
+        platforms: ${{ matrix.docker_platform }}
+        tags: |
+          ${{ github.sha }}:latest
+        build-args: |
+          RUNNER_VERSION=${{ steps.latest_runner.outputs.version }}
+
+    - name: Test Docker image
+      run: |
+        docker run --rm ${{ github.sha }}:latest ./run.sh --version
+  
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
--- a/.github/workflows/dependency-check.yml
+++ b/.github/workflows/dependency-check.yml
@@ -29,7 +29,7 @@ jobs:
      npm-vulnerabilities: ${{ steps.check-versions.outputs.npm-vulnerabilities }}
      open-dependency-prs: ${{ steps.check-prs.outputs.open-dependency-prs }}
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
--- a/.github/workflows/docker-buildx-upgrade.yml
+++ b/.github/workflows/docker-buildx-upgrade.yml
@@ -17,7 +17,7 @@ jobs:
      BUILDX_CURRENT_VERSION: ${{ steps.check_buildx_version.outputs.CURRENT_VERSION }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Check Docker version
        id: check_docker_version
@@ -89,7 +89,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Update Docker version
        shell: bash
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -0,0 +1,75 @@
+name: Publish DockerImage from Release Branch
+
+on:
+  workflow_dispatch:
+    inputs:
+      releaseBranch:
+        description: 'Release Branch (releases/mXXX)'
+        required: true
+
+jobs:
+  publish-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.releaseBranch }}
+
+      - name: Compute image version
+        id: image
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const runnerVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '');
+            console.log(`Using runner version ${runnerVersion}`);
+            if (!/^\d+\.\d+\.\d+$/.test(runnerVersion)) {
+              throw new Error(`Invalid runner version: ${runnerVersion}`);
+            }
+            core.setOutput('version', runnerVersion);
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./images
+          platforms: |
+            linux/amd64
+            linux/arm64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.image.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          build-args: |
+            RUNNER_VERSION=${{ steps.image.outputs.version }}
+          push: true
+          labels: |
+            org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
+            org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
+
+      - name: Generate attestation
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
+          push-to-registry: true
--- a/.github/workflows/dotnet-upgrade.yml
+++ b/.github/workflows/dotnet-upgrade.yml
@@ -15,7 +15,7 @@ jobs:
      DOTNET_CURRENT_MAJOR_MINOR_VERSION: ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
      - name: Get current major minor version
        id: fetch_current_version
        shell: bash
@@ -89,7 +89,7 @@ jobs:
    if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
        with:
          ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
      - name: Create Pull Request
--- a/.github/workflows/node-upgrade.yml
+++ b/.github/workflows/node-upgrade.yml
@@ -9,7 +9,7 @@ jobs:
  update-node:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - name: Get latest Node versions
        id: node-versions
        run: |
--- a/.github/workflows/npm-audit-typescript.yml
+++ b/.github/workflows/npm-audit-typescript.yml
@@ -7,7 +7,7 @@ jobs:
  npm-audit-with-ts-fix:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
--- a/.github/workflows/npm-audit.yml
+++ b/.github/workflows/npm-audit.yml
@@ -9,7 +9,7 @@ jobs:
  npm-audit:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
      
      - name: Setup Node.js
        uses: actions/setup-node@v6
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,12 +11,12 @@ jobs:
    if: startsWith(github.ref, 'refs/heads/releases/') || github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6

    # Make sure ./releaseVersion match ./src/runnerversion
    # Query GitHub release ensure version is not used
    - name: Check version
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@v8
      with:
        github-token: ${{secrets.GITHUB_TOKEN}}
        script: |
@@ -86,7 +86,7 @@ jobs:

    runs-on: ${{ matrix.os }}
    steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6

    # Build runner layout
    - name: Build & Layout Release
@@ -118,7 +118,7 @@ jobs:
    # Upload runner package tar.gz/zip as artifact.
    - name: Publish Artifact
      if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v6
      with:
        name: runner-packages-${{ matrix.runtime }}
        path: |
@@ -129,41 +129,41 @@ jobs:
    runs-on: ubuntu-latest
    steps:

-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6

    # Download runner package tar.gz/zip produced by 'build' job
    - name: Download Artifact (win-x64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-win-x64
        path: ./
    - name: Download Artifact (win-arm64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-win-arm64
        path: ./
    - name: Download Artifact (osx-x64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-osx-x64
        path: ./
    - name: Download Artifact (osx-arm64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-osx-arm64
        path: ./
    - name: Download Artifact (linux-x64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-linux-x64
        path: ./
    - name: Download Artifact (linux-arm)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-linux-arm
        path: ./
    - name: Download Artifact (linux-arm64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
      with:
        name: runner-packages-linux-arm64
        path: ./
@@ -171,7 +171,7 @@ jobs:
    # Create ReleaseNote file
    - name: Create ReleaseNote
      id: releaseNote
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@v8
      with:
        github-token: ${{secrets.GITHUB_TOKEN}}
        script: |
@@ -296,11 +296,11 @@ jobs:
      IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6

      - name: Compute image version
        id: image
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
@@ -334,8 +334,9 @@ jobs:
          push: true
          labels: |
            org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
            org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}

