chore: update Node versions (20: 20.20.1, 24: 24.14.0)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -1,10 +1,10 @@
 {
   "name": "Actions Runner Devcontainer",
-  "image": "mcr.microsoft.com/devcontainers/base:focal",
+  "image": "mcr.microsoft.com/devcontainers/base:noble",
   "features": {
-    "ghcr.io/devcontainers/features/docker-in-docker:1": {},
+    "ghcr.io/devcontainers/features/docker-in-docker:2": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.415"
+      "version": "8.0.418"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

.github/workflows/build.yml

@@ -14,6 +14,9 @@ on:
     paths-ignore:
     - '**.md'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -50,7 +53,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Build runner layout
     - name: Build & Layout Release
@@ -75,8 +78,53 @@ jobs:
     # Upload runner package tar.gz/zip as artifact
     - name: Publish Artifact
       if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: runner-package-${{ matrix.runtime }}
         path: |
           _package
+
+  docker:
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, ubuntu-24.04-arm ]
+        include:
+          - os: ubuntu-latest
+            docker_platform: linux/amd64
+          - os: ubuntu-24.04-arm
+            docker_platform: linux/arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Get latest runner version
+      id: latest_runner
+      uses: actions/github-script@v8
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const release = await github.rest.repos.getLatestRelease({
+            owner: 'actions',
+            repo: 'runner',
+          });
+          const version = release.data.tag_name.replace(/^v/, '');
+          core.setOutput('version', version);
+
+    - name: Setup Docker buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Build Docker image
+      uses: docker/build-push-action@v7
+      with:
+        context: ./images
+        load: true
+        platforms: ${{ matrix.docker_platform }}
+        tags: |
+          ${{ github.sha }}:latest
+        build-args: |
+          RUNNER_VERSION=${{ steps.latest_runner.outputs.version }}
+
+    - name: Test Docker image
+      run: |
+        docker run --rm ${{ github.sha }}:latest ./run.sh --version
+  

.github/workflows/codeql.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/dependency-check.yml

@@ -29,7 +29,7 @@ jobs:
       npm-vulnerabilities: ${{ steps.check-versions.outputs.npm-vulnerabilities }}
       open-dependency-prs: ${{ steps.check-prs.outputs.open-dependency-prs }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/docker-buildx-upgrade.yml

@@ -17,7 +17,7 @@ jobs:
       BUILDX_CURRENT_VERSION: ${{ steps.check_buildx_version.outputs.CURRENT_VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Check Docker version
         id: check_docker_version
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Update Docker version
         shell: bash

.github/workflows/docker-publish.yml

@@ -0,0 +1,75 @@
+name: Publish DockerImage from Release Branch
+
+on:
+  workflow_dispatch:
+    inputs:
+      releaseBranch:
+        description: 'Release Branch (releases/mXXX)'
+        required: true
+
+jobs:
+  publish-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    env:
+      REGISTRY: ghcr.io
+      IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.releaseBranch }}
+
+      - name: Compute image version
+        id: image
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const fs = require('fs');
+            const runnerVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '');
+            console.log(`Using runner version ${runnerVersion}`);
+            if (!/^\d+\.\d+\.\d+$/.test(runnerVersion)) {
+              throw new Error(`Invalid runner version: ${runnerVersion}`);
+            }
+            core.setOutput('version', runnerVersion);
+
+      - name: Setup Docker buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log into registry ${{ env.REGISTRY }}
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v7
+        with:
+          context: ./images
+          platforms: |
+            linux/amd64
+            linux/arm64
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.image.outputs.version }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          build-args: |
+            RUNNER_VERSION=${{ steps.image.outputs.version }}
+          push: true
+          labels: |
+            org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
+            org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
+
+      - name: Generate attestation
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.build-and-push.outputs.digest }}
+          push-to-registry: true

.github/workflows/dotnet-upgrade.yml

@@ -15,7 +15,7 @@ jobs:
       DOTNET_CURRENT_MAJOR_MINOR_VERSION: ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
       - name: Get current major minor version
         id: fetch_current_version
         shell: bash
@@ -89,7 +89,7 @@ jobs:
     if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
       - name: Create Pull Request

.github/workflows/node-upgrade.yml

@@ -9,7 +9,7 @@ jobs:
   update-node:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Get latest Node versions
         id: node-versions
         run: |

.github/workflows/npm-audit-typescript.yml

@@ -7,7 +7,7 @@ jobs:
   npm-audit-with-ts-fix:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Setup Node.js
         uses: actions/setup-node@v6
         with:

.github/workflows/npm-audit.yml

@@ -9,7 +9,7 @@ jobs:
   npm-audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       
       - name: Setup Node.js
         uses: actions/setup-node@v6

.github/workflows/release.yml

@@ -11,12 +11,12 @@ jobs:
     if: startsWith(github.ref, 'refs/heads/releases/') || github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Make sure ./releaseVersion match ./src/runnerversion
     # Query GitHub release ensure version is not used
     - name: Check version
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
@@ -86,7 +86,7 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Build runner layout
     - name: Build & Layout Release
@@ -118,7 +118,7 @@ jobs:
     # Upload runner package tar.gz/zip as artifact.
     - name: Publish Artifact
       if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         name: runner-packages-${{ matrix.runtime }}
         path: |
@@ -129,41 +129,41 @@ jobs:
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6
 
     # Download runner package tar.gz/zip produced by 'build' job
     - name: Download Artifact (win-x64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-win-x64
         path: ./
     - name: Download Artifact (win-arm64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-win-arm64
         path: ./
     - name: Download Artifact (osx-x64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-osx-x64
         path: ./
     - name: Download Artifact (osx-arm64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-osx-arm64
         path: ./
     - name: Download Artifact (linux-x64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-linux-x64
         path: ./
     - name: Download Artifact (linux-arm)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-linux-arm
         path: ./
     - name: Download Artifact (linux-arm64)
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: runner-packages-linux-arm64
         path: ./
@@ -171,7 +171,7 @@ jobs:
     # Create ReleaseNote file
     - name: Create ReleaseNote
       id: releaseNote
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@v8
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
@@ -296,11 +296,11 @@ jobs:
       IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Compute image version
         id: image
-        uses: actions/github-script@v8.0.0
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -309,10 +309,10 @@ jobs:
             core.setOutput('version', runnerVersion);
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -320,7 +320,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: ./images
           platforms: |
@@ -334,11 +334,12 @@ jobs:
           push: true
           labels: |
             org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
             org.opencontainers.image.licenses=MIT
+          annotations: |
+            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
 
       - name: Generate attestation
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@v4
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}

README.md

@@ -32,7 +32,7 @@ We are taking the following steps to better direct requests related to GitHub Ac
 
 2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
 
-3. Security Issues should be handled as per our [security.md](security.md)
+3. Security Issues should be handled as per our [SECURITY.md](https://github.com/actions/runner?tab=security-ov-file)
 
 We will still provide security updates for this project and fix major breaking changes during this time.
 

docs/start/envlinux.md

@@ -28,8 +28,8 @@ Debian based OS (Debian, Ubuntu, Linux Mint)
 - liblttng-ust1 or liblttng-ust0
 - libkrb5-3
 - zlib1g
-- libssl1.1, libssl1.0.2 or libssl1.0.0
-- libicu63, libicu60, libicu57 or libicu55
+- libssl3t64, libssl3, libssl1.1, libssl1.0.2 or libssl1.0.0
+- libicu76, libicu75, ..., libicu66, libicu65, libicu63, libicu60, libicu57, libicu55, or libicu52
 
 Fedora based OS (Fedora, Red Hat Enterprise Linux, CentOS, Oracle Linux 7)
 

images/Dockerfile

@@ -1,12 +1,12 @@
 # Source: https://github.com/dotnet/dotnet-docker
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy AS build
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble AS build
 
 ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=29.0.1
-ARG BUILDX_VERSION=0.30.0
+ARG DOCKER_VERSION=29.3.0
+ARG BUILDX_VERSION=0.32.1
 
 RUN apt update -y && apt install curl unzip -y
 
@@ -21,7 +21,7 @@ RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-c
     && unzip ./runner-container-hooks.zip -d ./k8s \
     && rm runner-container-hooks.zip
 
-RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.0/actions-runner-hooks-k8s-0.8.0.zip \
+RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v0.8.1/actions-runner-hooks-k8s-0.8.1.zip \
     && unzip ./runner-container-hooks.zip -d ./k8s-novolume \
     && rm runner-container-hooks.zip
 
@@ -33,15 +33,15 @@ RUN export RUNNER_ARCH=${TARGETARCH} \
     && rm -rf docker.tgz \
     && mkdir -p /usr/local/lib/docker/cli-plugins \
     && curl -fLo /usr/local/lib/docker/cli-plugins/docker-buildx \
-        "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
+    "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
     && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-noble
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV RUNNER_MANUALLY_TRAP_SIG=1
 ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
-ENV ImageOS=ubuntu22
+ENV ImageOS=ubuntu24
 
 # 'gpg-agent' and 'software-properties-common' are needed for the 'add-apt-repository' command that follows
 RUN apt update -y \
@@ -54,8 +54,6 @@ RUN add-apt-repository ppa:git-core/ppa \
     && apt install -y git \
     && rm -rf /var/lib/apt/lists/*
 
-WORKDIR /home/runner
-
 RUN adduser --disabled-password --gecos "" --uid 1001 runner \
     && groupadd docker --gid 123 \
     && usermod -aG sudo runner \
@@ -64,6 +62,8 @@ RUN adduser --disabled-password --gecos "" --uid 1001 runner \
     && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers \
     && chmod 777 /home/runner
 