      - name: Generate attestation
        uses: actions/attest-build-provenance@v3
--- a/.opencode/plans/dap-debugging-fixes.md
+++ b/.opencode/plans/dap-debugging-fixes.md
@@ -0,0 +1,299 @@
+# DAP Debugging - Bug Fixes and Enhancements
+
+**Status:** Planned  
+**Date:** January 2026  
+**Related:** [dap-debugging.md](./dap-debugging.md)
+
+## Overview
+
+This document tracks bug fixes and enhancements for the DAP debugging implementation after the initial phases were completed.
+
+## Issues
+
+### Bug 1: Double Output in REPL Shell Commands
+
+**Symptom:** Running commands in the REPL shell produces double output - the first one unmasked, the second one with secrets masked.
+
+**Root Cause:** In `DapDebugSession.ExecuteShellCommandAsync()` (lines 670-773), output is sent to the debugger twice:
+
+1. **Real-time streaming (unmasked):** Lines 678-712 stream output via DAP `output` events as data arrives from the process - but this output is NOT masked
+2. **Final result (masked):** Lines 765-769 return the combined output as `EvaluateResponseBody.Result` with secrets masked
+
+The DAP client displays both the streamed events AND the evaluate response result, causing duplication.
+
+**Fix:**
+1. Mask secrets in the real-time streaming output (add `HostContext.SecretMasker.MaskSecrets()` to lines ~690 and ~708)
+2. Change the final `Result` to only show exit code summary instead of full output
+
+---
+
+### Bug 2: Expressions Interpreted as Shell Commands
+
+**Symptom:** Evaluating expressions like `${{github.event_name}} == 'push'` in the Watch/Expressions pane results in them being executed as shell commands instead of being evaluated as GitHub Actions expressions.
+
+**Root Cause:** In `DapDebugSession.HandleEvaluateAsync()` (line 514), the condition to detect shell commands is too broad:
+
+```csharp
+if (evalContext == "repl" || expression.StartsWith("!") || expression.StartsWith("$"))
+```
+
+Since `${{github.event_name}}` starts with `$`, it gets routed to shell execution instead of expression evaluation.
+
+**Fix:**
+1. Check for `${{` prefix first - these are always GitHub Actions expressions
+2. Remove the `expression.StartsWith("$")` condition entirely (ambiguous and unnecessary since REPL context handles shell commands)
+3. Keep `expression.StartsWith("!")` for explicit shell override in non-REPL contexts
+
+---
+
+### Enhancement: Expression Interpolation in REPL Commands
+
+**Request:** When running REPL commands like `echo ${{github.event_name}}`, the `${{ }}` expressions should be expanded before shell execution, similar to how `run:` steps work.
+
+**Approach:** Add a helper method that uses the existing `PipelineTemplateEvaluator` infrastructure to expand expressions in the command string before passing it to the shell.
+
+---
+
+## Implementation Details
+
+### File: `src/Runner.Worker/Dap/DapDebugSession.cs`
+
+#### Change 1: Mask Real-Time Streaming Output
+
+**Location:** Lines ~678-712 (OutputDataReceived and ErrorDataReceived handlers)
+
+**Before:**
+```csharp
+processInvoker.OutputDataReceived += (sender, args) =>
+{
+    if (!string.IsNullOrEmpty(args.Data))
+    {
+        output.AppendLine(args.Data);
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody
+            {
+                Category = "stdout",
+                Output = args.Data + "\n"  // NOT MASKED
+            }
+        });
+    }
+};
+```
+
+**After:**
+```csharp
+processInvoker.OutputDataReceived += (sender, args) =>
+{
+    if (!string.IsNullOrEmpty(args.Data))
+    {
+        output.AppendLine(args.Data);
+        var maskedData = HostContext.SecretMasker.MaskSecrets(args.Data);
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody
+            {
+                Category = "stdout",
+                Output = maskedData + "\n"
+            }
+        });
+    }
+};
+```
+
+Apply the same change to `ErrorDataReceived` handler (~lines 696-712).
+
+---
+
+#### Change 2: Return Only Exit Code in Result
+
+**Location:** Lines ~767-772 (return statement in ExecuteShellCommandAsync)
+
+**Before:**
+```csharp
+return new EvaluateResponseBody
+{
+    Result = result.TrimEnd('\r', '\n'),
+    Type = exitCode == 0 ? "string" : "error",
+    VariablesReference = 0
+};
+```
+
+**After:**
+```csharp
+return new EvaluateResponseBody
+{
+    Result = $"(exit code: {exitCode})",
+    Type = exitCode == 0 ? "string" : "error",
+    VariablesReference = 0
+};
+```
+
+Also remove the result combination logic (lines ~747-762) since we no longer need to build the full result string for the response.
+
+---
+
+#### Change 3: Fix Expression vs Shell Routing
+
+**Location:** Lines ~511-536 (HandleEvaluateAsync method)
+
+**Before:**
+```csharp
+try
+{
+    // Check if this is a REPL/shell command (context: "repl") or starts with shell prefix
+    if (evalContext == "repl" || expression.StartsWith("!") || expression.StartsWith("$"))
+    {
+        // Shell execution mode
+        var command = expression.TrimStart('!', '$').Trim();
+        // ...
+    }
+    else
+    {
+        // Expression evaluation mode
+        var result = EvaluateExpression(expression, executionContext);
+        return CreateSuccessResponse(result);
+    }
+}
+```
+
+**After:**
+```csharp
+try
+{
+    // GitHub Actions expressions start with "${{" - always evaluate as expressions
+    if (expression.StartsWith("${{"))
+    {
+        var result = EvaluateExpression(expression, executionContext);
+        return CreateSuccessResponse(result);
+    }
+
+    // Check if this is a REPL/shell command:
+    // - context is "repl" (from Debug Console pane)
+    // - expression starts with "!" (explicit shell prefix for Watch pane)
+    if (evalContext == "repl" || expression.StartsWith("!"))
+    {
+        // Shell execution mode
+        var command = expression.TrimStart('!').Trim();
+        if (string.IsNullOrEmpty(command))
+        {
+            return CreateSuccessResponse(new EvaluateResponseBody
+            {
+                Result = "(empty command)",
+                Type = "string",
+                VariablesReference = 0
+            });
+        }
+
+        var result = await ExecuteShellCommandAsync(command, executionContext);
+        return CreateSuccessResponse(result);
+    }
+    else
+    {
+        // Expression evaluation mode (Watch pane, hover, etc.)
+        var result = EvaluateExpression(expression, executionContext);
+        return CreateSuccessResponse(result);
+    }
+}
+```
+
+---
+
+#### Change 4: Add Expression Expansion Helper Method
+
+**Location:** Add new method before `ExecuteShellCommandAsync` (~line 667)
+
+```csharp
+/// <summary>
+/// Expands ${{ }} expressions within a command string.
+/// For example: "echo ${{github.event_name}}" -> "echo push"
+/// </summary>
+private string ExpandExpressionsInCommand(string command, IExecutionContext context)
+{
+    if (string.IsNullOrEmpty(command) || !command.Contains("${{"))
+    {
+        return command;
+    }
+
+    try
+    {
+        // Create a StringToken with the command
+        var token = new StringToken(null, null, null, command);
+
+        // Use the template evaluator to expand expressions
+        var templateEvaluator = context.ToPipelineTemplateEvaluator();
+        var result = templateEvaluator.EvaluateStepDisplayName(
+            token,
+            context.ExpressionValues,
+            context.ExpressionFunctions);
+
+        // Mask secrets in the expanded command
+        result = HostContext.SecretMasker.MaskSecrets(result ?? command);
+
+        Trace.Info($"Expanded command: {result}");
+        return result;
+    }
+    catch (Exception ex)
+    {
+        Trace.Info($"Expression expansion failed, using original command: {ex.Message}");
+        return command;
+    }
+}
+```
+
+**Required import:** Add `using GitHub.DistributedTask.ObjectTemplating.Tokens;` at the top of the file if not already present.
+
+---
+
+#### Change 5: Use Expression Expansion in Shell Execution
+
+**Location:** Beginning of `ExecuteShellCommandAsync` method (~line 670)
+
+**Before:**
+```csharp
+private async Task<EvaluateResponseBody> ExecuteShellCommandAsync(string command, IExecutionContext context)
+{
+    Trace.Info($"Executing shell command: {command}");
+    // ...
+}
+```
+
+**After:**
+```csharp
+private async Task<EvaluateResponseBody> ExecuteShellCommandAsync(string command, IExecutionContext context)
+{
+    // Expand ${{ }} expressions in the command first
+    command = ExpandExpressionsInCommand(command, context);
+
+    Trace.Info($"Executing shell command: {command}");
+    // ...
+}
+```
+
+---
+
+## DAP Context Reference
+
+For future reference, these are the DAP evaluate context values:
+
+| DAP Context | Source UI | Behavior |
+|-------------|-----------|----------|
+| `"repl"` | Debug Console / REPL pane | Shell execution (with expression expansion) |
+| `"watch"` | Watch / Expressions pane | Expression evaluation |
+| `"hover"` | Editor hover (default) | Expression evaluation |
+| `"variables"` | Variables pane | Expression evaluation |
+| `"clipboard"` | Copy to clipboard | Expression evaluation |
+
+---
+
+## Testing Checklist
+
+- [ ] REPL command output is masked and appears only once
+- [ ] REPL command shows exit code in result field
+- [ ] Expression `${{github.event_name}}` evaluates correctly in Watch pane
+- [ ] Expression `${{github.event_name}} == 'push'` evaluates correctly
+- [ ] REPL command `echo ${{github.event_name}}` expands and executes correctly
+- [ ] REPL command `!ls -la` from Watch pane works (explicit shell prefix)
+- [ ] Secrets are masked in all outputs (streaming and expanded commands)
--- a/.opencode/plans/dap-debugging.md
+++ b/.opencode/plans/dap-debugging.md
@@ -0,0 +1,536 @@
+# DAP-Based Debugging for GitHub Actions Runner
+
+**Status:** Draft  
+**Author:** GitHub Actions Team  
+**Date:** January 2026
+
+## Progress Checklist
+
+- [x] **Phase 1:** DAP Protocol Infrastructure (DapMessages.cs, DapServer.cs, basic DapDebugSession.cs)
+- [x] **Phase 2:** Debug Session Logic (DapVariableProvider.cs, variable inspection, step history tracking)
+- [x] **Phase 3:** StepsRunner Integration (pause hooks before/after step execution)
+- [x] **Phase 4:** Expression Evaluation & Shell (REPL)
+- [x] **Phase 5:** Startup Integration (JobRunner.cs modifications)
+
+## Overview
+
+This document describes the implementation of Debug Adapter Protocol (DAP) support in the GitHub Actions runner, enabling rich debugging of workflow jobs from any DAP-compatible editor (nvim-dap, VS Code, etc.).
+
+## Goals
+
+- **Primary:** Create a working demo to demonstrate the feasibility of DAP-based workflow debugging
+- **Non-goal:** Production-ready, polished implementation (this is proof-of-concept)
+
+## User Experience
+
+1. User re-runs a failed job with "Enable debug logging" checked in GitHub UI
+2. Runner (running locally) detects debug mode and starts DAP server on port 4711
+3. Runner prints "Waiting for debugger on port 4711..." and pauses
+4. User opens editor (nvim with nvim-dap), connects to debugger
+5. Job execution begins, pausing before the first step
+6. User can:
+   - **Inspect variables:** View `github`, `env`, `inputs`, `steps`, `secrets` (redacted), `runner`, `job` contexts
+   - **Evaluate expressions:** `${{ github.event.pull_request.title }}`
+   - **Execute shell commands:** Run arbitrary commands in the job's environment (REPL)
+   - **Step through job:** `next` moves to next step, `continue` runs to end
+   - **Pause after steps:** Inspect step outputs before continuing
+
+## Activation
+
+DAP debugging activates automatically when the job is in debug mode:
+
+- User enables "Enable debug logging" when re-running a job in GitHub UI
+- Server sends `ACTIONS_STEP_DEBUG=true` in job variables
+- Runner sets `Global.WriteDebug = true` and `runner.debug = "1"`
+- DAP server starts on port 4711
+
+**No additional configuration required.**
+
+### Optional Configuration
+
+| Environment Variable | Default | Description |
+|---------------------|---------|-------------|
+| `ACTIONS_DAP_PORT` | `4711` | TCP port for DAP server (optional override) |
+
+## Architecture
+
+```
+┌─────────────────────┐                    ┌─────────────────────────────────────────┐
+│     nvim-dap        │                    │           Runner.Worker                 │
+│   (DAP Client)      │◄───TCP:4711───────►│  ┌─────────────────────────────────┐   │
+│                     │                    │  │     DapServer                    │   │
+└─────────────────────┘                    │  │  - TCP listener                  │   │
+                                           │  │  - DAP JSON protocol             │   │
+                                           │  └──────────────┬──────────────────┘   │
+                                           │                 │                       │
+                                           │  ┌──────────────▼──────────────────┐   │
+                                           │  │     DapDebugSession              │   │
+                                           │  │  - Debug state management        │   │
+                                           │  │  - Step coordination             │   │
+                                           │  │  - Variable exposure             │   │
+                                           │  │  - Expression evaluation         │   │
+                                           │  │  - Shell execution (REPL)        │   │
+                                           │  └──────────────┬──────────────────┘   │
+                                           │                 │                       │
+                                           │  ┌──────────────▼──────────────────┐   │
+                                           │  │     StepsRunner (modified)       │   │
+                                           │  │  - Pause before/after steps      │   │
+                                           │  │  - Notify debug session          │   │
+                                           │  └─────────────────────────────────┘   │
+                                           └─────────────────────────────────────────┘
+```
+
+## DAP Concept Mapping
+
+| DAP Concept | Actions Runner Equivalent |
+|-------------|---------------------------|
+| Thread | Single job execution |
+| Stack Frame | Current step + completed steps (step history) |
+| Scope | Context category: `github`, `env`, `inputs`, `steps`, `secrets`, `runner`, `job` |
+| Variable | Individual context values |
+| Breakpoint | Pause before specific step (future enhancement) |
+| Step Over (Next) | Execute current step, pause before next |
+| Continue | Run until job end |
+| Evaluate | Evaluate `${{ }}` expressions OR execute shell commands (REPL) |
+
+## File Structure
+
+```
+src/Runner.Worker/
+├── Dap/
+│   ├── DapServer.cs              # TCP listener, JSON protocol handling
+│   ├── DapDebugSession.cs        # Debug state, step coordination  
+│   ├── DapMessages.cs            # DAP protocol message types
+│   └── DapVariableProvider.cs    # Converts ExecutionContext to DAP variables
+```
+
+## Implementation Phases
+
+### Phase 1: DAP Protocol Infrastructure
+
+#### 1.1 Protocol Messages (`Dap/DapMessages.cs`)
+
+Base message types following DAP spec:
+
+```csharp
+public abstract class ProtocolMessage
+{
+    public int seq { get; set; }
+    public string type { get; set; }  // "request", "response", "event"
+}
+
+public class Request : ProtocolMessage
+{
+    public string command { get; set; }
+    public object arguments { get; set; }
+}
+
+public class Response : ProtocolMessage
+{
+    public int request_seq { get; set; }
+    public bool success { get; set; }
+    public string command { get; set; }
+    public string message { get; set; }
+    public object body { get; set; }
+}
+
+public class Event : ProtocolMessage
+{
+    public string @event { get; set; }
+    public object body { get; set; }
+}
+```
+
+Message framing: `Content-Length: N\r\n\r\n{json}`
+
+#### 1.2 DAP Server (`Dap/DapServer.cs`)
+
+```csharp
+[ServiceLocator(Default = typeof(DapServer))]
+public interface IDapServer : IRunnerService
+{
+    Task StartAsync(int port);
+    Task WaitForConnectionAsync();
+    Task StopAsync();
+    void SendEvent(Event evt);
+}
+
+public sealed class DapServer : RunnerService, IDapServer
+{
+    private TcpListener _listener;
+    private TcpClient _client;
+    private IDapDebugSession _session;
+    
+    // TCP listener on configurable port
+    // Single-client connection
+    // Async read/write loop
+    // Dispatch requests to DapDebugSession
+}
+```
+
+### Phase 2: Debug Session Logic
+
+#### 2.1 Debug Session (`Dap/DapDebugSession.cs`)
+
+```csharp
+public enum DapCommand { Continue, Next, Pause, Disconnect }
+public enum PauseReason { Entry, Step, Breakpoint, Pause }
+
+[ServiceLocator(Default = typeof(DapDebugSession))]
+public interface IDapDebugSession : IRunnerService
+{
+    bool IsActive { get; }
+    
+    // Called by DapServer
+    void Initialize(InitializeRequestArguments args);
+    void Attach(AttachRequestArguments args);
+    void ConfigurationDone();
+    Task<DapCommand> WaitForCommandAsync();
+    
+    // Called by StepsRunner
+    Task OnStepStartingAsync(IStep step, IExecutionContext jobContext);
+    void OnStepCompleted(IStep step);
+    
+    // DAP requests
+    ThreadsResponse GetThreads();
+    StackTraceResponse GetStackTrace(int threadId);
+    ScopesResponse GetScopes(int frameId);
+    VariablesResponse GetVariables(int variablesReference);
+    EvaluateResponse Evaluate(string expression, string context);
+}
+
+public sealed class DapDebugSession : RunnerService, IDapDebugSession
+{
+    private IExecutionContext _jobContext;
+    private IStep _currentStep;
+    private readonly List<IStep> _completedSteps = new();
+    private TaskCompletionSource<DapCommand> _commandTcs;
+    private bool _pauseAfterStep = false;
+    
+    // Object reference management for nested variables
+    private int _nextVariableReference = 1;
+    private readonly Dictionary<int, object> _variableReferences = new();
+}
+```
+
+Core state machine:
+1. **Waiting for client:** Server started, no client connected
+2. **Initializing:** Client connected, exchanging capabilities
+3. **Ready:** `configurationDone` received, waiting to start
+4. **Paused (before step):** Stopped before step execution, waiting for command
+5. **Running:** Executing a step
+6. **Paused (after step):** Stopped after step execution, waiting for command
+
+#### 2.2 Variable Provider (`Dap/DapVariableProvider.cs`)
+
+Maps `ExecutionContext.ExpressionValues` to DAP scopes and variables:
+
+| Scope | Source | Notes |
+|-------|--------|-------|
+| `github` | `ExpressionValues["github"]` | Full github context |
+| `env` | `ExpressionValues["env"]` | Environment variables |
+| `inputs` | `ExpressionValues["inputs"]` | Step inputs (when available) |
+| `steps` | `Global.StepsContext.GetScope()` | Completed step outputs |
+| `secrets` | `ExpressionValues["secrets"]` | Keys shown, values = `[REDACTED]` |
+| `runner` | `ExpressionValues["runner"]` | Runner context |
+| `job` | `ExpressionValues["job"]` | Job status |
+
+Nested objects (e.g., `github.event.pull_request`) become expandable variables with child references.
+
+### Phase 3: StepsRunner Integration
+
+#### 3.1 Modify `StepsRunner.cs`
+
+Add debug hooks at step boundaries:
+
+```csharp
+public async Task RunAsync(IExecutionContext jobContext)
+{
+    // Get debug session if available
+    var debugSession = HostContext.TryGetService<IDapDebugSession>();
+    bool isFirstStep = true;
+    
+    while (jobContext.JobSteps.Count > 0 || !checkPostJobActions)
+    {
+        // ... existing dequeue logic ...
+        
+        var step = jobContext.JobSteps.Dequeue();
+        
+        // Pause BEFORE step execution
+        if (debugSession?.IsActive == true)
+        {
+            var reason = isFirstStep ? PauseReason.Entry : PauseReason.Step;
+            await debugSession.OnStepStartingAsync(step, jobContext, reason);
+            isFirstStep = false;
+        }
+        
+        // ... existing step execution (condition eval, RunStepAsync, etc.) ...
+        
+        // Pause AFTER step execution (if requested)
+        if (debugSession?.IsActive == true)
+        {
+            debugSession.OnStepCompleted(step);
+            // Session may pause here to let user inspect outputs
+        }
+    }
+}
+```
+
+### Phase 4: Expression Evaluation & Shell (REPL)
+
+#### 4.1 Expression Evaluation
+
+Reuse existing `PipelineTemplateEvaluator`:
+
+```csharp
+private EvaluateResponseBody EvaluateExpression(string expression, IExecutionContext context)
+{
+    // Strip ${{ }} wrapper if present
+    var expr = expression.Trim();
+    if (expr.StartsWith("${{") && expr.EndsWith("}}"))
+    {
+        expr = expr.Substring(3, expr.Length - 5).Trim();
+    }
+    
+    var expressionToken = new BasicExpressionToken(fileId: null, line: null, column: null, expression: expr);
+    var templateEvaluator = context.ToPipelineTemplateEvaluator();
+    
+    var result = templateEvaluator.EvaluateStepDisplayName(
+        expressionToken, 
+        context.ExpressionValues, 
+        context.ExpressionFunctions
+    );
+    
+    // Mask secrets and determine type
+    result = HostContext.SecretMasker.MaskSecrets(result ?? "null");
+    
+    return new EvaluateResponseBody
+    {
+        Result = result,
+        Type = DetermineResultType(result),
+        VariablesReference = 0
+    };
+}
+```
+
+**Supported expression formats:**
+- Plain expression: `github.ref`, `steps.build.outputs.result`
+- Wrapped expression: `${{ github.event.pull_request.title }}`
+
+#### 4.2 Shell Execution (REPL)
+
+Shell execution is triggered when:
+1. The evaluate request has `context: "repl"`, OR
+2. The expression starts with `!` (e.g., `!ls -la`), OR  
+3. The expression starts with `$` followed by a shell command (e.g., `$env`)
+
+**Usage examples in debug console:**
+```
+!ls -la                          # List files in workspace
+!env | grep GITHUB               # Show GitHub environment variables
+!cat $GITHUB_EVENT_PATH          # View the event payload
+!echo ${{ github.ref }}          # Mix shell and expression (evaluated first)
+```
+
+**Implementation:**
+
+```csharp
+private async Task<EvaluateResponseBody> ExecuteShellCommandAsync(string command, IExecutionContext context)
+{
+    var processInvoker = HostContext.CreateService<IProcessInvoker>();
+    var output = new StringBuilder();
+    
+    processInvoker.OutputDataReceived += (sender, args) =>
+    {
+        output.AppendLine(args.Data);
+        // Stream to client in real-time via DAP output event
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody { Category = "stdout", Output = args.Data + "\n" }
+        });
+    };
+    
+    processInvoker.ErrorDataReceived += (sender, args) =>
+    {
+        _server?.SendEvent(new Event
+        {
+            EventType = "output",
+            Body = new OutputEventBody { Category = "stderr", Output = args.Data + "\n" }
+        });
+    };
+    
+    // Build environment from job context (includes GITHUB_*, env context, prepend path)
+    var env = BuildShellEnvironment(context);
+    var workDir = GetWorkingDirectory(context);  // Uses github.workspace
+    var (shell, shellArgs) = GetDefaultShell();  // Platform-specific detection
+    
+    int exitCode = await processInvoker.ExecuteAsync(
+        workingDirectory: workDir,
+        fileName: shell,
+        arguments: string.Format(shellArgs, command),
+        environment: env,
+        requireExitCodeZero: false,
+        cancellationToken: CancellationToken.None
+    );
+    
+    return new EvaluateResponseBody
+    {
+        Result = HostContext.SecretMasker.MaskSecrets(output.ToString()),
+        Type = exitCode == 0 ? "string" : "error",
+        VariablesReference = 0
+    };
+}
+```
+
+**Shell detection by platform:**
+
+| Platform | Priority | Shell | Arguments |
+|----------|----------|-------|-----------|
+| Windows | 1 | `pwsh` | `-NoProfile -NonInteractive -Command "{0}"` |
+| Windows | 2 | `powershell` | `-NoProfile -NonInteractive -Command "{0}"` |
+| Windows | 3 | `cmd.exe` | `/C "{0}"` |
+| Unix | 1 | `bash` | `-c "{0}"` |
+| Unix | 2 | `sh` | `-c "{0}"` |
+
+**Environment built for shell commands:**
+- Current system environment variables
+- GitHub Actions context variables (from `IEnvironmentContextData.GetRuntimeEnvironmentVariables()`)
+- Prepend path from job context added to `PATH`
+
+### Phase 5: Startup Integration
+
+#### 5.1 Modify `JobRunner.cs`
+
+Add DAP server startup after debug mode is detected (around line 159):
+
+```csharp
+if (jobContext.Global.WriteDebug)
+{
+    jobContext.SetRunnerContext("debug", "1");
+    
+    // Start DAP server for interactive debugging
+    var dapServer = HostContext.GetService<IDapServer>();
+    var port = int.Parse(
+        Environment.GetEnvironmentVariable("ACTIONS_DAP_PORT") ?? "4711");
+    
+    await dapServer.StartAsync(port);
+    Trace.Info($"DAP server listening on port {port}");
+    jobContext.Output($"DAP debugger waiting for connection on port {port}...");
+    
+    // Block until debugger connects
+    await dapServer.WaitForConnectionAsync();
+    Trace.Info("DAP client connected, continuing job execution");
+}
+```
+
+## DAP Capabilities
+
+Capabilities to advertise in `InitializeResponse`:
+
+```json
+{
+    "supportsConfigurationDoneRequest": true,
+    "supportsEvaluateForHovers": true,
+    "supportsTerminateDebuggee": true,
+    "supportsStepBack": false,
+    "supportsSetVariable": false,
+    "supportsRestartFrame": false,
+    "supportsGotoTargetsRequest": false,
+    "supportsStepInTargetsRequest": false,
+    "supportsCompletionsRequest": false,
+    "supportsModulesRequest": false,
+    "supportsExceptionOptions": false,
+    "supportsValueFormattingOptions": false,
+    "supportsExceptionInfoRequest": false,
+    "supportsDelayedStackTraceLoading": false,
+    "supportsLoadedSourcesRequest": false,
+    "supportsProgressReporting": false,
+    "supportsRunInTerminalRequest": false
+}
+```
+
+## Client Configuration (nvim-dap)
+
+Example configuration for nvim-dap:
+
+```lua
+local dap = require('dap')
+
+dap.adapters.actions = {
+    type = 'server',
+    host = '127.0.0.1',
+    port = 4711,
+}
+
+dap.configurations.yaml = {
+    {
+        type = 'actions',
+        request = 'attach',
+        name = 'Attach to Actions Runner',
+    }
+}
+```
+
+## Demo Flow
+
+1. Trigger job re-run with "Enable debug logging" checked in GitHub UI
+2. Runner starts, detects debug mode (`Global.WriteDebug == true`)
+3. DAP server starts, console shows: `DAP debugger waiting for connection on port 4711...`
+4. In nvim: `:lua require('dap').continue()`
+5. Connection established, capabilities exchanged
+6. Job begins, pauses before first step
+7. nvim shows "stopped" state, variables panel shows contexts
+8. User explores variables, evaluates expressions, runs shell commands
+9. User presses `n` (next) to advance to next step
+10. After step completes, user can inspect outputs before continuing
+11. Repeat until job completes
+
+## Testing Strategy
+
+1. **Unit tests:** DAP protocol serialization, variable provider mapping
+2. **Integration tests:** Mock DAP client verifying request/response sequences
+3. **Manual testing:** Real job with nvim-dap attached
+
+## Future Enhancements (Out of Scope for Demo)
+
+- Composite action step-in (expand into sub-steps)
+- Breakpoints on specific step names
+- Watch expressions
+- Conditional breakpoints
+- Remote debugging (runner not on localhost)
+- VS Code extension
+
+## Estimated Effort
+
+| Phase | Effort |
+|-------|--------|
+| Phase 1: Protocol Infrastructure | 4-6 hours |
+| Phase 2: Debug Session Logic | 4-6 hours |
+| Phase 3: StepsRunner Integration | 2-3 hours |
+| Phase 4: Expression & Shell | 3-4 hours |
+| Phase 5: Startup & Polish | 2-3 hours |
+| **Total** | **~2-3 days** |
+
+## Key Files to Modify
+
+| File | Changes |
+|------|---------|
+| `src/Runner.Worker/JobRunner.cs` | Start DAP server when debug mode enabled |
+| `src/Runner.Worker/StepsRunner.cs` | Add pause hooks before/after step execution |
+| `src/Runner.Worker/Runner.Worker.csproj` | Add new Dap/ folder files |
+
+## Key Files to Create
+
+| File | Purpose |
+|------|---------|
+| `src/Runner.Worker/Dap/DapServer.cs` | TCP server, protocol framing |
+| `src/Runner.Worker/Dap/DapDebugSession.cs` | Debug state machine, command handling |
+| `src/Runner.Worker/Dap/DapMessages.cs` | Protocol message types |
+| `src/Runner.Worker/Dap/DapVariableProvider.cs` | Context → DAP variable conversion |
+
+## Reference Links
+
+- [DAP Overview](https://microsoft.github.io/debug-adapter-protocol/overview)
+- [DAP Specification](https://microsoft.github.io/debug-adapter-protocol/specification)
+- [Enable Debug Logging (GitHub Docs)](https://docs.github.com/en/actions/how-tos/monitor-workflows/enable-debug-logging)
--- a/images/Dockerfile
+++ b/images/Dockerfile
@@ -1,12 +1,12 @@
 # Source: https://github.com/dotnet/dotnet-docker
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy AS build
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble AS build

 ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=29.0.1
-ARG BUILDX_VERSION=0.30.0
+ARG DOCKER_VERSION=29.0.2
+ARG BUILDX_VERSION=0.30.1

 RUN apt update -y && apt install curl unzip -y

@@ -33,15 +33,15 @@ RUN export RUNNER_ARCH=${TARGETARCH} \
    && rm -rf docker.tgz \
    && mkdir -p /usr/local/lib/docker/cli-plugins \
    && curl -fLo /usr/local/lib/docker/cli-plugins/docker-buildx \
-        "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
+    "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
    && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx

-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble

 ENV DEBIAN_FRONTEND=noninteractive
 ENV RUNNER_MANUALLY_TRAP_SIG=1
 ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
-ENV ImageOS=ubuntu22
+ENV ImageOS=ubuntu24

 # 'gpg-agent' and 'software-properties-common' are needed for the 'add-apt-repository' command that follows
 RUN apt update -y \
@@ -54,8 +54,6 @@ RUN add-apt-repository ppa:git-core/ppa \
    && apt install -y git \
    && rm -rf /var/lib/apt/lists/*

-WORKDIR /home/runner
-
 RUN adduser --disabled-password --gecos "" --uid 1001 runner \
    && groupadd docker --gid 123 \
    && usermod -aG sudo runner \
@@ -64,6 +62,8 @@ RUN adduser --disabled-password --gecos "" --uid 1001 runner \
    && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers \
    && chmod 777 /home/runner

+WORKDIR /home/runner
+
 COPY --chown=runner:docker --from=build /actions-runner .
 COPY --from=build /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-buildx