+WORKDIR /home/runner
+
 COPY --chown=runner:docker --from=build /actions-runner .
 COPY --from=build /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-buildx
 

releaseNote.md

@@ -1,43 +1,35 @@
 ## What's Changed
-* Update safe_sleep.sh for bug when scheduler is paused for more than 1 second by @horner in https://github.com/actions/runner/pull/3157
-* Acknowledge runner request by @ericsciple in https://github.com/actions/runner/pull/3996
-* Update Docker to v28.3.3 and Buildx to v0.27.0 by @github-actions[bot] in https://github.com/actions/runner/pull/3999
-* Update dotnet sdk to latest version @8.0.413 by @github-actions[bot] in https://github.com/actions/runner/pull/4000
-* Bump actions/attest-build-provenance from 2 to 3 by @dependabot[bot] in https://github.com/actions/runner/pull/4002
-* Bump @typescript-eslint/eslint-plugin from 6.7.2 to 8.35.0 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/3920
-* Bump husky from 8.0.3 to 9.1.7 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/3842
-* Bump @vercel/ncc from 0.38.0 to 0.38.3 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/3841
-* Bump eslint-plugin-github from 4.10.0 to 4.10.2 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/3180
-* Bump typescript from 5.2.2 to 5.9.2 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/4007
-* chore: migrate Husky config from v8 to v9 format by @salmanmkc in https://github.com/actions/runner/pull/4003
-* Map RUNNER_TEMP for container action by @ericsciple in https://github.com/actions/runner/pull/4011
-* Break UseV2Flow into UseV2Flow and UseRunnerAdminFlow. by @TingluoHuang in https://github.com/actions/runner/pull/4013
-* Update Docker to v28.4.0 and Buildx to v0.28.0 by @github-actions[bot] in https://github.com/actions/runner/pull/4020
-* Bump node.js to latest version in runner. by @TingluoHuang in https://github.com/actions/runner/pull/4022
-* feat: add automated .NET dependency management workflow by @salmanmkc in https://github.com/actions/runner/pull/4028
-* feat: add automated Docker BuildX dependency management workflow by @salmanmkc in https://github.com/actions/runner/pull/4029
-* feat: add automated Node.js version management workflow by @salmanmkc in https://github.com/actions/runner/pull/4026
-* feat: add comprehensive NPM security management workflow by @salmanmkc in https://github.com/actions/runner/pull/4027
-* feat: add comprehensive dependency monitoring system by @salmanmkc in https://github.com/actions/runner/pull/4025
-* Use BrokerURL when using RunnerAdmin by @luketomlinson in https://github.com/actions/runner/pull/4044
-* Bump actions/github-script from 7.0.1 to 8.0.0 by @dependabot[bot] in https://github.com/actions/runner/pull/4016
-* Bump actions/stale from 9 to 10 by @dependabot[bot] in https://github.com/actions/runner/pull/4015
-* fix: prevent Node.js upgrade workflow from creating PRs with empty versions by @salmanmkc in https://github.com/actions/runner/pull/4055
-* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4057
-* Bump actions/setup-node from 4 to 5 by @dependabot[bot] in https://github.com/actions/runner/pull/4037
-* Bump Azure.Storage.Blobs from 12.25.0 to 12.25.1 by @dependabot[bot] in https://github.com/actions/runner/pull/4058
-* Update Docker to v28.5.0 and Buildx to v0.29.1 by @github-actions[bot] in https://github.com/actions/runner/pull/4069
-* Bump github/codeql-action from 3 to 4 by @dependabot[bot] in https://github.com/actions/runner/pull/4072
-* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4075
-* Include k8s novolume (version v0.8.0) by @nikola-jokic in https://github.com/actions/runner/pull/4063
-* Make sure runner-admin has both auth_url and auth_url_v2. by @TingluoHuang in https://github.com/actions/runner/pull/4066
-* Report job has infra failure to run-service by @TingluoHuang in https://github.com/actions/runner/pull/4073
-* Bump actions/setup-node from 5 to 6 by @dependabot[bot] in https://github.com/actions/runner/pull/4078
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4200
+* Update dotnet sdk to latest version @8.0.417 by @github-actions[bot] in https://github.com/actions/runner/pull/4201
+* Bump System.Formats.Asn1 and System.Security.Cryptography.Pkcs by @dependabot[bot] in https://github.com/actions/runner/pull/4202
+* Allow empty container options by @ericsciple in https://github.com/actions/runner/pull/4208
+* Update Docker to v29.1.5 and Buildx to v0.31.0 by @github-actions[bot] in https://github.com/actions/runner/pull/4212
+* Report job level annotations by @TingluoHuang in https://github.com/actions/runner/pull/4216
+* Fix local action display name showing `Run /./` instead of `Run ./` by @ericsciple in https://github.com/actions/runner/pull/4218
+* Update Docker to v29.2.0 and Buildx to v0.31.1 by @github-actions[bot] in https://github.com/actions/runner/pull/4219
+* Add support for libssl3 and libssl3t64 for newer Debian/Ubuntu versions by @nekketsuuu in https://github.com/actions/runner/pull/4213
+* Validate work dir during runner start up. by @TingluoHuang in https://github.com/actions/runner/pull/4227
+* Bump hook to 0.8.1 by @nikola-jokic in https://github.com/actions/runner/pull/4222
+* Support return job result as exitcode in hosted runner. by @TingluoHuang in https://github.com/actions/runner/pull/4233
+* Add telemetry tracking for deprecated set-output and save-state commands by @ericsciple in https://github.com/actions/runner/pull/4221
+* Fix parser comparison mismatches by @ericsciple in https://github.com/actions/runner/pull/4220
+* Remove unnecessary connection test during some registration flows by @zarenner in https://github.com/actions/runner/pull/4244
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4249
+* Update dotnet sdk to latest version @8.0.418 by @github-actions[bot] in https://github.com/actions/runner/pull/4250
+* Fix link to SECURITY.md in README by @TingluoHuang in https://github.com/actions/runner/pull/4253
+* Try to infer runner is on hosted/ghes when githuburl is empty. by @TingluoHuang in https://github.com/actions/runner/pull/4254
+* Add Node.js 20 deprecation warning annotation (Phase 1) by @salmanmkc in https://github.com/actions/runner/pull/4242
+* Update Node.js 20 deprecation date to June 2nd, 2026 by @salmanmkc in https://github.com/actions/runner/pull/4258
+* Composite Action Step Markers by @ericsciple in https://github.com/actions/runner/pull/4243
+* Symlink actions cache by @paveliak in https://github.com/actions/runner/pull/4260
+* Bump minimatch in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/4261
+* Bump @stylistic/eslint-plugin from 3.1.0 to 5.9.0 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/4257
 
 ## New Contributors
-* @horner made their first contribution in https://github.com/actions/runner/pull/3157
+* @nekketsuuu made their first contribution in https://github.com/actions/runner/pull/4213
+* @zarenner made their first contribution in https://github.com/actions/runner/pull/4244
 
-**Full Changelog**: https://github.com/actions/runner/compare/v2.328.0...v2.329.0
+**Full Changelog**: https://github.com/actions/runner/compare/v2.331.0...v2.332.0
 
 _Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
 To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.

src/Misc/expressionFunc/hashFiles/.eslintrc.json

@@ -1,5 +1,5 @@
 {
-    "plugins": ["@typescript-eslint"],
+    "plugins": ["@typescript-eslint", "@stylistic"],
     "extends": ["plugin:github/recommended"],
     "parser": "@typescript-eslint/parser",
     "parserOptions": {
@@ -26,7 +26,7 @@
       ],
       "camelcase": "off",
       "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
-      "@typescript-eslint/func-call-spacing": ["error", "never"],
+      "@stylistic/func-call-spacing": ["error", "never"],
       "@typescript-eslint/no-array-constructor": "error",
       "@typescript-eslint/no-empty-interface": "error",
       "@typescript-eslint/no-explicit-any": "error",
@@ -47,8 +47,8 @@
       "@typescript-eslint/promise-function-async": "error",
       "@typescript-eslint/require-array-sort-compare": "error",
       "@typescript-eslint/restrict-plus-operands": "error",
-      "@typescript-eslint/semi": ["error", "never"],
-      "@typescript-eslint/type-annotation-spacing": "error",
+      "@stylistic/semi": ["error", "never"],
+      "@stylistic/type-annotation-spacing": "error",
       "@typescript-eslint/unbound-method": "error",
       "filenames/match-regex" : "off",
       "github/no-then" : 1, // warning

src/Misc/expressionFunc/hashFiles/package.json

@@ -35,9 +35,10 @@
     "@actions/glob": "^0.4.0"
   },
   "devDependencies": {
-    "@types/node": "^20.6.2",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
-    "@typescript-eslint/parser": "^6.7.2",
+    "@stylistic/eslint-plugin": "^5.10.0",
+    "@types/node": "^22.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@typescript-eslint/parser": "^8.0.0",
     "@vercel/ncc": "^0.38.3",
     "eslint": "^8.47.0",
     "eslint-plugin-github": "^4.10.2",
@@ -45,6 +46,6 @@
     "husky": "^9.1.7",
     "lint-staged": "^15.5.0",
     "prettier": "^3.0.3",
-    "typescript": "^5.9.2"
+    "typescript": "^5.9.3"
   }
 }

src/Misc/externals.sh

@@ -6,8 +6,8 @@ NODE_URL=https://nodejs.org/dist
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.5"
-NODE24_VERSION="24.11.0"
+NODE20_VERSION="20.20.1"
+NODE24_VERSION="24.14.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args

src/Misc/layoutbin/hashFiles/index.js

@@ -1,7 +1,7 @@
 /******/ (() => { // webpackBootstrap
 /******/ 	var __webpack_modules__ = ({
 
-/***/ 2627:
+/***/ 4711:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -22,13 +22,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -46,15 +56,15 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
     function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-const crypto = __importStar(__nccwpck_require__(6113));
-const fs = __importStar(__nccwpck_require__(7147));
-const glob = __importStar(__nccwpck_require__(8090));
-const path = __importStar(__nccwpck_require__(1017));
-const stream = __importStar(__nccwpck_require__(2781));
-const util = __importStar(__nccwpck_require__(3837));
+const crypto = __importStar(__nccwpck_require__(6982));
+const fs = __importStar(__nccwpck_require__(9896));
+const glob = __importStar(__nccwpck_require__(7206));
+const path = __importStar(__nccwpck_require__(6928));
+const stream = __importStar(__nccwpck_require__(2203));
+const util = __importStar(__nccwpck_require__(9023));
 function run() {
-    var _a, e_1, _b, _c;
     return __awaiter(this, void 0, void 0, function* () {
+        var _a, e_1, _b, _c;
         // arg0 -> node
         // arg1 -> hashFiles.js
         // env[followSymbolicLinks] = true/null
@@ -128,7 +138,7 @@ function run() {
 
 /***/ }),
 
-/***/ 7351:
+/***/ 4914:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -154,8 +164,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.issue = exports.issueCommand = void 0;
-const os = __importStar(__nccwpck_require__(2037));
-const utils_1 = __nccwpck_require__(5278);
+const os = __importStar(__nccwpck_require__(857));
+const utils_1 = __nccwpck_require__(302);
 /**
  * Commands
  *
@@ -227,7 +237,7 @@ function escapeProperty(s) {
 
 /***/ }),
 
-/***/ 2186:
+/***/ 7484:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -262,12 +272,12 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getIDToken = exports.getState = exports.saveState = exports.group = exports.endGroup = exports.startGroup = exports.info = exports.notice = exports.warning = exports.error = exports.debug = exports.isDebug = exports.setFailed = exports.setCommandEcho = exports.setOutput = exports.getBooleanInput = exports.getMultilineInput = exports.getInput = exports.addPath = exports.setSecret = exports.exportVariable = exports.ExitCode = void 0;
-const command_1 = __nccwpck_require__(7351);
-const file_command_1 = __nccwpck_require__(717);
-const utils_1 = __nccwpck_require__(5278);
-const os = __importStar(__nccwpck_require__(2037));
-const path = __importStar(__nccwpck_require__(1017));
-const oidc_utils_1 = __nccwpck_require__(8041);
+const command_1 = __nccwpck_require__(4914);
+const file_command_1 = __nccwpck_require__(4753);
+const utils_1 = __nccwpck_require__(302);
+const os = __importStar(__nccwpck_require__(857));
+const path = __importStar(__nccwpck_require__(6928));
+const oidc_utils_1 = __nccwpck_require__(5306);
 /**
  * The code to exit an action
  */
@@ -552,17 +562,17 @@ exports.getIDToken = getIDToken;
 /**
  * Summary exports
  */
-var summary_1 = __nccwpck_require__(1327);
+var summary_1 = __nccwpck_require__(1847);
 Object.defineProperty(exports, "summary", ({ enumerable: true, get: function () { return summary_1.summary; } }));
 /**
  * @deprecated use core.summary
  */
-var summary_2 = __nccwpck_require__(1327);
+var summary_2 = __nccwpck_require__(1847);
 Object.defineProperty(exports, "markdownSummary", ({ enumerable: true, get: function () { return summary_2.markdownSummary; } }));
 /**
  * Path exports
  */
-var path_utils_1 = __nccwpck_require__(2981);
+var path_utils_1 = __nccwpck_require__(1976);
 Object.defineProperty(exports, "toPosixPath", ({ enumerable: true, get: function () { return path_utils_1.toPosixPath; } }));
 Object.defineProperty(exports, "toWin32Path", ({ enumerable: true, get: function () { return path_utils_1.toWin32Path; } }));
 Object.defineProperty(exports, "toPlatformPath", ({ enumerable: true, get: function () { return path_utils_1.toPlatformPath; } }));
@@ -570,7 +580,7 @@ Object.defineProperty(exports, "toPlatformPath", ({ enumerable: true, get: funct
 
 /***/ }),
 
-/***/ 717:
+/***/ 4753:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -599,10 +609,10 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.prepareKeyValueMessage = exports.issueFileCommand = void 0;
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */
-const fs = __importStar(__nccwpck_require__(7147));
-const os = __importStar(__nccwpck_require__(2037));
-const uuid_1 = __nccwpck_require__(5840);
-const utils_1 = __nccwpck_require__(5278);
+const fs = __importStar(__nccwpck_require__(9896));
+const os = __importStar(__nccwpck_require__(857));
+const uuid_1 = __nccwpck_require__(2048);
+const utils_1 = __nccwpck_require__(302);
 function issueFileCommand(command, message) {
     const filePath = process.env[`GITHUB_${command}`];
     if (!filePath) {
@@ -635,7 +645,7 @@ exports.prepareKeyValueMessage = prepareKeyValueMessage;
 
 /***/ }),
 
-/***/ 8041:
+/***/ 5306:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -651,9 +661,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.OidcClient = void 0;
-const http_client_1 = __nccwpck_require__(6255);
-const auth_1 = __nccwpck_require__(5526);
-const core_1 = __nccwpck_require__(2186);
+const http_client_1 = __nccwpck_require__(4844);
+const auth_1 = __nccwpck_require__(4552);
+const core_1 = __nccwpck_require__(7484);
 class OidcClient {
     static createHttpClient(allowRetry = true, maxRetry = 10) {
         const requestOptions = {
@@ -719,7 +729,7 @@ exports.OidcClient = OidcClient;
 
 /***/ }),
 
-/***/ 2981:
+/***/ 1976:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -745,7 +755,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.toPlatformPath = exports.toWin32Path = exports.toPosixPath = void 0;
-const path = __importStar(__nccwpck_require__(1017));
+const path = __importStar(__nccwpck_require__(6928));
 /**
  * toPosixPath converts the given path to the posix form. On Windows, \\ will be
  * replaced with /.
@@ -784,7 +794,7 @@ exports.toPlatformPath = toPlatformPath;
 
 /***/ }),
 
-/***/ 1327:
+/***/ 1847:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -800,8 +810,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.summary = exports.markdownSummary = exports.SUMMARY_DOCS_URL = exports.SUMMARY_ENV_VAR = void 0;
-const os_1 = __nccwpck_require__(2037);
-const fs_1 = __nccwpck_require__(7147);
+const os_1 = __nccwpck_require__(857);
+const fs_1 = __nccwpck_require__(9896);
 const { access, appendFile, writeFile } = fs_1.promises;
 exports.SUMMARY_ENV_VAR = 'GITHUB_STEP_SUMMARY';
 exports.SUMMARY_DOCS_URL = 'https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary';
@@ -1074,7 +1084,7 @@ exports.summary = _summary;
 
 /***/ }),
 
-/***/ 5278:
+/***/ 302:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -1121,7 +1131,7 @@ exports.toCommandProperties = toCommandProperties;
 
 /***/ }),
 
-/***/ 8090:
+/***/ 7206:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1137,8 +1147,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.hashFiles = exports.create = void 0;
-const internal_globber_1 = __nccwpck_require__(8298);
-const internal_hash_files_1 = __nccwpck_require__(2448);
+const internal_globber_1 = __nccwpck_require__(103);
+const internal_hash_files_1 = __nccwpck_require__(3608);
 /**
  * Constructs a globber
  *
@@ -1174,7 +1184,7 @@ exports.hashFiles = hashFiles;
 
 /***/ }),
 
-/***/ 1026:
+/***/ 8164:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1200,7 +1210,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getOptions = void 0;
-const core = __importStar(__nccwpck_require__(2186));
+const core = __importStar(__nccwpck_require__(7484));
 /**
  * Returns a copy with defaults filled in.
  */
@@ -1236,7 +1246,7 @@ exports.getOptions = getOptions;
 
 /***/ }),
 
-/***/ 8298:
+/***/ 103:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1290,14 +1300,14 @@ var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _ar
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.DefaultGlobber = void 0;
-const core = __importStar(__nccwpck_require__(2186));
-const fs = __importStar(__nccwpck_require__(7147));
-const globOptionsHelper = __importStar(__nccwpck_require__(1026));
-const path = __importStar(__nccwpck_require__(1017));
-const patternHelper = __importStar(__nccwpck_require__(9005));
-const internal_match_kind_1 = __nccwpck_require__(1063);
-const internal_pattern_1 = __nccwpck_require__(4536);
-const internal_search_state_1 = __nccwpck_require__(9117);
+const core = __importStar(__nccwpck_require__(7484));
+const fs = __importStar(__nccwpck_require__(9896));
+const globOptionsHelper = __importStar(__nccwpck_require__(8164));
+const path = __importStar(__nccwpck_require__(6928));
+const patternHelper = __importStar(__nccwpck_require__(8891));
+const internal_match_kind_1 = __nccwpck_require__(2644);
+const internal_pattern_1 = __nccwpck_require__(5370);
+const internal_search_state_1 = __nccwpck_require__(9890);
 const IS_WINDOWS = process.platform === 'win32';
 class DefaultGlobber {
     constructor(options) {
@@ -1478,7 +1488,7 @@ exports.DefaultGlobber = DefaultGlobber;
 
 /***/ }),
 
-/***/ 2448:
+/***/ 3608:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1520,12 +1530,12 @@ var __asyncValues = (this && this.__asyncValues) || function (o) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.hashFiles = void 0;
-const crypto = __importStar(__nccwpck_require__(6113));
-const core = __importStar(__nccwpck_require__(2186));
-const fs = __importStar(__nccwpck_require__(7147));
-const stream = __importStar(__nccwpck_require__(2781));
-const util = __importStar(__nccwpck_require__(3837));
-const path = __importStar(__nccwpck_require__(1017));
+const crypto = __importStar(__nccwpck_require__(6982));
+const core = __importStar(__nccwpck_require__(7484));
+const fs = __importStar(__nccwpck_require__(9896));
+const stream = __importStar(__nccwpck_require__(2203));
+const util = __importStar(__nccwpck_require__(9023));
+const path = __importStar(__nccwpck_require__(6928));
 function hashFiles(globber, currentWorkspace, verbose = false) {
     var e_1, _a;
     var _b;
@@ -1582,7 +1592,7 @@ exports.hashFiles = hashFiles;
 
 /***/ }),
 
-/***/ 1063:
+/***/ 2644:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -1607,7 +1617,7 @@ var MatchKind;
 