--- a/releaseNote.md
+++ b/releaseNote.md
@@ -1,30 +1,27 @@
 ## What's Changed
-* Custom Image: Preflight checks by @lawrencegripper in https://github.com/actions/runner/pull/4081
-* Update dotnet sdk to latest version @8.0.415 by @github-actions[bot] in https://github.com/actions/runner/pull/4080
-* Link to an extant discussion category by @jsoref in https://github.com/actions/runner/pull/4084
-* Improve logic around decide IsHostedServer. by @TingluoHuang in https://github.com/actions/runner/pull/4086
-* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4093
-* Compare updated template evaluator by @ericsciple in https://github.com/actions/runner/pull/4092
-* fix(dockerfile): set more lenient permissions on /home/runner by @caxu-rh in https://github.com/actions/runner/pull/4083
-* Add support for libicu73-76 for newer Debian/Ubuntu versions by @lets-build-an-ocean in https://github.com/actions/runner/pull/4098
-* Bump actions/download-artifact from 5 to 6 by @dependabot[bot] in https://github.com/actions/runner/pull/4089
-* Bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in https://github.com/actions/runner/pull/4088
-* Bump Azure.Storage.Blobs from 12.25.1 to 12.26.0 by @dependabot[bot] in https://github.com/actions/runner/pull/4077
-* Only start runner after network is online by @dupondje in https://github.com/actions/runner/pull/4094
-* Retry http error related to DNS resolution failure. by @TingluoHuang in https://github.com/actions/runner/pull/4110
-* Update Docker to v29.0.1 and Buildx to v0.30.0 by @github-actions[bot] in https://github.com/actions/runner/pull/4114
-* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4115
-* Update dotnet sdk to latest version @8.0.416 by @github-actions[bot] in https://github.com/actions/runner/pull/4116
-* Compare updated workflow parser for ActionManifestManager by @ericsciple in https://github.com/actions/runner/pull/4111
-* Bump npm pkg version for hashFiles. by @TingluoHuang in https://github.com/actions/runner/pull/4122
+* Fix owner of /home/runner directory by @nikola-jokic in https://github.com/actions/runner/pull/4132
+* Update Docker to v29.0.2 and Buildx to v0.30.1 by @github-actions[bot] in https://github.com/actions/runner/pull/4135
+* Update workflow around runner docker image. by @TingluoHuang in https://github.com/actions/runner/pull/4133
+* Fix regex for validating runner version format by @TingluoHuang in https://github.com/actions/runner/pull/4136
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4144
+* Ensure safe_sleep tries alternative approaches by @TingluoHuang in https://github.com/actions/runner/pull/4146
+* Bump actions/github-script from 7 to 8 by @dependabot[bot] in https://github.com/actions/runner/pull/4137
+* Bump actions/checkout from 5 to 6 by @dependabot[bot] in https://github.com/actions/runner/pull/4130
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4149
+* Bump docker image to use ubuntu 24.04 by @TingluoHuang in https://github.com/actions/runner/pull/4018
+* Add support for case function by @AllanGuigou in https://github.com/actions/runner/pull/4147
+* Cleanup feature flag actions_container_action_runner_temp by @ericsciple in https://github.com/actions/runner/pull/4163
+* Bump actions/download-artifact from 6 to 7 by @dependabot[bot] in https://github.com/actions/runner/pull/4155
+* Bump actions/upload-artifact from 5 to 6 by @dependabot[bot] in https://github.com/actions/runner/pull/4157
+* Set ACTIONS_ORCHESTRATION_ID as env to actions. by @TingluoHuang in https://github.com/actions/runner/pull/4178
+* Allow hosted VM report job telemetry via .setup_info file. by @TingluoHuang in https://github.com/actions/runner/pull/4186
+* Bump typescript from 5.9.2 to 5.9.3 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/4184
+* Bump Azure.Storage.Blobs from 12.26.0 to 12.27.0 by @dependabot[bot] in https://github.com/actions/runner/pull/4189

 ## New Contributors
-* @lawrencegripper made their first contribution in https://github.com/actions/runner/pull/4081
-* @caxu-rh made their first contribution in https://github.com/actions/runner/pull/4083
-* @lets-build-an-ocean made their first contribution in https://github.com/actions/runner/pull/4098
-* @dupondje made their first contribution in https://github.com/actions/runner/pull/4094
+* @AllanGuigou made their first contribution in https://github.com/actions/runner/pull/4147

-**Full Changelog**: https://github.com/actions/runner/compare/v2.329.0...v2.330.0
+**Full Changelog**: https://github.com/actions/runner/compare/v2.330.0...v2.331.0

 _Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
 To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.
--- a/src/Misc/expressionFunc/hashFiles/package-lock.json
+++ b/src/Misc/expressionFunc/hashFiles/package-lock.json
@@ -23,7 +23,7 @@
        "husky": "^9.1.7",
        "lint-staged": "^15.5.0",
        "prettier": "^3.0.3",
-        "typescript": "^5.9.2"
+        "typescript": "^5.9.3"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -4439,9 +4439,9 @@
      }
    },
    "node_modules/typescript": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
-      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "bin": {
        "tsc": "bin/tsc",
@@ -7643,9 +7643,9 @@
      }
    },
    "typescript": {
-      "version": "5.9.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
-      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true
    },
    "unbox-primitive": {
--- a/src/Misc/expressionFunc/hashFiles/package.json
+++ b/src/Misc/expressionFunc/hashFiles/package.json
@@ -46,6 +46,6 @@
    "husky": "^9.1.7",
    "lint-staged": "^15.5.0",
    "prettier": "^3.0.3",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.3"
  }
 }
--- a/src/Misc/externals.sh
+++ b/src/Misc/externals.sh
@@ -6,8 +6,8 @@ NODE_URL=https://nodejs.org/dist
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.5"
-NODE24_VERSION="24.11.1"
+NODE20_VERSION="20.19.6"
+NODE24_VERSION="24.12.0"

 get_abs_path() {
  # exploits the fact that pwd will print abs path when no args
--- a/src/Misc/layoutroot/safe_sleep.sh
+++ b/src/Misc/layoutroot/safe_sleep.sh
@@ -1,5 +1,36 @@
 #!/bin/bash

+# try to use sleep if available
+if [ -x "$(command -v sleep)" ]; then
+    sleep "$1"
+    exit 0
+fi
+
+# try to use ping if available
+if [ -x "$(command -v ping)" ]; then
+    ping -c $(( $1 + 1 )) 127.0.0.1 > /dev/null
+    exit 0
+fi
+
+# try to use read -t from stdin/stdout/stderr if we are in bash
+if [ -n "$BASH_VERSION" ]; then
+    if command -v read >/dev/null 2>&1; then
+        if [ -t 0 ]; then
+            read -t "$1" -u 0 || :;
+            exit 0
+        fi
+        if [ -t 1 ]; then
+            read -t "$1" -u 1 || :;
+            exit 0
+        fi
+        if [ -t 2 ]; then
+            read -t "$1" -u 2 || :;
+            exit 0
+        fi
+    fi
+fi
+
+# fallback to a busy wait
 SECONDS=0
 while [[ $SECONDS -lt $1 ]]; do
    :
--- a/src/Runner.Common/Constants.cs
+++ b/src/Runner.Common/Constants.cs
@@ -169,23 +169,23 @@ namespace GitHub.Runner.Common
                public static readonly string AllowRunnerContainerHooks = "DistributedTask.AllowRunnerContainerHooks";
                public static readonly string AddCheckRunIdToJobContext = "actions_add_check_run_id_to_job_context";
                public static readonly string DisplayHelpfulActionsDownloadErrors = "actions_display_helpful_actions_download_errors";
-                public static readonly string ContainerActionRunnerTemp = "actions_container_action_runner_temp";
                public static readonly string SnapshotPreflightHostedRunnerCheck = "actions_snapshot_preflight_hosted_runner_check";
                public static readonly string SnapshotPreflightImageGenPoolCheck = "actions_snapshot_preflight_image_gen_pool_check";
                public static readonly string CompareWorkflowParser = "actions_runner_compare_workflow_parser";
+                public static readonly string SetOrchestrationIdEnvForActions = "actions_set_orchestration_id_env_for_actions";
            }
-            
+
            // Node version migration related constants
            public static class NodeMigration
            {
                // Node versions
                public static readonly string Node20 = "node20";
                public static readonly string Node24 = "node24";
-                
+
                // Environment variables for controlling node version selection
                public static readonly string ForceNode24Variable = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24";
                public static readonly string AllowUnsecureNodeVersionVariable = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
-                
+
                // Feature flags for controlling the migration phases
                public static readonly string UseNode24ByDefaultFlag = "actions.runner.usenode24bydefault";
                public static readonly string RequireNode24Flag = "actions.runner.requirenode24";
--- a/src/Runner.Worker/ActionManifestManager.cs
+++ b/src/Runner.Worker/ActionManifestManager.cs
@@ -316,6 +316,7 @@ namespace GitHub.Runner.Worker
                Schema = _actionManifestSchema,
                // TODO: Switch to real tracewriter for cutover
                TraceWriter = new GitHub.Actions.WorkflowParser.ObjectTemplating.EmptyTraceWriter(),
+                AllowCaseFunction = false,
            };

            // Expression values from execution context
--- a/src/Runner.Worker/ActionManifestManagerLegacy.cs
+++ b/src/Runner.Worker/ActionManifestManagerLegacy.cs
@@ -315,6 +315,7 @@ namespace GitHub.Runner.Worker
                    maxBytes: 10 * 1024 * 1024),
                Schema = _actionManifestSchema,
                TraceWriter = executionContext.ToTemplateTraceWriter(),
+                AllowCaseFunction = false,
            };