 /***/ }),
 
-/***/ 1849:
+/***/ 4138:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1636,8 +1646,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.safeTrimTrailingSeparator = exports.normalizeSeparators = exports.hasRoot = exports.hasAbsoluteRoot = exports.ensureAbsoluteRoot = exports.dirname = void 0;
-const path = __importStar(__nccwpck_require__(1017));
-const assert_1 = __importDefault(__nccwpck_require__(9491));
+const path = __importStar(__nccwpck_require__(6928));
+const assert_1 = __importDefault(__nccwpck_require__(2613));
 const IS_WINDOWS = process.platform === 'win32';
 /**
  * Similar to path.dirname except normalizes the path separators and slightly better handling for Windows UNC paths.
@@ -1812,7 +1822,7 @@ exports.safeTrimTrailingSeparator = safeTrimTrailingSeparator;
 
 /***/ }),
 
-/***/ 6836:
+/***/ 6617:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1841,9 +1851,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Path = void 0;
-const path = __importStar(__nccwpck_require__(1017));
-const pathHelper = __importStar(__nccwpck_require__(1849));
-const assert_1 = __importDefault(__nccwpck_require__(9491));
+const path = __importStar(__nccwpck_require__(6928));
+const pathHelper = __importStar(__nccwpck_require__(4138));
+const assert_1 = __importDefault(__nccwpck_require__(2613));
 const IS_WINDOWS = process.platform === 'win32';
 /**
  * Helper class for parsing paths into segments
@@ -1932,7 +1942,7 @@ exports.Path = Path;
 
 /***/ }),
 
-/***/ 9005:
+/***/ 8891:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -1958,8 +1968,8 @@ var __importStar = (this && this.__importStar) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.partialMatch = exports.match = exports.getSearchPaths = void 0;
-const pathHelper = __importStar(__nccwpck_require__(1849));
-const internal_match_kind_1 = __nccwpck_require__(1063);
+const pathHelper = __importStar(__nccwpck_require__(4138));
+const internal_match_kind_1 = __nccwpck_require__(2644);
 const IS_WINDOWS = process.platform === 'win32';
 /**
  * Given an array of patterns, returns an array of paths to search.
@@ -2033,7 +2043,7 @@ exports.partialMatch = partialMatch;
 
 /***/ }),
 
-/***/ 4536:
+/***/ 5370:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -2062,13 +2072,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.Pattern = void 0;
-const os = __importStar(__nccwpck_require__(2037));
-const path = __importStar(__nccwpck_require__(1017));
-const pathHelper = __importStar(__nccwpck_require__(1849));
-const assert_1 = __importDefault(__nccwpck_require__(9491));
-const minimatch_1 = __nccwpck_require__(3973);
-const internal_match_kind_1 = __nccwpck_require__(1063);
-const internal_path_1 = __nccwpck_require__(6836);
+const os = __importStar(__nccwpck_require__(857));
+const path = __importStar(__nccwpck_require__(6928));
+const pathHelper = __importStar(__nccwpck_require__(4138));
+const assert_1 = __importDefault(__nccwpck_require__(2613));
+const minimatch_1 = __nccwpck_require__(3772);
+const internal_match_kind_1 = __nccwpck_require__(2644);
+const internal_path_1 = __nccwpck_require__(6617);
 const IS_WINDOWS = process.platform === 'win32';
 class Pattern {
     constructor(patternOrNegate, isImplicitPattern = false, segments, homedir) {
@@ -2295,7 +2305,7 @@ exports.Pattern = Pattern;
 
 /***/ }),
 
-/***/ 9117:
+/***/ 9890:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -2313,7 +2323,7 @@ exports.SearchState = SearchState;
 
 /***/ }),
 
-/***/ 5526:
+/***/ 4552:
 /***/ (function(__unused_webpack_module, exports) {
 
 "use strict";
@@ -2401,7 +2411,7 @@ exports.PersonalAccessTokenCredentialHandler = PersonalAccessTokenCredentialHand
 
 /***/ }),
 
-/***/ 6255:
+/***/ 4844:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -2437,10 +2447,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.HttpClient = exports.isHttps = exports.HttpClientResponse = exports.HttpClientError = exports.getProxyUrl = exports.MediaTypes = exports.Headers = exports.HttpCodes = void 0;
-const http = __importStar(__nccwpck_require__(3685));
-const https = __importStar(__nccwpck_require__(5687));
-const pm = __importStar(__nccwpck_require__(9835));
-const tunnel = __importStar(__nccwpck_require__(4294));
+const http = __importStar(__nccwpck_require__(8611));
+const https = __importStar(__nccwpck_require__(5692));
+const pm = __importStar(__nccwpck_require__(4988));
+const tunnel = __importStar(__nccwpck_require__(770));
 var HttpCodes;
 (function (HttpCodes) {
     HttpCodes[HttpCodes["OK"] = 200] = "OK";
@@ -3026,7 +3036,7 @@ const lowercaseKeys = (obj) => Object.keys(obj).reduce((c, k) => ((c[k.toLowerCa
 
 /***/ }),
 
-/***/ 9835:
+/***/ 4988:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -3115,7 +3125,7 @@ function isLoopbackAddress(host) {
 
 /***/ }),
 
-/***/ 9417:
+/***/ 9380:
 /***/ ((module) => {
 
 "use strict";
@@ -3185,11 +3195,11 @@ function range(a, b, str) {
 
 /***/ }),
 
-/***/ 3717:
+/***/ 4691:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-var concatMap = __nccwpck_require__(6891);
-var balanced = __nccwpck_require__(9417);
+var concatMap = __nccwpck_require__(7087);
+var balanced = __nccwpck_require__(9380);
 
 module.exports = expandTop;
 
@@ -3393,7 +3403,7 @@ function expand(str, isTop) {
 
 /***/ }),
 
-/***/ 6891:
+/***/ 7087:
 /***/ ((module) => {
 
 module.exports = function (xs, fn) {
@@ -3413,19 +3423,19 @@ var isArray = Array.isArray || function (xs) {
 
 /***/ }),
 
-/***/ 3973:
+/***/ 3772:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
 module.exports = minimatch
 minimatch.Minimatch = Minimatch
 
-var path = (function () { try { return __nccwpck_require__(1017) } catch (e) {}}()) || {
+var path = (function () { try { return __nccwpck_require__(6928) } catch (e) {}}()) || {
   sep: '/'
 }
 minimatch.sep = path.sep
 
 var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {}
-var expand = __nccwpck_require__(3717)
+var expand = __nccwpck_require__(4691)
 
 var plTypes = {
   '!': { open: '(?:(?!(?:', close: '))[^/]*?)'},
@@ -4367,27 +4377,27 @@ function regExpEscape (s) {
 
 /***/ }),
 
-/***/ 4294:
+/***/ 770:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
 
-module.exports = __nccwpck_require__(4219);
+module.exports = __nccwpck_require__(218);
 
 
 /***/ }),
 
-/***/ 4219:
+/***/ 218:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 
-var net = __nccwpck_require__(1808);
-var tls = __nccwpck_require__(4404);
-var http = __nccwpck_require__(3685);
-var https = __nccwpck_require__(5687);
-var events = __nccwpck_require__(2361);
-var assert = __nccwpck_require__(9491);
-var util = __nccwpck_require__(3837);
+var net = __nccwpck_require__(9278);
+var tls = __nccwpck_require__(4756);
+var http = __nccwpck_require__(8611);
+var https = __nccwpck_require__(5692);
+var events = __nccwpck_require__(4434);
+var assert = __nccwpck_require__(2613);
+var util = __nccwpck_require__(9023);
 
 
 exports.httpOverHttp = httpOverHttp;
@@ -4647,7 +4657,7 @@ exports.debug = debug; // for test
 
 /***/ }),
 
-/***/ 5840:
+/***/ 2048:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4711,29 +4721,29 @@ Object.defineProperty(exports, "parse", ({
   }
 }));
 
-var _v = _interopRequireDefault(__nccwpck_require__(8628));
+var _v = _interopRequireDefault(__nccwpck_require__(6415));
 
-var _v2 = _interopRequireDefault(__nccwpck_require__(6409));
+var _v2 = _interopRequireDefault(__nccwpck_require__(1697));
 
-var _v3 = _interopRequireDefault(__nccwpck_require__(5122));
+var _v3 = _interopRequireDefault(__nccwpck_require__(4676));
 
-var _v4 = _interopRequireDefault(__nccwpck_require__(9120));
+var _v4 = _interopRequireDefault(__nccwpck_require__(9771));
 
-var _nil = _interopRequireDefault(__nccwpck_require__(5332));
+var _nil = _interopRequireDefault(__nccwpck_require__(7723));
 
-var _version = _interopRequireDefault(__nccwpck_require__(1595));
+var _version = _interopRequireDefault(__nccwpck_require__(5868));
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
-var _parse = _interopRequireDefault(__nccwpck_require__(2746));
+var _parse = _interopRequireDefault(__nccwpck_require__(7267));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 /***/ }),
 
-/***/ 4569:
+/***/ 216:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4744,7 +4754,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _crypto = _interopRequireDefault(__nccwpck_require__(6113));
+var _crypto = _interopRequireDefault(__nccwpck_require__(6982));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4763,7 +4773,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 5332:
+/***/ 7723:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -4778,7 +4788,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 2746:
+/***/ 7267:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4789,7 +4799,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4830,7 +4840,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 814:
+/***/ 7879:
 /***/ ((__unused_webpack_module, exports) => {
 
 "use strict";
@@ -4845,7 +4855,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 807:
+/***/ 2973:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4856,7 +4866,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = rng;
 
-var _crypto = _interopRequireDefault(__nccwpck_require__(6113));
+var _crypto = _interopRequireDefault(__nccwpck_require__(6982));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4876,7 +4886,7 @@ function rng() {
 
 /***/ }),
 
-/***/ 5274:
+/***/ 507:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4887,7 +4897,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _crypto = _interopRequireDefault(__nccwpck_require__(6113));
+var _crypto = _interopRequireDefault(__nccwpck_require__(6982));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4906,7 +4916,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 8950:
+/***/ 7597:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4917,7 +4927,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -4952,7 +4962,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 8628:
+/***/ 6415:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -4963,9 +4973,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _rng = _interopRequireDefault(__nccwpck_require__(807));
+var _rng = _interopRequireDefault(__nccwpck_require__(2973));
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5066,7 +5076,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 6409:
+/***/ 1697:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5077,9 +5087,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _v = _interopRequireDefault(__nccwpck_require__(5998));
+var _v = _interopRequireDefault(__nccwpck_require__(2930));
 
-var _md = _interopRequireDefault(__nccwpck_require__(4569));
+var _md = _interopRequireDefault(__nccwpck_require__(216));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5089,7 +5099,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 5998:
+/***/ 2930:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5101,9 +5111,9 @@ Object.defineProperty(exports, "__esModule", ({
 exports["default"] = _default;
 exports.URL = exports.DNS = void 0;
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
-var _parse = _interopRequireDefault(__nccwpck_require__(2746));
+var _parse = _interopRequireDefault(__nccwpck_require__(7267));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5174,7 +5184,7 @@ function _default(name, version, hashfunc) {
 
 /***/ }),
 
-/***/ 5122:
+/***/ 4676:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5185,9 +5195,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _rng = _interopRequireDefault(__nccwpck_require__(807));
+var _rng = _interopRequireDefault(__nccwpck_require__(2973));
 
-var _stringify = _interopRequireDefault(__nccwpck_require__(8950));
+var _stringify = _interopRequireDefault(__nccwpck_require__(7597));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5218,7 +5228,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 9120:
+/***/ 9771:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5229,9 +5239,9 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _v = _interopRequireDefault(__nccwpck_require__(5998));
+var _v = _interopRequireDefault(__nccwpck_require__(2930));
 
-var _sha = _interopRequireDefault(__nccwpck_require__(5274));
+var _sha = _interopRequireDefault(__nccwpck_require__(507));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5241,7 +5251,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 6900:
+/***/ 6200:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5252,7 +5262,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _regex = _interopRequireDefault(__nccwpck_require__(814));
+var _regex = _interopRequireDefault(__nccwpck_require__(7879));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5265,7 +5275,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 1595:
+/***/ 5868:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5276,7 +5286,7 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports["default"] = void 0;
 
-var _validate = _interopRequireDefault(__nccwpck_require__(6900));
+var _validate = _interopRequireDefault(__nccwpck_require__(6200));
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
@@ -5293,7 +5303,7 @@ exports["default"] = _default;
 
 /***/ }),
 
-/***/ 9491:
+/***/ 2613:
 /***/ ((module) => {
 
 "use strict";
@@ -5301,7 +5311,7 @@ module.exports = require("assert");
 
 /***/ }),
 
-/***/ 6113:
+/***/ 6982:
 /***/ ((module) => {
 
 "use strict";
@@ -5309,7 +5319,7 @@ module.exports = require("crypto");
 
 /***/ }),
 
-/***/ 2361:
+/***/ 4434:
 /***/ ((module) => {
 
 "use strict";
@@ -5317,7 +5327,7 @@ module.exports = require("events");
 
 /***/ }),
 
-/***/ 7147:
+/***/ 9896:
 /***/ ((module) => {
 
 "use strict";
@@ -5325,7 +5335,7 @@ module.exports = require("fs");
 
 /***/ }),
 
-/***/ 3685:
+/***/ 8611:
 /***/ ((module) => {
 
 "use strict";
@@ -5333,7 +5343,7 @@ module.exports = require("http");
 
 /***/ }),
 
-/***/ 5687:
+/***/ 5692:
 /***/ ((module) => {
 
 "use strict";
@@ -5341,7 +5351,7 @@ module.exports = require("https");
 
 /***/ }),
 
-/***/ 1808:
+/***/ 9278:
 /***/ ((module) => {
 
 "use strict";
@@ -5349,7 +5359,7 @@ module.exports = require("net");
 
 /***/ }),
 
-/***/ 2037:
+/***/ 857:
 /***/ ((module) => {
 
 "use strict";
@@ -5357,7 +5367,7 @@ module.exports = require("os");
 
 /***/ }),
 
-/***/ 1017:
+/***/ 6928:
 /***/ ((module) => {
 
 "use strict";
@@ -5365,7 +5375,7 @@ module.exports = require("path");
 
 /***/ }),
 
-/***/ 2781:
+/***/ 2203:
 /***/ ((module) => {
 
 "use strict";
@@ -5373,7 +5383,7 @@ module.exports = require("stream");
 
 /***/ }),
 
-/***/ 4404:
+/***/ 4756:
 /***/ ((module) => {
 
 "use strict";
@@ -5381,7 +5391,7 @@ module.exports = require("tls");
 
 /***/ }),
 
-/***/ 3837:
+/***/ 9023:
 /***/ ((module) => {
 
 "use strict";
@@ -5431,7 +5441,7 @@ module.exports = require("util");
 /******/ 	// startup
 /******/ 	// Load entry module and return exports
 /******/ 	// This entry module is referenced by other modules so it can't be inlined
-/******/ 	var __webpack_exports__ = __nccwpck_require__(2627);
+/******/ 	var __webpack_exports__ = __nccwpck_require__(4711);
 /******/ 	module.exports = __webpack_exports__;
 /******/ 	
 /******/ })()

src/Misc/layoutbin/installdependencies.sh

@@ -102,7 +102,7 @@ then
             exit 1
         fi
 
-        apt_get_with_fallbacks libssl1.1$ libssl1.0.2$ libssl1.0.0$
+        apt_get_with_fallbacks libssl3t64$ libssl3$ libssl1.1$ libssl1.0.2$ libssl1.0.0$
         if [ $? -ne 0 ]
         then
             echo "'$apt_get' failed with exit code '$?'"

src/Misc/layoutroot/safe_sleep.sh

@@ -1,5 +1,36 @@
 #!/bin/bash
 
+# try to use sleep if available
+if [ -x "$(command -v sleep)" ]; then
+    sleep "$1"
+    exit 0
+fi
+
+# try to use ping if available
+if [ -x "$(command -v ping)" ]; then
+    ping -c $(( $1 + 1 )) 127.0.0.1 > /dev/null
+    exit 0
+fi
+
+# try to use read -t from stdin/stdout/stderr if we are in bash
+if [ -n "$BASH_VERSION" ]; then
+    if command -v read >/dev/null 2>&1; then
+        if [ -t 0 ]; then
+            read -t "$1" -u 0 || :;
+            exit 0
+        fi
+        if [ -t 1 ]; then
+            read -t "$1" -u 1 || :;
+            exit 0
+        fi
+        if [ -t 2 ]; then
+            read -t "$1" -u 2 || :;
+            exit 0
+        fi
+    fi
+fi
+
+# fallback to a busy wait
 SECONDS=0
 while [[ $SECONDS -lt $1 ]]; do
     :

src/Runner.Common/ActionCommand.cs

@@ -204,6 +204,26 @@ namespace GitHub.Runner.Common
             return unescaped;
         }
 
+        /// <summary>
+        /// Escapes special characters in a value using the standard action command escape mappings.
+        /// Iterates in reverse so that '%' is escaped first to avoid double-encoding.
+        /// </summary>
+        public static string EscapeValue(string value)
+        {
+            if (string.IsNullOrEmpty(value))
+            {
+                return value;
+            }
+
+            string escaped = value;
+            for (int i = _escapeMappings.Length - 1; i >= 0; i--)
+            {
+                escaped = escaped.Replace(_escapeMappings[i].Token, _escapeMappings[i].Replacement);
+            }
+
+            return escaped;
+        }
+
         private static string UnescapeProperty(string escaped)
         {
             if (string.IsNullOrEmpty(escaped))

src/Runner.Common/ConfigurationStore.cs

@@ -75,6 +75,41 @@ namespace GitHub.Runner.Common
                 {
                     return UrlUtil.IsHostedServer(new UriBuilder(GitHubUrl));
                 }
+                else
+                {
+                    // feature flag env in case the new logic is wrong.
+                    if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_FORCE_EMPTY_GITHUB_URL_IS_HOSTED")))
+                    {
+                        return true;
+                    }
+
+                    // GitHubUrl will be empty for jit configured runner
+                    // We will try to infer it from the ServerUrl/ServerUrlV2
+                    if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_FORCE_GHES")))
+                    {
+                        // Allow env to override and force GHES in case the inference logic is wrong.
+                        return false;
+                    }
+
+                    if (!string.IsNullOrEmpty(ServerUrl))
+                    {
+                        // pipelines services
+                        var serverUrl = new UriBuilder(ServerUrl);
+                        return serverUrl.Host.EndsWith(".actions.githubusercontent.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrl.Host.EndsWith(".codedev.ms", StringComparison.OrdinalIgnoreCase);
+                    }
+
+                    if (!string.IsNullOrEmpty(ServerUrlV2))
+                    {
+                        // broker-listener
+                        var serverUrlV2 = new UriBuilder(ServerUrlV2);
+                        return serverUrlV2.Host.EndsWith(".actions.githubusercontent.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".githubapp.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".ghe.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".actions.localhost", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".ghe.localhost", StringComparison.OrdinalIgnoreCase);
+                    }
+                }
 