            // Expression values from execution context
--- a/src/Runner.Worker/Dap/DapDebugSession.cs
+++ b/src/Runner.Worker/Dap/DapDebugSession.cs
--- a/src/Runner.Worker/Dap/DapMessages.cs
+++ b/src/Runner.Worker/Dap/DapMessages.cs
--- a/src/Runner.Worker/Dap/DapServer.cs
+++ b/src/Runner.Worker/Dap/DapServer.cs
@@ -0,0 +1,480 @@
+using System;
+using System.IO;
+using System.Net;
+using System.Net.Sockets;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+using Newtonsoft.Json;
+
+namespace GitHub.Runner.Worker.Dap
+{
+    /// <summary>
+    /// DAP Server interface for handling Debug Adapter Protocol connections.
+    /// </summary>
+    [ServiceLocator(Default = typeof(DapServer))]
+    public interface IDapServer : IRunnerService, IDisposable
+    {
+        /// <summary>
+        /// Starts the DAP TCP server on the specified port.
+        /// </summary>
+        /// <param name="port">The port to listen on (default: 4711)</param>
+        /// <param name="cancellationToken">Cancellation token</param>
+        Task StartAsync(int port, CancellationToken cancellationToken);
+
+        /// <summary>
+        /// Blocks until a debug client connects.
+        /// </summary>
+        /// <param name="cancellationToken">Cancellation token</param>
+        Task WaitForConnectionAsync(CancellationToken cancellationToken);
+
+        /// <summary>
+        /// Stops the DAP server and closes all connections.
+        /// </summary>
+        Task StopAsync();
+
+        /// <summary>
+        /// Sets the debug session that will handle DAP requests.
+        /// </summary>
+        /// <param name="session">The debug session</param>
+        void SetSession(IDapDebugSession session);
+
+        /// <summary>
+        /// Sends an event to the connected debug client.
+        /// </summary>
+        /// <param name="evt">The event to send</param>
+        void SendEvent(Event evt);
+
+        /// <summary>
+        /// Gets whether a debug client is currently connected.
+        /// </summary>
+        bool IsConnected { get; }
+    }
+
+    /// <summary>
+    /// TCP server implementation of the Debug Adapter Protocol.
+    /// Handles message framing (Content-Length headers) and JSON serialization.
+    /// </summary>
+    public sealed class DapServer : RunnerService, IDapServer
+    {
+        private const string ContentLengthHeader = "Content-Length: ";
+        private const string HeaderTerminator = "\r\n\r\n";
+
+        private TcpListener _listener;
+        private TcpClient _client;
+        private NetworkStream _stream;
+        private IDapDebugSession _session;
+        private CancellationTokenSource _cts;
+        private Task _messageLoopTask;
+        private TaskCompletionSource<bool> _connectionTcs;
+        private int _nextSeq = 1;
+        private readonly object _sendLock = new object();
+        private bool _disposed = false;
+
+        public bool IsConnected => _client?.Connected == true;
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            Trace.Info("DapServer initialized");
+        }
+
+        public void SetSession(IDapDebugSession session)
+        {
+            _session = session;
+            Trace.Info("Debug session set");
+        }
+
+        public async Task StartAsync(int port, CancellationToken cancellationToken)
+        {
+            Trace.Info($"Starting DAP server on port {port}");
+
+            _cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            _connectionTcs = new TaskCompletionSource<bool>(TaskCreationOptions.RunContinuationsAsynchronously);
+
+            try
+            {
+                _listener = new TcpListener(IPAddress.Loopback, port);
+                _listener.Start();
+                Trace.Info($"DAP server listening on 127.0.0.1:{port}");
+
+                // Start accepting connections in the background
+                _ = AcceptConnectionAsync(_cts.Token);
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Failed to start DAP server: {ex.Message}");
+                throw;
+            }
+
+            await Task.CompletedTask;
+        }
+
+        private async Task AcceptConnectionAsync(CancellationToken cancellationToken)
+        {
+            try
+            {
+                Trace.Info("Waiting for debug client connection...");
+
+                // Use cancellation-aware accept
+                using (cancellationToken.Register(() => _listener?.Stop()))
+                {
+                    _client = await _listener.AcceptTcpClientAsync();
+                }
+
+                if (cancellationToken.IsCancellationRequested)
+                {
+                    return;
+                }
+
+                _stream = _client.GetStream();
+                var remoteEndPoint = _client.Client.RemoteEndPoint;
+                Trace.Info($"Debug client connected from {remoteEndPoint}");
+
+                // Signal that connection is established
+                _connectionTcs.TrySetResult(true);
+
+                // Start processing messages
+                _messageLoopTask = ProcessMessagesAsync(_cts.Token);
+            }
+            catch (ObjectDisposedException) when (cancellationToken.IsCancellationRequested)
+            {
+                // Expected when cancellation stops the listener
+                Trace.Info("Connection accept cancelled");
+                _connectionTcs.TrySetCanceled();
+            }
+            catch (SocketException ex) when (cancellationToken.IsCancellationRequested)
+            {
+                // Expected when cancellation stops the listener
+                Trace.Info($"Connection accept cancelled: {ex.Message}");
+                _connectionTcs.TrySetCanceled();
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Error accepting connection: {ex.Message}");
+                _connectionTcs.TrySetException(ex);
+            }
+        }
+
+        public async Task WaitForConnectionAsync(CancellationToken cancellationToken)
+        {
+            Trace.Info("Waiting for debug client to connect...");
+
+            using (cancellationToken.Register(() => _connectionTcs.TrySetCanceled()))
+            {
+                await _connectionTcs.Task;
+            }
+
+            Trace.Info("Debug client connected");
+        }
+
+        public async Task StopAsync()
+        {
+            Trace.Info("Stopping DAP server");
+
+            _cts?.Cancel();
+
+            // Wait for message loop to complete
+            if (_messageLoopTask != null)
+            {
+                try
+                {
+                    await _messageLoopTask;
+                }
+                catch (OperationCanceledException)
+                {
+                    // Expected
+                }
+                catch (Exception ex)
+                {
+                    Trace.Warning($"Message loop ended with error: {ex.Message}");
+                }
+            }
+
+            // Clean up resources
+            _stream?.Close();
+            _client?.Close();
+            _listener?.Stop();
+
+            Trace.Info("DAP server stopped");
+        }
+
+        public void SendEvent(Event evt)
+        {
+            if (!IsConnected)
+            {
+                Trace.Warning($"Cannot send event '{evt.EventType}': no client connected");
+                return;
+            }
+
+            try
+            {
+                lock (_sendLock)
+                {
+                    evt.Seq = _nextSeq++;
+                    SendMessageInternal(evt);
+                }
+                Trace.Info($"Sent event: {evt.EventType}");
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Failed to send event '{evt.EventType}': {ex.Message}");
+            }
+        }
+
+        private async Task ProcessMessagesAsync(CancellationToken cancellationToken)
+        {
+            Trace.Info("Starting DAP message processing loop");
+
+            try
+            {
+                while (!cancellationToken.IsCancellationRequested && IsConnected)
+                {
+                    var json = await ReadMessageAsync(cancellationToken);
+                    if (json == null)
+                    {
+                        Trace.Info("Client disconnected (end of stream)");
+                        break;
+                    }
+
+                    await ProcessMessageAsync(json, cancellationToken);
+                }
+            }
+            catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+            {
+                Trace.Info("Message processing cancelled");
+            }
+            catch (IOException ex)
+            {
+                Trace.Info($"Connection closed: {ex.Message}");
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Error in message loop: {ex}");
+            }
+
+            Trace.Info("DAP message processing loop ended");
+        }
+
+        private async Task ProcessMessageAsync(string json, CancellationToken cancellationToken)
+        {
+            Request request = null;
+            try
+            {
+                // Parse the incoming message
+                request = JsonConvert.DeserializeObject<Request>(json);
+                if (request == null || request.Type != "request")
+                {
+                    Trace.Warning($"Received non-request message: {json}");
+                    return;
+                }
+
+                Trace.Info($"Received request: seq={request.Seq}, command={request.Command}");
+
+                // Dispatch to session for handling
+                if (_session == null)
+                {
+                    Trace.Error("No debug session configured");
+                    SendErrorResponse(request, "No debug session configured");
+                    return;
+                }
+
+                var response = await _session.HandleRequestAsync(request);
+                response.RequestSeq = request.Seq;
+                response.Command = request.Command;
+                response.Type = "response";
+
+                lock (_sendLock)
+                {
+                    response.Seq = _nextSeq++;
+                    SendMessageInternal(response);
+                }
+
+                Trace.Info($"Sent response: seq={response.Seq}, command={response.Command}, success={response.Success}");
+            }
+            catch (JsonException ex)
+            {
+                Trace.Error($"Failed to parse request: {ex.Message}");
+                Trace.Error($"JSON: {json}");
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Error processing request: {ex}");
+                if (request != null)
+                {
+                    SendErrorResponse(request, ex.Message);
+                }
+            }
+        }
+
+        private void SendErrorResponse(Request request, string message)
+        {
+            var response = new Response
+            {
+                Type = "response",
+                RequestSeq = request.Seq,
+                Command = request.Command,
+                Success = false,
+                Message = message,
+                Body = new ErrorResponseBody
+                {
+                    Error = new Message
+                    {
+                        Id = 1,
+                        Format = message,
+                        ShowUser = true
+                    }
+                }
+            };
+
+            lock (_sendLock)
+            {
+                response.Seq = _nextSeq++;
+                SendMessageInternal(response);
+            }
+        }
+
+        /// <summary>
+        /// Reads a DAP message from the stream.
+        /// DAP uses HTTP-like message framing: Content-Length: N\r\n\r\n{json}
+        /// </summary>
+        private async Task<string> ReadMessageAsync(CancellationToken cancellationToken)
+        {
+            // Read headers until we find Content-Length
+            var headerBuilder = new StringBuilder();
+            int contentLength = -1;
+
+            while (true)
+            {
+                var line = await ReadLineAsync(cancellationToken);
+                if (line == null)
+                {
+                    // End of stream
+                    return null;
+                }
+
+                if (line.Length == 0)
+                {
+                    // Empty line marks end of headers
+                    break;
+                }
+
+                headerBuilder.AppendLine(line);
+
+                if (line.StartsWith(ContentLengthHeader, StringComparison.OrdinalIgnoreCase))
+                {
+                    var lengthStr = line.Substring(ContentLengthHeader.Length).Trim();
+                    if (!int.TryParse(lengthStr, out contentLength))
+                    {
+                        throw new InvalidDataException($"Invalid Content-Length: {lengthStr}");
+                    }
+                }
+            }
+
+            if (contentLength < 0)
+            {
+                throw new InvalidDataException("Missing Content-Length header");
+            }
+
+            // Read the JSON body
+            var buffer = new byte[contentLength];
+            var totalRead = 0;
+            while (totalRead < contentLength)
+            {
+                var bytesRead = await _stream.ReadAsync(buffer, totalRead, contentLength - totalRead, cancellationToken);
+                if (bytesRead == 0)
+                {
+                    throw new EndOfStreamException("Connection closed while reading message body");
+                }
+                totalRead += bytesRead;
+            }
+
+            var json = Encoding.UTF8.GetString(buffer);
+            Trace.Verbose($"Received: {json}");
+            return json;
+        }
+
+        /// <summary>
+        /// Reads a line from the stream (terminated by \r\n).
+        /// </summary>
+        private async Task<string> ReadLineAsync(CancellationToken cancellationToken)
+        {
+            var lineBuilder = new StringBuilder();
+            var buffer = new byte[1];
+            var previousWasCr = false;
+
+            while (true)
+            {
+                var bytesRead = await _stream.ReadAsync(buffer, 0, 1, cancellationToken);
+                if (bytesRead == 0)
+                {
+                    // End of stream
+                    return lineBuilder.Length > 0 ? lineBuilder.ToString() : null;
+                }
+
+                var c = (char)buffer[0];
+
+                if (c == '\n' && previousWasCr)
+                {
+                    // Found \r\n, return the line (without the \r)
+                    if (lineBuilder.Length > 0 && lineBuilder[lineBuilder.Length - 1] == '\r')
+                    {
+                        lineBuilder.Length--;
+                    }
+                    return lineBuilder.ToString();
+                }
+
+                previousWasCr = (c == '\r');
+                lineBuilder.Append(c);
+            }
+        }
+
+        /// <summary>
+        /// Sends a DAP message to the stream with Content-Length framing.
+        /// Must be called within the _sendLock.
+        /// </summary>
+        private void SendMessageInternal(ProtocolMessage message)
+        {
+            var json = JsonConvert.SerializeObject(message, new JsonSerializerSettings
+            {
+                NullValueHandling = NullValueHandling.Ignore
+            });
+
+            var bodyBytes = Encoding.UTF8.GetBytes(json);
+            var header = $"Content-Length: {bodyBytes.Length}\r\n\r\n";
+            var headerBytes = Encoding.UTF8.GetBytes(header);
+
+            _stream.Write(headerBytes, 0, headerBytes.Length);
+            _stream.Write(bodyBytes, 0, bodyBytes.Length);
+            _stream.Flush();
+
+            Trace.Verbose($"Sent: {json}");
+        }
+
+        public void Dispose()
+        {
+            Dispose(true);
+            GC.SuppressFinalize(this);
+        }
+
+        private void Dispose(bool disposing)
+        {
+            if (_disposed)
+            {
+                return;
+            }
+
+            if (disposing)
+            {
+                _cts?.Cancel();
+                _stream?.Dispose();
+                _client?.Dispose();
+                _listener?.Stop();
+                _cts?.Dispose();
+            }
+
+            _disposed = true;
+        }
+    }
+}
--- a/src/Runner.Worker/Dap/DapVariableProvider.cs
+++ b/src/Runner.Worker/Dap/DapVariableProvider.cs
@@ -0,0 +1,293 @@
+using System;
+using System.Collections.Generic;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.Runner.Common;
+
+namespace GitHub.Runner.Worker.Dap
+{
+    /// <summary>
+    /// Provides DAP variable information from the execution context.
+    /// Maps workflow contexts (github, env, runner, job, steps, secrets) to DAP scopes and variables.
+    /// </summary>
+    public sealed class DapVariableProvider
+    {
+        // Well-known scope names that map to top-level contexts
+        private static readonly string[] ScopeNames = { "github", "env", "runner", "job", "steps", "secrets", "inputs", "vars", "matrix", "needs" };
+
+        // Reserved variable reference ranges for scopes (1-100)
+        private const int ScopeReferenceBase = 1;
+        private const int ScopeReferenceMax = 100;
+
+        // Dynamic variable references start after scope range
+        private const int DynamicReferenceBase = 101;
+
+        private readonly IHostContext _hostContext;
+        private readonly Dictionary<int, (PipelineContextData Data, string Path)> _variableReferences = new();
+        private int _nextVariableReference = DynamicReferenceBase;
+
+        public DapVariableProvider(IHostContext hostContext)
+        {
+            _hostContext = hostContext;
+        }
+
+        /// <summary>
+        /// Resets the variable reference state. Call this when the execution context changes.
+        /// </summary>
+        public void Reset()
+        {
+            _variableReferences.Clear();
+            _nextVariableReference = DynamicReferenceBase;
+        }
+
+        /// <summary>
+        /// Gets the list of scopes for a given execution context.
+        /// Each scope represents a top-level context like 'github', 'env', etc.
+        /// </summary>
+        public List<Scope> GetScopes(IExecutionContext context, int frameId)
+        {
+            var scopes = new List<Scope>();
+
+            if (context?.ExpressionValues == null)
+            {
+                return scopes;
+            }
+
+            for (int i = 0; i < ScopeNames.Length; i++)
+            {
+                var scopeName = ScopeNames[i];
+                if (context.ExpressionValues.TryGetValue(scopeName, out var value) && value != null)
+                {
+                    var variablesRef = ScopeReferenceBase + i;
+                    var scope = new Scope
+                    {
+                        Name = scopeName,
+                        VariablesReference = variablesRef,
+                        Expensive = false,
+                        // Secrets get a special presentation hint
+                        PresentationHint = scopeName == "secrets" ? "registers" : null
+                    };
+
+                    // Count named variables if it's a dictionary
+                    if (value is DictionaryContextData dict)
+                    {
+                        scope.NamedVariables = dict.Count;
+                    }
+                    else if (value is CaseSensitiveDictionaryContextData csDict)
+                    {
+                        scope.NamedVariables = csDict.Count;
+                    }
+
+                    scopes.Add(scope);
+                }
+            }
+
+            return scopes;
+        }
+
+        /// <summary>
+        /// Gets variables for a given variable reference.
+        /// </summary>
+        public List<Variable> GetVariables(IExecutionContext context, int variablesReference)
+        {
+            var variables = new List<Variable>();
+
+            if (context?.ExpressionValues == null)
+            {
+                return variables;
+            }
+
+            PipelineContextData data = null;
+            string basePath = null;
+            bool isSecretsScope = false;
+
+            // Check if this is a scope reference (1-100)
+            if (variablesReference >= ScopeReferenceBase && variablesReference <= ScopeReferenceMax)
+            {
+                var scopeIndex = variablesReference - ScopeReferenceBase;
+                if (scopeIndex < ScopeNames.Length)
+                {
+                    var scopeName = ScopeNames[scopeIndex];
+                    isSecretsScope = scopeName == "secrets";
+                    if (context.ExpressionValues.TryGetValue(scopeName, out data))
+                    {
+                        basePath = scopeName;
+                    }
+                }
+            }
+            // Check dynamic references
+            else if (_variableReferences.TryGetValue(variablesReference, out var refData))
+            {
+                data = refData.Data;
+                basePath = refData.Path;
+                // Check if we're inside the secrets scope
+                isSecretsScope = basePath?.StartsWith("secrets", StringComparison.OrdinalIgnoreCase) == true;
+            }
+
+            if (data == null)
+            {
+                return variables;
+            }
+
+            // Convert the data to variables
+            ConvertToVariables(data, basePath, isSecretsScope, variables);
+
+            return variables;
+        }
+
+        /// <summary>
+        /// Converts PipelineContextData to DAP Variable objects.
+        /// </summary>
+        private void ConvertToVariables(PipelineContextData data, string basePath, bool isSecretsScope, List<Variable> variables)
+        {
+            switch (data)
+            {
+                case DictionaryContextData dict:
+                    ConvertDictionaryToVariables(dict, basePath, isSecretsScope, variables);
+                    break;
+
+                case CaseSensitiveDictionaryContextData csDict:
+                    ConvertCaseSensitiveDictionaryToVariables(csDict, basePath, isSecretsScope, variables);
+                    break;
+
+                case ArrayContextData array:
+                    ConvertArrayToVariables(array, basePath, isSecretsScope, variables);
+                    break;
+
+                default:
+                    // Scalar value - shouldn't typically get here for a container
+                    break;
+            }
+        }
+
+        private void ConvertDictionaryToVariables(DictionaryContextData dict, string basePath, bool isSecretsScope, List<Variable> variables)
+        {
+            foreach (var pair in dict)
+            {
+                var variable = CreateVariable(pair.Key, pair.Value, basePath, isSecretsScope);
+                variables.Add(variable);
+            }
+        }
+
+        private void ConvertCaseSensitiveDictionaryToVariables(CaseSensitiveDictionaryContextData dict, string basePath, bool isSecretsScope, List<Variable> variables)
+        {
+            foreach (var pair in dict)
+            {
+                var variable = CreateVariable(pair.Key, pair.Value, basePath, isSecretsScope);
+                variables.Add(variable);
+            }
+        }
+
+        private void ConvertArrayToVariables(ArrayContextData array, string basePath, bool isSecretsScope, List<Variable> variables)
+        {
+            for (int i = 0; i < array.Count; i++)
+            {
+                var item = array[i];
+                var variable = CreateVariable($"[{i}]", item, basePath, isSecretsScope);
+                variable.Name = $"[{i}]";
+                variables.Add(variable);
+            }
+        }
+
+        private Variable CreateVariable(string name, PipelineContextData value, string basePath, bool isSecretsScope)
+        {
+            var childPath = string.IsNullOrEmpty(basePath) ? name : $"{basePath}.{name}";
+            var variable = new Variable
+            {
+                Name = name,
+                EvaluateName = $"${{{{ {childPath} }}}}"
+            };
+
+            if (value == null)
+            {
+                variable.Value = "null";
+                variable.Type = "null";
+                variable.VariablesReference = 0;
+                return variable;
+            }
+
+            switch (value)
+            {
+                case StringContextData str:
+                    if (isSecretsScope)
+                    {
+                        // Always mask secrets regardless of value
+                        variable.Value = "[REDACTED]";
+                    }
+                    else
+                    {
+                        // Mask any secret values that might be in non-secret contexts
+                        variable.Value = MaskSecrets(str.Value);
+                    }
+                    variable.Type = "string";
+                    variable.VariablesReference = 0;
+                    break;
+
+                case NumberContextData num:
+                    variable.Value = num.ToString();
+                    variable.Type = "number";
+                    variable.VariablesReference = 0;
+                    break;
+
+                case BooleanContextData boolVal:
+                    variable.Value = boolVal.Value ? "true" : "false";
+                    variable.Type = "boolean";
+                    variable.VariablesReference = 0;
+                    break;
+
+                case DictionaryContextData dict:
+                    variable.Value = $"Object ({dict.Count} properties)";
+                    variable.Type = "object";
+                    variable.VariablesReference = RegisterVariableReference(dict, childPath);
+                    variable.NamedVariables = dict.Count;
+                    break;
+
+                case CaseSensitiveDictionaryContextData csDict:
+                    variable.Value = $"Object ({csDict.Count} properties)";
+                    variable.Type = "object";
+                    variable.VariablesReference = RegisterVariableReference(csDict, childPath);
+                    variable.NamedVariables = csDict.Count;
+                    break;
+
+                case ArrayContextData array:
+                    variable.Value = $"Array ({array.Count} items)";
+                    variable.Type = "array";
+                    variable.VariablesReference = RegisterVariableReference(array, childPath);
+                    variable.IndexedVariables = array.Count;
+                    break;
+
+                default:
+                    // Unknown type - convert to string representation
+                    var rawValue = value.ToJToken()?.ToString() ?? "unknown";
+                    variable.Value = MaskSecrets(rawValue);
+                    variable.Type = value.GetType().Name;
+                    variable.VariablesReference = 0;
+                    break;
+            }
+
+            return variable;
+        }
+
+        /// <summary>
+        /// Registers a nested variable reference and returns its ID.
+        /// </summary>
+        private int RegisterVariableReference(PipelineContextData data, string path)
+        {
+            var reference = _nextVariableReference++;
+            _variableReferences[reference] = (data, path);
+            return reference;
+        }
+
+        /// <summary>
+        /// Masks any secret values in the string using the host context's secret masker.
+        /// </summary>
+        private string MaskSecrets(string value)
+        {
+            if (string.IsNullOrEmpty(value))
+            {
+                return value ?? string.Empty;
+            }
+
+            return _hostContext.SecretMasker.MaskSecrets(value);
+        }
+    }
+}
--- a/src/Runner.Worker/FeatureManager.cs
+++ b/src/Runner.Worker/FeatureManager.cs
@@ -11,10 +11,5 @@ namespace GitHub.Runner.Worker
            var isContainerHooksPathSet = !string.IsNullOrEmpty(Environment.GetEnvironmentVariable(Constants.Hooks.ContainerHooksPath));
            return isContainerHookFeatureFlagSet && isContainerHooksPathSet;
        }
-
-        public static bool IsContainerActionRunnerTempEnabled(Variables variables)
-        {
-            return variables?.GetBoolean(Constants.Runner.Features.ContainerActionRunnerTemp) ?? false;
-        }
    }
 }
--- a/src/Runner.Worker/Handlers/ContainerActionHandler.cs
+++ b/src/Runner.Worker/Handlers/ContainerActionHandler.cs
@@ -191,19 +191,13 @@ namespace GitHub.Runner.Worker.Handlers
            ArgUtil.Directory(tempWorkflowDirectory, nameof(tempWorkflowDirectory));