                 // Default to true since Hosted runners likely don't have this property set.
                 return true;

src/Runner.Common/Constants.cs

@@ -169,26 +169,33 @@ namespace GitHub.Runner.Common
                 public static readonly string AllowRunnerContainerHooks = "DistributedTask.AllowRunnerContainerHooks";
                 public static readonly string AddCheckRunIdToJobContext = "actions_add_check_run_id_to_job_context";
                 public static readonly string DisplayHelpfulActionsDownloadErrors = "actions_display_helpful_actions_download_errors";
-                public static readonly string ContainerActionRunnerTemp = "actions_container_action_runner_temp";
                 public static readonly string SnapshotPreflightHostedRunnerCheck = "actions_snapshot_preflight_hosted_runner_check";
                 public static readonly string SnapshotPreflightImageGenPoolCheck = "actions_snapshot_preflight_image_gen_pool_check";
-                public static readonly string CompareTemplateEvaluator = "actions_runner_compare_template_evaluator";
+                public static readonly string CompareWorkflowParser = "actions_runner_compare_workflow_parser";
+                public static readonly string ServiceContainerCommand = "actions_service_container_command";
+                public static readonly string SetOrchestrationIdEnvForActions = "actions_set_orchestration_id_env_for_actions";
+                public static readonly string SendJobLevelAnnotations = "actions_send_job_level_annotations";
+                public static readonly string EmitCompositeMarkers = "actions_runner_emit_composite_markers";
             }
-            
+
             // Node version migration related constants
             public static class NodeMigration
             {
                 // Node versions
                 public static readonly string Node20 = "node20";
                 public static readonly string Node24 = "node24";
-                
+
                 // Environment variables for controlling node version selection
                 public static readonly string ForceNode24Variable = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24";
                 public static readonly string AllowUnsecureNodeVersionVariable = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
-                
+
                 // Feature flags for controlling the migration phases
                 public static readonly string UseNode24ByDefaultFlag = "actions.runner.usenode24bydefault";
                 public static readonly string RequireNode24Flag = "actions.runner.requirenode24";
+                public static readonly string WarnOnNode20Flag = "actions.runner.warnonnode20";
+
+                // Blog post URL for Node 20 deprecation
+                public static readonly string Node20DeprecationUrl = "https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/";
             }
 
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";
@@ -283,6 +290,8 @@ namespace GitHub.Runner.Common
                 public static readonly string ForcedActionsNodeVersion = "ACTIONS_RUNNER_FORCE_ACTIONS_NODE_VERSION";
                 public static readonly string PrintLogToStdout = "ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT";
                 public static readonly string ActionArchiveCacheDirectory = "ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE";
+                public static readonly string SymlinkCachedActions = "ACTIONS_RUNNER_SYMLINK_CACHED_ACTIONS";
+                public static readonly string EmitCompositeMarkers = "ACTIONS_RUNNER_EMIT_COMPOSITE_MARKERS";
             }
 
             public static class System

src/Runner.Listener/Configuration/ConfigurationManager.cs

@@ -178,8 +178,12 @@ namespace GitHub.Runner.Listener.Configuration
                         }
                     }
 
-                    // Validate can connect.
-                    await _runnerServer.ConnectAsync(new Uri(runnerSettings.ServerUrl), creds);
+                    // Validate can connect using the obtained vss credentials.
+                    // In Runner Admin flow there's nothing new to test connection to at this point as registerToken is already validated via GetTenantCredential.
+                    if (!runnerSettings.UseRunnerAdminFlow)
+                    {
+                        await _runnerServer.ConnectAsync(new Uri(runnerSettings.ServerUrl), creds);
+                    }
 
                     _term.WriteLine();
                     _term.WriteSuccessMessage("Connected to GitHub");

src/Runner.Listener/JobDispatcher.cs

@@ -24,7 +24,7 @@ namespace GitHub.Runner.Listener
     public interface IJobDispatcher : IRunnerService
     {
         bool Busy { get; }
-        TaskCompletionSource<bool> RunOnceJobCompleted { get; }
+        TaskCompletionSource<TaskResult> RunOnceJobCompleted { get; }
         void Run(Pipelines.AgentJobRequestMessage message, bool runOnce = false);
         bool Cancel(JobCancelMessage message);
         Task WaitAsync(CancellationToken token);
@@ -56,7 +56,7 @@ namespace GitHub.Runner.Listener
         // timeout limit can be overwritten by environment GITHUB_ACTIONS_RUNNER_CHANNEL_TIMEOUT
         private TimeSpan _channelTimeout;
 
-        private TaskCompletionSource<bool> _runOnceJobCompleted = new();
+        private TaskCompletionSource<TaskResult> _runOnceJobCompleted = new();
 
         public event EventHandler<JobStatusEventArgs> JobStatus;
 
@@ -82,7 +82,7 @@ namespace GitHub.Runner.Listener
             Trace.Info($"Set runner/worker IPC timeout to {_channelTimeout.TotalSeconds} seconds.");
         }
 
-        public TaskCompletionSource<bool> RunOnceJobCompleted => _runOnceJobCompleted;
+        public TaskCompletionSource<TaskResult> RunOnceJobCompleted => _runOnceJobCompleted;
 
         public bool Busy { get; private set; }
 
@@ -340,18 +340,19 @@ namespace GitHub.Runner.Listener
 
         private async Task RunOnceAsync(Pipelines.AgentJobRequestMessage message, string orchestrationId, WorkerDispatcher previousJobDispatch, CancellationToken jobRequestCancellationToken, CancellationToken workerCancelTimeoutKillToken)
         {
+            var jobResult = TaskResult.Succeeded;
             try
             {
-                await RunAsync(message, orchestrationId, previousJobDispatch, jobRequestCancellationToken, workerCancelTimeoutKillToken);
+                jobResult = await RunAsync(message, orchestrationId, previousJobDispatch, jobRequestCancellationToken, workerCancelTimeoutKillToken);
             }
             finally
             {
                 Trace.Info("Fire signal for one time used runner.");
-                _runOnceJobCompleted.TrySetResult(true);
+                _runOnceJobCompleted.TrySetResult(jobResult);
             }
         }
 
-        private async Task RunAsync(Pipelines.AgentJobRequestMessage message, string orchestrationId, WorkerDispatcher previousJobDispatch, CancellationToken jobRequestCancellationToken, CancellationToken workerCancelTimeoutKillToken)
+        private async Task<TaskResult> RunAsync(Pipelines.AgentJobRequestMessage message, string orchestrationId, WorkerDispatcher previousJobDispatch, CancellationToken jobRequestCancellationToken, CancellationToken workerCancelTimeoutKillToken)
         {
             Busy = true;
             try
@@ -399,7 +400,7 @@ namespace GitHub.Runner.Listener
                     {
                         // renew job request task complete means we run out of retry for the first job request renew.
                         Trace.Info($"Unable to renew job request for job {message.JobId} for the first time, stop dispatching job to worker.");
-                        return;
+                        return TaskResult.Abandoned;
                     }
 
                     if (jobRequestCancellationToken.IsCancellationRequested)
@@ -412,7 +413,7 @@ namespace GitHub.Runner.Listener
 
                         // complete job request with result Cancelled
                         await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, TaskResult.Canceled);
-                        return;
+                        return TaskResult.Canceled;
                     }
 
                     HostContext.WritePerfCounter($"JobRequestRenewed_{requestId.ToString()}");
@@ -523,7 +524,7 @@ namespace GitHub.Runner.Listener
                             await renewJobRequest;
 
                             // not finish the job request since the job haven't run on worker at all, we will not going to set a result to server.
-                            return;
+                            return TaskResult.Failed;
                         }
 
                         // we get first jobrequest renew succeed and start the worker process with the job message.
@@ -604,7 +605,7 @@ namespace GitHub.Runner.Listener
                                     Trace.Error(detailInfo);
                                 }
 
-                                return;
+                                return TaskResultUtil.TranslateFromReturnCode(returnCode);
                             }
                             else if (completedTask == renewJobRequest)
                             {
@@ -706,6 +707,8 @@ namespace GitHub.Runner.Listener
 
                             // complete job request
                             await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, resultOnAbandonOrCancel);
+
+                            return resultOnAbandonOrCancel;
                         }
                         finally
                         {

src/Runner.Listener/Runner.cs

@@ -5,8 +5,8 @@ using System.IO;
 using System.Linq;
 using System.Reflection;
 using System.Runtime.CompilerServices;
-using System.Security.Cryptography;
 using System.Security.Claims;
+using System.Security.Cryptography;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -324,8 +324,11 @@ namespace GitHub.Runner.Listener
                         HostContext.EnableAuthMigration("EnableAuthMigrationByDefault");
                     }
 
+                    // hosted runner only run one job and would like to know the result of the job for telemetry and alerting on failure spike.
+                    var returnJobResultForHosted = StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_RETURN_JOB_RESULT_FOR_HOSTED"));
+
                     // Run the runner interactively or as service
-                    return await ExecuteRunnerAsync(settings, command.RunOnce || settings.Ephemeral);
+                    return await ExecuteRunnerAsync(settings, command.RunOnce || settings.Ephemeral || returnJobResultForHosted, returnJobResultForHosted);
                 }
                 else
                 {
@@ -401,17 +404,32 @@ namespace GitHub.Runner.Listener
         }
 
         //create worker manager, create message listener and start listening to the queue
-        private async Task<int> RunAsync(RunnerSettings settings, bool runOnce = false)
+        private async Task<int> RunAsync(RunnerSettings settings, bool runOnce = false, bool returnRunOnceJobResult = false)
         {
             try
             {
                 Trace.Info(nameof(RunAsync));
-                
+
+                // Validate directory permissions.
+                string workDirectory = HostContext.GetDirectory(WellKnownDirectory.Work);
+                Trace.Info($"Validating directory permissions for: '{workDirectory}'");
+                try
+                {
+                    Directory.CreateDirectory(workDirectory);
+                    IOUtil.ValidateExecutePermission(workDirectory);
+                }
+                catch (Exception ex)
+                {
+                    Trace.Error(ex);
+                    _term.WriteError($"Fail to create and validate runner's work directory '{workDirectory}'.");
+                    return Constants.Runner.ReturnCode.TerminatedError;
+                }
+
                 // First try using migrated settings if available
                 var configManager = HostContext.GetService<IConfigurationManager>();
                 RunnerSettings migratedSettings = null;
-                
-                try 
+
+                try
                 {
                     migratedSettings = configManager.LoadMigratedSettings();
                     Trace.Info("Loaded migrated settings from .runner_migrated file");
@@ -422,15 +440,15 @@ namespace GitHub.Runner.Listener
                     // If migrated settings file doesn't exist or can't be loaded, we'll use the provided settings
                     Trace.Info($"Failed to load migrated settings: {ex.Message}");
                 }
-                
+
                 bool usedMigratedSettings = false;
-                
+
                 if (migratedSettings != null)
                 {
                     // Try to create session with migrated settings first
                     Trace.Info("Attempting to create session using migrated settings");
                     _listener = GetMessageListener(migratedSettings, isMigratedSettings: true);
-                    
+
                     try
                     {
                         CreateSessionResult createSessionResult = await _listener.CreateSessionAsync(HostContext.RunnerShutdownToken);
@@ -450,7 +468,7 @@ namespace GitHub.Runner.Listener
                         Trace.Error($"Exception when creating session with migrated settings: {ex}");
                     }
                 }
-                
+
                 // If migrated settings weren't used or session creation failed, use original settings
                 if (!usedMigratedSettings)
                 {
@@ -503,7 +521,7 @@ namespace GitHub.Runner.Listener
                             restartSession = true;
                             break;
                         }
-                        
+
                         TaskAgentMessage message = null;
                         bool skipMessageDeletion = false;
                         try
@@ -565,6 +583,21 @@ namespace GitHub.Runner.Listener
                                         Trace.Info($"Ignore any exception after cancel message loop. {ex}");
                                     }
 