            container.MountVolumes.Add(new MountVolume("/var/run/docker.sock", "/var/run/docker.sock"));
-            if (FeatureManager.IsContainerActionRunnerTempEnabled(ExecutionContext.Global.Variables))
-            {
-                container.MountVolumes.Add(new MountVolume(tempDirectory, "/github/runner_temp"));
-            }
+            container.MountVolumes.Add(new MountVolume(tempDirectory, "/github/runner_temp"));
            container.MountVolumes.Add(new MountVolume(tempHomeDirectory, "/github/home"));
            container.MountVolumes.Add(new MountVolume(tempWorkflowDirectory, "/github/workflow"));
            container.MountVolumes.Add(new MountVolume(tempFileCommandDirectory, "/github/file_commands"));
            container.MountVolumes.Add(new MountVolume(defaultWorkingDirectory, "/github/workspace"));

-            if (FeatureManager.IsContainerActionRunnerTempEnabled(ExecutionContext.Global.Variables))
-            {
-                container.AddPathTranslateMapping(tempDirectory, "/github/runner_temp");
-            }
+            container.AddPathTranslateMapping(tempDirectory, "/github/runner_temp");
            container.AddPathTranslateMapping(tempHomeDirectory, "/github/home");
            container.AddPathTranslateMapping(tempWorkflowDirectory, "/github/workflow");
            container.AddPathTranslateMapping(tempFileCommandDirectory, "/github/file_commands");
@@ -245,6 +239,14 @@ namespace GitHub.Runner.Worker.Handlers
                Environment["ACTIONS_RESULTS_URL"] = resultsUrl;
            }

+            if (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.SetOrchestrationIdEnvForActions) ?? false)
+            {
+                if (ExecutionContext.Global.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out var orchestrationId) && !string.IsNullOrEmpty(orchestrationId))
+                {
+                    Environment["ACTIONS_ORCHESTRATION_ID"] = orchestrationId;
+                }
+            }
+
            foreach (var variable in this.Environment)
            {
                container.ContainerEnvironmentVariables[variable.Key] = container.TranslateToContainerPath(variable.Value);
--- a/src/Runner.Worker/Handlers/NodeScriptActionHandler.cs
+++ b/src/Runner.Worker/Handlers/NodeScriptActionHandler.cs
@@ -77,6 +77,14 @@ namespace GitHub.Runner.Worker.Handlers
                Environment["ACTIONS_CACHE_SERVICE_V2"] = bool.TrueString;
            }

+            if (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.SetOrchestrationIdEnvForActions) ?? false)
+            {
+                if (ExecutionContext.Global.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out var orchestrationId) && !string.IsNullOrEmpty(orchestrationId))
+                {
+                    Environment["ACTIONS_ORCHESTRATION_ID"] = orchestrationId;
+                }
+            }
+
            // Resolve the target script.
            string target = null;
            if (stage == ActionRunStage.Main)
--- a/src/Runner.Worker/Handlers/ScriptHandler.cs
+++ b/src/Runner.Worker/Handlers/ScriptHandler.cs
@@ -318,6 +318,14 @@ namespace GitHub.Runner.Worker.Handlers
                Environment["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = systemConnection.Authorization.Parameters[EndpointAuthorizationParameters.AccessToken];
            }

+            if (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.SetOrchestrationIdEnvForActions) ?? false)
+            {
+                if (ExecutionContext.Global.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out var orchestrationId) && !string.IsNullOrEmpty(orchestrationId))
+                {
+                    Environment["ACTIONS_ORCHESTRATION_ID"] = orchestrationId;
+                }
+            }
+
            ExecutionContext.Debug($"{fileName} {arguments}");

            Inputs.TryGetValue("standardInInput", out var standardInInput);
--- a/src/Runner.Worker/JobExtension.cs
+++ b/src/Runner.Worker/JobExtension.cs
@@ -112,6 +112,13 @@ namespace GitHub.Runner.Worker
                                            groupName = "Machine Setup Info";
                                        }

+                                        // not output internal groups
+                                        if (groupName.StartsWith("_internal_", StringComparison.OrdinalIgnoreCase))
+                                        {
+                                            jobContext.Global.JobTelemetry.Add(new JobTelemetry() { Type = JobTelemetryType.General, Message = info.Detail });
+                                            continue;
+                                        }
+
                                        context.Output($"##[group]{groupName}");
                                        var multiLines = info.Detail.Replace("\r\n", "\n").TrimEnd('\n').Split('\n');
                                        foreach (var line in multiLines)
--- a/src/Runner.Worker/JobRunner.cs
+++ b/src/Runner.Worker/JobRunner.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -13,6 +13,7 @@ using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker.Dap;
 using GitHub.Services.Common;
 using GitHub.Services.WebApi;
 using Sdk.RSWebApi.Contracts;
@@ -112,6 +113,7 @@ namespace GitHub.Runner.Worker

            IExecutionContext jobContext = null;
            CancellationTokenRegistration? runnerShutdownRegistration = null;
+            IDapServer dapServer = null;
            try
            {
                // Create the job execution context.
@@ -159,6 +161,47 @@ namespace GitHub.Runner.Worker
                if (jobContext.Global.WriteDebug)
                {
                    jobContext.SetRunnerContext("debug", "1");
+
+                    // Start DAP server for interactive debugging
+                    // This allows debugging workflow jobs with DAP-compatible editors (nvim-dap, VS Code, etc.)
+                    try
+                    {
+                        var port = 4711;
+                        var portEnv = Environment.GetEnvironmentVariable("ACTIONS_DAP_PORT");
+                        if (!string.IsNullOrEmpty(portEnv) && int.TryParse(portEnv, out var customPort))
+                        {
+                            port = customPort;
+                        }
+
+                        dapServer = HostContext.GetService<IDapServer>();
+                        var debugSession = HostContext.GetService<IDapDebugSession>();
+
+                        // Wire up the server and session
+                        dapServer.SetSession(debugSession);
+                        debugSession.SetDapServer(dapServer);
+
+                        await dapServer.StartAsync(port, jobRequestCancellationToken);
+                        Trace.Info($"DAP server listening on port {port}");
+                        jobContext.Output($"DAP debugger waiting for connection on port {port}...");
+                        jobContext.Output($"Connect your DAP client (nvim-dap, VS Code, etc.) to attach to this job.");
+
+                        // Block until debugger connects
+                        await dapServer.WaitForConnectionAsync(jobRequestCancellationToken);
+                        Trace.Info("DAP client connected, continuing job execution");
+                        jobContext.Output("Debugger connected. Job execution will pause before each step.");
+                    }
+                    catch (OperationCanceledException)
+                    {
+                        // Job was cancelled before debugger connected
+                        Trace.Info("Job cancelled while waiting for DAP client connection");
+                    }
+                    catch (Exception ex)
+                    {
+                        // Log but don't fail the job if DAP server fails to start
+                        Trace.Warning($"Failed to start DAP server: {ex.Message}");
+                        jobContext.Warning($"DAP debugging unavailable: {ex.Message}");
+                        dapServer = null;
+                    }
                }

                jobContext.SetRunnerContext("os", VarUtil.OS);
@@ -259,6 +302,20 @@ namespace GitHub.Runner.Worker
                    runnerShutdownRegistration = null;
                }

+                // Stop DAP server if it was started
+                if (dapServer != null)
+                {
+                    try
+                    {
+                        Trace.Info("Stopping DAP server");
+                        await dapServer.StopAsync();
+                    }
+                    catch (Exception ex)
+                    {
+                        Trace.Warning($"Error stopping DAP server: {ex.Message}");
+                    }
+                }
+
                await ShutdownQueue(throwOnFailure: false);
            }
        }
--- a/src/Runner.Worker/StepsRunner.cs
+++ b/src/Runner.Worker/StepsRunner.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
@@ -10,6 +10,7 @@ using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker.Dap;
 using GitHub.Runner.Worker.Expressions;

 namespace GitHub.Runner.Worker
@@ -50,6 +51,12 @@ namespace GitHub.Runner.Worker
            jobContext.JobContext.Status = (jobContext.Result ?? TaskResult.Succeeded).ToActionResult();
            var scopeInputs = new Dictionary<string, PipelineContextData>(StringComparer.OrdinalIgnoreCase);
            bool checkPostJobActions = false;
+
+            // Get debug session for DAP debugging support
+            // The session's IsActive property determines if debugging is actually enabled
+            var debugSession = HostContext.GetService<IDapDebugSession>();
+            bool isFirstStep = true;
+
            while (jobContext.JobSteps.Count > 0 || !checkPostJobActions)
            {
                if (jobContext.JobSteps.Count == 0 && !checkPostJobActions)
@@ -181,6 +188,14 @@ namespace GitHub.Runner.Worker
                            }
                        }

+                        // Pause for DAP debugger BEFORE step execution
+                        // This happens after expression values are set up so the debugger can inspect variables
+                        if (debugSession?.IsActive == true)
+                        {
+                            await debugSession.OnStepStartingAsync(step, jobContext, isFirstStep);
+                            isFirstStep = false;
+                        }
+
                        // Evaluate condition
                        step.ExecutionContext.Debug($"Evaluating condition for step: '{step.DisplayName}'");
                        var conditionTraceWriter = new ConditionTraceWriter(Trace, step.ExecutionContext);
@@ -253,8 +268,17 @@ namespace GitHub.Runner.Worker
                    Trace.Info($"No need for updating job result with current step result '{step.ExecutionContext.Result}'.");
                }

+                // Notify DAP debugger AFTER step execution
+                if (debugSession?.IsActive == true)
+                {
+                    debugSession.OnStepCompleted(step);
+                }
+
                Trace.Info($"Current state: job state = '{jobContext.Result}'");
            }
+
+            // Notify DAP debugger that the job has completed
+            debugSession?.OnJobCompleted();
        }

        private async Task RunStepAsync(IStep step, CancellationToken jobCancellationToken)
--- a/src/Sdk/DTExpressions2/Expressions2/ExpressionConstants.cs
+++ b/src/Sdk/DTExpressions2/Expressions2/ExpressionConstants.cs
@@ -9,6 +9,7 @@ namespace GitHub.DistributedTask.Expressions2
    {
        static ExpressionConstants()
        {
+            AddFunction<Case>("case", 3, Byte.MaxValue);
            AddFunction<Contains>("contains", 2, 2);
            AddFunction<EndsWith>("endsWith", 2, 2);
            AddFunction<Format>("format", 1, Byte.MaxValue);
--- a/src/Sdk/DTExpressions2/Expressions2/ExpressionParser.cs
+++ b/src/Sdk/DTExpressions2/Expressions2/ExpressionParser.cs
@@ -17,9 +17,10 @@ namespace GitHub.DistributedTask.Expressions2
            String expression,
            ITraceWriter trace,
            IEnumerable<INamedValueInfo> namedValues,
-            IEnumerable<IFunctionInfo> functions)
+            IEnumerable<IFunctionInfo> functions,
+            Boolean allowCaseFunction = true)
        {
-            var context = new ParseContext(expression, trace, namedValues, functions);
+            var context = new ParseContext(expression, trace, namedValues, functions, allowCaseFunction);
            context.Trace.Info($"Parsing expression: <{expression}>");
            return CreateTree(context);
        }
@@ -349,6 +350,10 @@ namespace GitHub.DistributedTask.Expressions2
            {
                throw new ParseException(ParseExceptionKind.TooManyParameters, token: @operator, expression: context.Expression);
            }
+            else if (functionInfo.Name.Equals("case", StringComparison.OrdinalIgnoreCase) && function.Parameters.Count % 2 == 0)
+            {
+                throw new ParseException(ParseExceptionKind.EvenParameters, token: @operator, expression: context.Expression);
+            }
        }

        /// <summary>
@@ -411,6 +416,12 @@ namespace GitHub.DistributedTask.Expressions2
            String name,
            out IFunctionInfo functionInfo)
        {
+            if (String.Equals(name, "case", StringComparison.OrdinalIgnoreCase) && !context.AllowCaseFunction)
+            {
+                functionInfo = null;
+                return false;
+            }
+
            return ExpressionConstants.WellKnownFunctions.TryGetValue(name, out functionInfo) ||
                context.ExtensionFunctions.TryGetValue(name, out functionInfo);
        }
@@ -418,6 +429,7 @@ namespace GitHub.DistributedTask.Expressions2
        private sealed class ParseContext
        {
            public Boolean AllowUnknownKeywords;
+            public Boolean AllowCaseFunction;
            public readonly String Expression;
            public readonly Dictionary<String, IFunctionInfo> ExtensionFunctions = new Dictionary<String, IFunctionInfo>(StringComparer.OrdinalIgnoreCase);
            public readonly Dictionary<String, INamedValueInfo> ExtensionNamedValues = new Dictionary<String, INamedValueInfo>(StringComparer.OrdinalIgnoreCase);
@@ -433,7 +445,8 @@ namespace GitHub.DistributedTask.Expressions2
                ITraceWriter trace,
                IEnumerable<INamedValueInfo> namedValues,
                IEnumerable<IFunctionInfo> functions,
-                Boolean allowUnknownKeywords = false)
+                Boolean allowUnknownKeywords = false,
+                Boolean allowCaseFunction = true)
            {
                Expression = expression ?? String.Empty;
                if (Expression.Length > ExpressionConstants.MaxLength)
@@ -454,6 +467,7 @@ namespace GitHub.DistributedTask.Expressions2

                LexicalAnalyzer = new LexicalAnalyzer(Expression);
                AllowUnknownKeywords = allowUnknownKeywords;
+                AllowCaseFunction = allowCaseFunction;
            }

            private class NoOperationTraceWriter : ITraceWriter
--- a/src/Sdk/DTExpressions2/Expressions2/ParseException.cs
+++ b/src/Sdk/DTExpressions2/Expressions2/ParseException.cs
@@ -29,6 +29,9 @@ namespace GitHub.DistributedTask.Expressions2
                case ParseExceptionKind.TooManyParameters:
                    description = "Too many parameters supplied";
                    break;
+                case ParseExceptionKind.EvenParameters:
+                    description = "Even number of parameters supplied, requires an odd number of parameters";
+                    break;
                case ParseExceptionKind.UnexpectedEndOfExpression:
                    description = "Unexpected end of expression";
                    break;
--- a/src/Sdk/DTExpressions2/Expressions2/ParseExceptionKind.cs
+++ b/src/Sdk/DTExpressions2/Expressions2/ParseExceptionKind.cs
@@ -6,6 +6,7 @@
        ExceededMaxLength,
        TooFewParameters,
        TooManyParameters,
+        EvenParameters,
        UnexpectedEndOfExpression,
        UnexpectedSymbol,
        UnrecognizedFunction,
--- a/src/Sdk/DTExpressions2/Expressions2/Sdk/Functions/Case.cs
+++ b/src/Sdk/DTExpressions2/Expressions2/Sdk/Functions/Case.cs
@@ -0,0 +1,45 @@
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+
+using System;
+using GitHub.Actions.Expressions.Data;
+
+namespace GitHub.DistributedTask.Expressions2.Sdk.Functions
+{
+    internal sealed class Case : Function
+    {
+        protected sealed override Object EvaluateCore(
+            EvaluationContext context,
+            out ResultMemory resultMemory)
+        {
+            resultMemory = null;
+            // Validate argument count - must be odd (pairs of predicate-result plus default)
+            if (Parameters.Count % 2 == 0)
+            {
+                throw new InvalidOperationException("case requires an odd number of arguments");
+            }
+
+            // Evaluate predicate-result pairs
+            for (var i = 0; i < Parameters.Count - 1; i += 2)
+            {
+                var predicate = Parameters[i].Evaluate(context);
+
+                // Predicate must be a boolean
+                if (predicate.Kind != ValueKind.Boolean)
+                {
+                    throw new InvalidOperationException("case predicate must evaluate to a boolean value");
+                }
+
+                // If predicate is true, return the corresponding result
+                if ((Boolean)predicate.Value)
+                {
+                    var result = Parameters[i + 1].Evaluate(context);
+                    return result.Value;
+                }
+            }
+
+            // No predicate matched, return default (last argument)
+            var defaultResult = Parameters[Parameters.Count - 1].Evaluate(context);
+            return defaultResult.Value;
+        }
+    }
+}
--- a/src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateContext.cs
+++ b/src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateContext.cs
@@ -86,6 +86,12 @@ namespace GitHub.DistributedTask.ObjectTemplating