+                                    if (returnRunOnceJobResult)
+                                    {
+                                        try
+                                        {
+                                            var jobResult = await jobDispatcher.RunOnceJobCompleted.Task;
+                                            return TaskResultUtil.TranslateToReturnCode(jobResult);
+                                        }
+                                        catch (Exception ex)
+                                        {
+                                            Trace.Error("run once job finished with error.");
+                                            Trace.Error(ex);
+                                            return Constants.Runner.ReturnCode.TerminatedError;
+                                        }
+                                    }
+
                                     return Constants.Runner.ReturnCode.Success;
                                 }
                             }
@@ -851,15 +884,15 @@ namespace GitHub.Runner.Listener
             return Constants.Runner.ReturnCode.Success;
         }
 
-        private async Task<int> ExecuteRunnerAsync(RunnerSettings settings, bool runOnce)
+        private async Task<int> ExecuteRunnerAsync(RunnerSettings settings, bool runOnce, bool returnRunOnceJobResult)
         {
             int returnCode = Constants.Runner.ReturnCode.Success;
             bool restart = false;
             do
             {
                 restart = false;
-                returnCode = await RunAsync(settings, runOnce);
-                
+                returnCode = await RunAsync(settings, runOnce, returnRunOnceJobResult);
+
                 if (returnCode == Constants.Runner.ReturnCode.RunnerConfigurationRefreshed)
                 {
                     Trace.Info("Runner configuration was refreshed, restarting session...");

src/Runner.Listener/SelfUpdater.cs

@@ -120,8 +120,10 @@ namespace GitHub.Runner.Listener
             }
             catch (Exception ex)
             {
+                Trace.Error(ex);
+                _terminal.WriteError($"Runner update failed: {ex.Message}");
                 _updateTrace.Enqueue(ex.ToString());
-                throw;
+                return false;
             }
             finally
             {

src/Runner.Listener/SelfUpdaterV2.cs

@@ -120,8 +120,10 @@ namespace GitHub.Runner.Listener
             }
             catch (Exception ex)
             {
+                Trace.Error(ex);
+                _terminal.WriteError($"Runner update failed: {ex.Message}");
                 _updateTrace.Enqueue(ex.ToString());
-                throw;
+                return false;
             }
             finally
             {

src/Runner.Sdk/Util/IOUtil.cs

@@ -93,6 +93,16 @@ namespace GitHub.Runner.Sdk
             }
         }
 
+        public static FileSystemInfo CreateSymbolicLink(string destDirectory, string srcDirectory)
+        {
+            // ensure directory chain exists
+            Directory.CreateDirectory(destDirectory);
+            // delete leaf directory
+            Directory.Delete(destDirectory);
+            // create symlink for the leaf directory
+            return Directory.CreateSymbolicLink(destDirectory, srcDirectory);
+        }
+
         public static void Delete(string path, CancellationToken cancellationToken)
         {
             DeleteDirectory(path, cancellationToken);

src/Runner.Worker/ActionCommandManager.cs

@@ -318,6 +318,17 @@ namespace GitHub.Runner.Worker
                 context.AddIssue(issue, ExecutionContextLogOptions.Default);
             }
 
+            if (!context.Global.HasDeprecatedSetOutput)
+            {
+                context.Global.HasDeprecatedSetOutput = true;
+                var telemetry = new JobTelemetry
+                {
+                    Type = JobTelemetryType.ActionCommand,
+                    Message = "DeprecatedCommand: set-output"
+                };
+                context.Global.JobTelemetry.Add(telemetry);
+            }
+
             if (!command.Properties.TryGetValue(SetOutputCommandProperties.Name, out string outputName) || string.IsNullOrEmpty(outputName))
             {
                 throw new Exception("Required field 'name' is missing in ##[set-output] command.");
@@ -353,6 +364,17 @@ namespace GitHub.Runner.Worker
                 context.AddIssue(issue, ExecutionContextLogOptions.Default);
             }
 
+            if (!context.Global.HasDeprecatedSaveState)
+            {
+                context.Global.HasDeprecatedSaveState = true;
+                var telemetry = new JobTelemetry
+                {
+                    Type = JobTelemetryType.ActionCommand,
+                    Message = "DeprecatedCommand: save-state"
+                };
+                context.Global.JobTelemetry.Add(telemetry);
+            }
+
             if (!command.Properties.TryGetValue(SaveStateCommandProperties.Name, out string stateName) || string.IsNullOrEmpty(stateName))
             {
                 throw new Exception("Required field 'name' is missing in ##[save-state] command.");

src/Runner.Worker/ActionManager.cs

@@ -111,7 +111,7 @@ namespace GitHub.Runner.Worker
             {
                 // Log the error and fail the PrepareActionsAsync Initialization.
                 Trace.Error($"Caught exception from PrepareActionsAsync Initialization: {ex}");
-                executionContext.InfrastructureError(ex.Message, category: "resolve_action");
+                executionContext.InfrastructureError(ex.InnerException?.Message ?? ex.Message, category: "resolve_action");
                 executionContext.Result = TaskResult.Failed;
                 throw;
             }
@@ -378,7 +378,7 @@ namespace GitHub.Runner.Worker
                 string dockerFileLowerCase = Path.Combine(actionDirectory, "dockerfile");
                 if (File.Exists(manifestFile) || File.Exists(manifestFileYaml))
                 {
-                    var manifestManager = HostContext.GetService<IActionManifestManager>();
+                    var manifestManager = HostContext.GetService<IActionManifestManagerWrapper>();
                     if (File.Exists(manifestFile))
                     {
                         definition.Data = manifestManager.Load(executionContext, manifestFile);
@@ -773,10 +773,6 @@ namespace GitHub.Runner.Worker
             }
             else
             {
-                // make sure we get a clean folder ready to use.
-                IOUtil.DeleteDirectory(destDirectory, executionContext.CancellationToken);
-                Directory.CreateDirectory(destDirectory);
-
                 if (downloadInfo.PackageDetails != null)
                 {
                     executionContext.Output($"##[group]Download immutable action package '{downloadInfo.NameWithOwner}@{downloadInfo.Ref}'");
@@ -811,6 +807,50 @@ namespace GitHub.Runner.Worker
                 if (!string.IsNullOrEmpty(actionArchiveCacheDir) &&
                     Directory.Exists(actionArchiveCacheDir))
                 {
+                    var symlinkCachedActions = StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable(Constants.Variables.Agent.SymlinkCachedActions));
+                    if (symlinkCachedActions)
+                    {
+                        Trace.Info($"Checking if can symlink '{downloadInfo.ResolvedNameWithOwner}@{downloadInfo.ResolvedSha}'");
+
+                        var cacheDirectory = Path.Combine(actionArchiveCacheDir, downloadInfo.ResolvedNameWithOwner.Replace(Path.DirectorySeparatorChar, '_').Replace(Path.AltDirectorySeparatorChar, '_'), downloadInfo.ResolvedSha);
+                        if (Directory.Exists(cacheDirectory))
+                        {
+                            try
+                            {
+                                Trace.Info($"Found unpacked action directory '{cacheDirectory}' in cache directory '{actionArchiveCacheDir}'");
+
+                                // repository archive from github always contains a nested folder
+                                var nestedDirectories = new DirectoryInfo(cacheDirectory).GetDirectories();
+                                if (nestedDirectories.Length != 1)
+                                {
+                                    throw new InvalidOperationException($"'{cacheDirectory}' contains '{nestedDirectories.Length}' directories");
+                                }
+                                else
+                                {
+                                    executionContext.Debug($"Symlink '{nestedDirectories[0].Name}' to '{destDirectory}'");
+                                    // make sure we get a clean folder ready to use.
+                                    IOUtil.DeleteDirectory(destDirectory, executionContext.CancellationToken);
+                                    IOUtil.CreateSymbolicLink(destDirectory, nestedDirectories[0].FullName);
+                                }
+
+                                executionContext.Debug($"Created symlink from cached directory '{cacheDirectory}' to '{destDirectory}'");
+                                executionContext.Global.JobTelemetry.Add(new JobTelemetry()
+                                {
+                                    Type = JobTelemetryType.General,
+                                    Message = $"Action archive cache usage: {downloadInfo.ResolvedNameWithOwner}@{downloadInfo.ResolvedSha} use cache {useActionArchiveCache} has cache {hasActionArchiveCache} via symlink"
+                                });
+
+                                Trace.Info("Finished getting action repository.");
+                                return;
+                            }
+                            catch (Exception ex)
+                            {
+                                Trace.Error($"Failed to create symlink from cached directory '{cacheDirectory}' to '{destDirectory}'. Error: {ex}");
+                                // Fall through to normal download logic
+                            }
+                        }
+                    }
+
                     hasActionArchiveCache = true;
                     Trace.Info($"Check if action archive '{downloadInfo.ResolvedNameWithOwner}@{downloadInfo.ResolvedSha}' already exists in cache directory '{actionArchiveCacheDir}'");
 #if OS_WINDOWS
@@ -892,6 +932,10 @@ namespace GitHub.Runner.Worker
                 }
 #endif
 