        internal ITraceWriter TraceWriter { get; set; }

+        /// <summary>
+        /// Gets or sets a value indicating whether the case expression function is allowed.
+        /// Defaults to true. Set to false to disable the case function.
+        /// </summary>
+        internal Boolean AllowCaseFunction { get; set; } = true;
+
        private IDictionary<String, Int32> FileIds
        {
            get
--- a/src/Sdk/DTObjectTemplating/ObjectTemplating/Tokens/TemplateToken.cs
+++ b/src/Sdk/DTObjectTemplating/ObjectTemplating/Tokens/TemplateToken.cs
@@ -57,7 +57,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
@@ -94,7 +94,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
@@ -123,7 +123,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
@@ -152,7 +152,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
--- a/src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConverter.cs
+++ b/src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConverter.cs
@@ -663,7 +663,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
            var node = default(ExpressionNode);
            try
            {
-                node = expressionParser.CreateTree(condition, null, namedValues, functions) as ExpressionNode;
+                node = expressionParser.CreateTree(condition, null, namedValues, functions, allowCaseFunction: context.AllowCaseFunction) as ExpressionNode;
            }
            catch (Exception ex)
            {
--- a/src/Sdk/Expressions/ExpressionConstants.cs
+++ b/src/Sdk/Expressions/ExpressionConstants.cs
@@ -10,6 +10,7 @@ namespace GitHub.Actions.Expressions
    {
        static ExpressionConstants()
        {
+            AddFunction<Case>("case", 3, Byte.MaxValue);
            AddFunction<Contains>("contains", 2, 2);
            AddFunction<EndsWith>("endsWith", 2, 2);
            AddFunction<Format>("format", 1, Byte.MaxValue);
--- a/src/Sdk/Expressions/ExpressionParser.cs
+++ b/src/Sdk/Expressions/ExpressionParser.cs
@@ -17,9 +17,10 @@ namespace GitHub.Actions.Expressions
            String expression,
            ITraceWriter trace,
            IEnumerable<INamedValueInfo> namedValues,
-            IEnumerable<IFunctionInfo> functions)
+            IEnumerable<IFunctionInfo> functions,
+            Boolean allowCaseFunction = true)
        {
-            var context = new ParseContext(expression, trace, namedValues, functions);
+            var context = new ParseContext(expression, trace, namedValues, functions, allowCaseFunction: allowCaseFunction);
            context.Trace.Info($"Parsing expression: <{expression}>");
            return CreateTree(context);
        }
@@ -349,6 +350,10 @@ namespace GitHub.Actions.Expressions
            {
                throw new ParseException(ParseExceptionKind.TooManyParameters, token: @operator, expression: context.Expression);
            }
+            else if (functionInfo.Name.Equals("case", StringComparison.OrdinalIgnoreCase) && function.Parameters.Count % 2 == 0)
+            {
+                throw new ParseException(ParseExceptionKind.EvenParameters, token: @operator, expression: context.Expression);
+            }
        }

        /// <summary>
@@ -411,6 +416,12 @@ namespace GitHub.Actions.Expressions
            String name,
            out IFunctionInfo functionInfo)
        {
+            if (String.Equals(name, "case", StringComparison.OrdinalIgnoreCase) && !context.AllowCaseFunction)
+            {
+                functionInfo = null;
+                return false;
+            }
+
            return ExpressionConstants.WellKnownFunctions.TryGetValue(name, out functionInfo) ||
                context.ExtensionFunctions.TryGetValue(name, out functionInfo);
        }
@@ -418,6 +429,7 @@ namespace GitHub.Actions.Expressions
        private sealed class ParseContext
        {
            public Boolean AllowUnknownKeywords;
+            public Boolean AllowCaseFunction;
            public readonly String Expression;
            public readonly Dictionary<String, IFunctionInfo> ExtensionFunctions = new Dictionary<String, IFunctionInfo>(StringComparer.OrdinalIgnoreCase);
            public readonly Dictionary<String, INamedValueInfo> ExtensionNamedValues = new Dictionary<String, INamedValueInfo>(StringComparer.OrdinalIgnoreCase);
@@ -433,7 +445,8 @@ namespace GitHub.Actions.Expressions
                ITraceWriter trace,
                IEnumerable<INamedValueInfo> namedValues,
                IEnumerable<IFunctionInfo> functions,
-                Boolean allowUnknownKeywords = false)
+                Boolean allowUnknownKeywords = false,
+                Boolean allowCaseFunction = true)
            {
                Expression = expression ?? String.Empty;
                if (Expression.Length > ExpressionConstants.MaxLength)
@@ -454,6 +467,7 @@ namespace GitHub.Actions.Expressions

                LexicalAnalyzer = new LexicalAnalyzer(Expression);
                AllowUnknownKeywords = allowUnknownKeywords;
+                AllowCaseFunction = allowCaseFunction;
            }

            private class NoOperationTraceWriter : ITraceWriter
@@ -468,4 +482,4 @@ namespace GitHub.Actions.Expressions
            }
        }
    }
-}
+}
--- a/src/Sdk/Expressions/ParseException.cs
+++ b/src/Sdk/Expressions/ParseException.cs
@@ -29,6 +29,9 @@ namespace GitHub.Actions.Expressions
                case ParseExceptionKind.TooManyParameters:
                    description = "Too many parameters supplied";
                    break;
+                case ParseExceptionKind.EvenParameters:
+                    description = "Even number of parameters supplied, requires an odd number of parameters";
+                    break;
                case ParseExceptionKind.UnexpectedEndOfExpression:
                    description = "Unexpected end of expression";
                    break;
--- a/src/Sdk/Expressions/ParseExceptionKind.cs
+++ b/src/Sdk/Expressions/ParseExceptionKind.cs
@@ -6,6 +6,7 @@ namespace GitHub.Actions.Expressions
        ExceededMaxLength,
        TooFewParameters,
        TooManyParameters,
+        EvenParameters,
        UnexpectedEndOfExpression,
        UnexpectedSymbol,
        UnrecognizedFunction,
--- a/src/Sdk/Expressions/Sdk/Functions/Case.cs
+++ b/src/Sdk/Expressions/Sdk/Functions/Case.cs
@@ -0,0 +1,45 @@
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+
+using System;
+using GitHub.Actions.Expressions.Data;
+
+namespace GitHub.Actions.Expressions.Sdk.Functions
+{
+    internal sealed class Case : Function
+    {
+        protected sealed override Object EvaluateCore(
+            EvaluationContext context,
+            out ResultMemory resultMemory)
+        {
+            resultMemory = null;
+            // Validate argument count - must be odd (pairs of predicate-result plus default)
+            if (Parameters.Count % 2 == 0)
+            {
+                throw new InvalidOperationException("case requires an odd number of arguments");
+            }
+
+            // Evaluate predicate-result pairs
+            for (var i = 0; i < Parameters.Count - 1; i += 2)
+            {
+                var predicate = Parameters[i].Evaluate(context);
+
+                // Predicate must be a boolean
+                if (predicate.Kind != ValueKind.Boolean)
+                {
+                    throw new InvalidOperationException("case predicate must evaluate to a boolean value");
+                }
+
+                // If predicate is true, return the corresponding result
+                if ((Boolean)predicate.Value)
+                {
+                    var result = Parameters[i + 1].Evaluate(context);
+                    return result.Value;
+                }
+            }
+
+            // No predicate matched, return default (last argument)
+            var defaultResult = Parameters[Parameters.Count - 1].Evaluate(context);
+            return defaultResult.Value;
+        }
+    }
+}
--- a/src/Sdk/Sdk.csproj
+++ b/src/Sdk/Sdk.csproj
@@ -18,7 +18,7 @@
    </ItemGroup>

    <ItemGroup>
-        <PackageReference Include="Azure.Storage.Blobs" Version="12.26.0" />
+        <PackageReference Include="Azure.Storage.Blobs" Version="12.27.0" />
        <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
        <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
        <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
--- a/src/Sdk/WorkflowParser/Conversion/WorkflowTemplateConverter.cs
+++ b/src/Sdk/WorkflowParser/Conversion/WorkflowTemplateConverter.cs
@@ -1775,7 +1775,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
            var node = default(ExpressionNode);
            try
            {
-                node = expressionParser.CreateTree(condition, null, namedValues, functions) as ExpressionNode;
+                node = expressionParser.CreateTree(condition, null, namedValues, functions, allowCaseFunction: context.AllowCaseFunction) as ExpressionNode;
            }
            catch (Exception ex)
            {
--- a/src/Sdk/WorkflowParser/ObjectTemplating/TemplateContext.cs
+++ b/src/Sdk/WorkflowParser/ObjectTemplating/TemplateContext.cs
@@ -113,6 +113,12 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating
        /// </summary>
        internal Boolean StrictJsonParsing { get; set; }

+        /// <summary>
+        /// Gets or sets a value indicating whether the case expression function is allowed.
+        /// Defaults to true. Set to false to disable the case function.
+        /// </summary>
+        internal Boolean AllowCaseFunction { get; set; } = true;
+
        internal ITraceWriter TraceWriter { get; set; }

        private IDictionary<String, Int32> FileIds
--- a/src/Sdk/WorkflowParser/ObjectTemplating/Tokens/TemplateToken.cs
+++ b/src/Sdk/WorkflowParser/ObjectTemplating/Tokens/TemplateToken.cs
@@ -55,7 +55,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
@@ -93,7 +93,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
@@ -123,7 +123,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
@@ -153,7 +153,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
            var originalBytes = context.Memory.CurrentBytes;
            try
            {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                var options = new EvaluationOptions
                {
                    MaxMemory = context.Memory.MaxBytes,
--- a/src/runnerversion
+++ b/src/runnerversion
@@ -1 +1 @@
-2.330.0
+2.331.0
Author	SHA1	Message	Date
Francesco Renzi	f45c5d0785	Fix expression parsing (partially)	2026-01-15 16:05:01 +00:00
Francesco Renzi	7e4f99337f	fix double output + masking	2026-01-15 13:52:24 +00:00
Francesco Renzi	186656e153	Phase 5 done	2026-01-14 21:24:59 +00:00
Francesco Renzi	2e02381901	phase 4 complete	2026-01-14 21:14:10 +00:00
Francesco Renzi	a55696a429	Phase 3 complete	2026-01-14 21:05:55 +00:00
Francesco Renzi	379ac038b2	Phase 2 done	2026-01-14 20:34:11 +00:00
Francesco Renzi	14e8e1f667	Phase 1 done	2026-01-14 20:21:52 +00:00
Allan Guigou	3f43560cb9	Prepare runner release 2.331.0 (#4190 )	2026-01-09 12:15:39 -05:00
dependabot[bot]	73f7dbb681	Bump Azure.Storage.Blobs from 12.26.0 to 12.27.0 (#4189 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-09 14:54:40 +00:00
dependabot[bot]	f554a6446d	Bump typescript from 5.9.2 to 5.9.3 in /src/Misc/expressionFunc/hashFiles (#4184 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2026-01-07 18:52:44 +00:00
Tingluo Huang	bdceac4ab3	Allow hosted VM report job telemetry via .setup_info file. (#4186 )	2026-01-07 13:27:22 -05:00
Tingluo Huang	3f1dd45172	Set ACTIONS_ORCHESTRATION_ID as env to actions. (#4178 ) Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>	2026-01-06 14:06:47 -05:00
dependabot[bot]	cf8f50b4d8	Bump actions/upload-artifact from 5 to 6 (#4157 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2025-12-21 08:31:15 +00:00
dependabot[bot]	2cf22c4858	Bump actions/download-artifact from 6 to 7 (#4155 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2025-12-18 23:52:35 +00:00
eric sciple	04d77df0c7	Cleanup feature flag actions_container_action_runner_temp (#4163 )	2025-12-18 14:53:43 -06:00
Allan Guigou	651077689d	Add support for case function (#4147 ) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2025-12-17 15:57:05 +00:00
Tingluo Huang	c96dcd4729	Bump docker image to use ubuntu 24.04 (#4018 )	2025-12-12 13:38:45 -05:00
github-actions[bot]	4b0058f15c	chore: update Node versions (#4149 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-12-12 14:57:21 +00:00
dependabot[bot]	87d1dfb798	Bump actions/checkout from 5 to 6 (#4130 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2025-12-12 11:00:47 +00:00
dependabot[bot]	c992a2b406	Bump actions/github-script from 7 to 8 (#4137 ) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Salman Chishti <salmanmkc@GitHub.com>	2025-12-12 10:54:38 +00:00
Tingluo Huang	b2204f1fab	Ensure safe_sleep tries alternative approaches (#4146 )	2025-12-11 09:53:50 -05:00
github-actions[bot]	f99c3e6ee8	chore: update Node versions (#4144 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-12-08 16:52:16 +00:00
Tingluo Huang	463496e4fb	Fix regex for validating runner version format (#4136 )	2025-11-24 10:30:33 -05:00
Tingluo Huang	3f9f6f3994	Update workflow around runner docker image. (#4133 )	2025-11-24 08:59:01 -05:00
github-actions[bot]	221f65874f	Update Docker to v29.0.2 and Buildx to v0.30.1 (#4135 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2025-11-24 11:37:28 +00:00
Nikola Jokic	9a21440691	Fix owner of /home/runner directory (#4132 )	2025-11-21 16:15:17 -05:00
@@ -1 +1 @@
 .330.0
 .331.0