+                // make sure we get a clean folder ready to use.
+                IOUtil.DeleteDirectory(destDirectory, executionContext.CancellationToken);
+                Directory.CreateDirectory(destDirectory);
+
                 // repository archive from github always contains a nested folder
                 var subDirectories = new DirectoryInfo(stagingDirectory).GetDirectories();
                 if (subDirectories.Length != 1)
@@ -964,7 +1008,7 @@ namespace GitHub.Runner.Worker
             if (File.Exists(actionManifest) || File.Exists(actionManifestYaml))
             {
                 executionContext.Debug($"action.yml for action: '{actionManifest}'.");
-                var manifestManager = HostContext.GetService<IActionManifestManager>();
+                var manifestManager = HostContext.GetService<IActionManifestManagerWrapper>();
                 ActionDefinitionData actionDefinitionData = null;
                 if (File.Exists(actionManifest))
                 {

src/Runner.Worker/ActionManifestManager.cs

@@ -2,29 +2,29 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Threading;
+using System.Reflection;
+using System.Linq;
 using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;
-using System.Reflection;
-using GitHub.DistributedTask.Pipelines.ObjectTemplating;
-using GitHub.DistributedTask.ObjectTemplating.Schema;
-using GitHub.DistributedTask.ObjectTemplating;
-using GitHub.DistributedTask.ObjectTemplating.Tokens;
-using GitHub.DistributedTask.Pipelines.ContextData;
-using System.Linq;
-using Pipelines = GitHub.DistributedTask.Pipelines;
+using GitHub.Actions.WorkflowParser;
+using GitHub.Actions.WorkflowParser.Conversion;
+using GitHub.Actions.WorkflowParser.ObjectTemplating;
+using GitHub.Actions.WorkflowParser.ObjectTemplating.Schema;
+using GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens;
+using GitHub.Actions.Expressions.Data;
 
 namespace GitHub.Runner.Worker
 {
     [ServiceLocator(Default = typeof(ActionManifestManager))]
     public interface IActionManifestManager : IRunnerService
     {
-        ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile);
+        public ActionDefinitionDataNew Load(IExecutionContext executionContext, string manifestFile);
 
-        DictionaryContextData EvaluateCompositeOutputs(IExecutionContext executionContext, TemplateToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+        DictionaryExpressionData EvaluateCompositeOutputs(IExecutionContext executionContext, TemplateToken token, IDictionary<string, ExpressionData> extraExpressionValues);
 
-        List<string> EvaluateContainerArguments(IExecutionContext executionContext, SequenceToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+        List<string> EvaluateContainerArguments(IExecutionContext executionContext, SequenceToken token, IDictionary<string, ExpressionData> extraExpressionValues);
 
-        Dictionary<string, string> EvaluateContainerEnvironment(IExecutionContext executionContext, MappingToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+        Dictionary<string, string> EvaluateContainerEnvironment(IExecutionContext executionContext, MappingToken token, IDictionary<string, ExpressionData> extraExpressionValues);
 
         string EvaluateDefaultInput(IExecutionContext executionContext, string inputName, TemplateToken token);
     }
@@ -50,10 +50,10 @@ namespace GitHub.Runner.Worker
             Trace.Info($"Load schema file with definitions: {StringUtil.ConvertToJson(_actionManifestSchema.Definitions.Keys)}");
         }
 
-        public ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile)
+        public ActionDefinitionDataNew Load(IExecutionContext executionContext, string manifestFile)
         {
             var templateContext = CreateTemplateContext(executionContext);
-            ActionDefinitionData actionDefinition = new();
+            ActionDefinitionDataNew actionDefinition = new();
 
             // Clean up file name real quick
             // Instead of using Regex which can be computationally expensive, 
@@ -160,21 +160,21 @@ namespace GitHub.Runner.Worker
             return actionDefinition;
         }
 
-        public DictionaryContextData EvaluateCompositeOutputs(
+        public DictionaryExpressionData EvaluateCompositeOutputs(
             IExecutionContext executionContext,
             TemplateToken token,
-            IDictionary<string, PipelineContextData> extraExpressionValues)
+            IDictionary<string, ExpressionData> extraExpressionValues)
         {
-            var result = default(DictionaryContextData);
+            DictionaryExpressionData result = null;
 
             if (token != null)
             {
                 var templateContext = CreateTemplateContext(executionContext, extraExpressionValues);
                 try
                 {
-                    token = TemplateEvaluator.Evaluate(templateContext, "outputs", token, 0, null, omitHeader: true);
+                    token = TemplateEvaluator.Evaluate(templateContext, "outputs", token, 0, null);
                     templateContext.Errors.Check();
-                    result = token.ToContextData().AssertDictionary("composite outputs");
+                    result = token.ToExpressionData().AssertDictionary("composite outputs");
                 }
                 catch (Exception ex) when (!(ex is TemplateValidationException))
                 {
@@ -184,13 +184,13 @@ namespace GitHub.Runner.Worker
                 templateContext.Errors.Check();
             }
 
-            return result ?? new DictionaryContextData();
+            return result ?? new DictionaryExpressionData();
         }
 
         public List<string> EvaluateContainerArguments(
             IExecutionContext executionContext,
             SequenceToken token,
-            IDictionary<string, PipelineContextData> extraExpressionValues)
+            IDictionary<string, ExpressionData> extraExpressionValues)
         {
             var result = new List<string>();
 
@@ -199,7 +199,7 @@ namespace GitHub.Runner.Worker
                 var templateContext = CreateTemplateContext(executionContext, extraExpressionValues);
                 try
                 {
-                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "container-runs-args", token, 0, null, omitHeader: true);
+                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "container-runs-args", token, 0, null);
                     templateContext.Errors.Check();
 
                     Trace.Info($"Arguments evaluate result: {StringUtil.ConvertToJson(evaluateResult)}");
@@ -229,7 +229,7 @@ namespace GitHub.Runner.Worker
         public Dictionary<string, string> EvaluateContainerEnvironment(
             IExecutionContext executionContext,
             MappingToken token,
-            IDictionary<string, PipelineContextData> extraExpressionValues)
+            IDictionary<string, ExpressionData> extraExpressionValues)
         {
             var result = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
 
@@ -238,7 +238,7 @@ namespace GitHub.Runner.Worker
                 var templateContext = CreateTemplateContext(executionContext, extraExpressionValues);
                 try
                 {
-                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "container-runs-env", token, 0, null, omitHeader: true);
+                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "container-runs-env", token, 0, null);
                     templateContext.Errors.Check();
 
                     Trace.Info($"Environments evaluate result: {StringUtil.ConvertToJson(evaluateResult)}");
@@ -281,7 +281,7 @@ namespace GitHub.Runner.Worker
                 var templateContext = CreateTemplateContext(executionContext);
                 try
                 {
-                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "input-default-context", token, 0, null, omitHeader: true);
+                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "input-default-context", token, 0, null);
                     templateContext.Errors.Check();
 
                     Trace.Info($"Input '{inputName}': default value evaluate result: {StringUtil.ConvertToJson(evaluateResult)}");
@@ -303,7 +303,7 @@ namespace GitHub.Runner.Worker
 
         private TemplateContext CreateTemplateContext(
             IExecutionContext executionContext,
-            IDictionary<string, PipelineContextData> extraExpressionValues = null)
+            IDictionary<string, ExpressionData> extraExpressionValues = null)
         {
             var result = new TemplateContext
             {
@@ -314,13 +314,18 @@ namespace GitHub.Runner.Worker
                     maxEvents: 1000000,
                     maxBytes: 10 * 1024 * 1024),
                 Schema = _actionManifestSchema,
-                TraceWriter = executionContext.ToTemplateTraceWriter(),
+                // TODO: Switch to real tracewriter for cutover
+                TraceWriter = new GitHub.Actions.WorkflowParser.ObjectTemplating.EmptyTraceWriter(),
+                AllowCaseFunction = false,
             };
 
             // Expression values from execution context
             foreach (var pair in executionContext.ExpressionValues)
             {
-                result.ExpressionValues[pair.Key] = pair.Value;
+                // Convert old PipelineContextData to new ExpressionData
+                var json = StringUtil.ConvertToJson(pair.Value, Newtonsoft.Json.Formatting.None);
+                var newValue = StringUtil.ConvertFromJson<GitHub.Actions.Expressions.Data.ExpressionData>(json);
+                result.ExpressionValues[pair.Key] = newValue;
             }
 
             // Extra expression values
@@ -332,10 +337,19 @@ namespace GitHub.Runner.Worker
                 }
             }
 
-            // Expression functions from execution context
-            foreach (var item in executionContext.ExpressionFunctions)
+            // Expression functions
+            foreach (var func in executionContext.ExpressionFunctions)
             {
-                result.ExpressionFunctions.Add(item);
+                GitHub.Actions.Expressions.IFunctionInfo newFunc = func.Name switch
+                {
+                    "always" => new GitHub.Actions.Expressions.FunctionInfo<Expressions.NewAlwaysFunction>(func.Name, func.MinParameters, func.MaxParameters),
+                    "cancelled" => new GitHub.Actions.Expressions.FunctionInfo<Expressions.NewCancelledFunction>(func.Name, func.MinParameters, func.MaxParameters),
+                    "failure" => new GitHub.Actions.Expressions.FunctionInfo<Expressions.NewFailureFunction>(func.Name, func.MinParameters, func.MaxParameters),
+                    "success" => new GitHub.Actions.Expressions.FunctionInfo<Expressions.NewSuccessFunction>(func.Name, func.MinParameters, func.MaxParameters),
+                    "hashFiles" => new GitHub.Actions.Expressions.FunctionInfo<Expressions.NewHashFilesFunction>(func.Name, func.MinParameters, func.MaxParameters),
+                    _ => throw new NotSupportedException($"Expression function '{func.Name}' is not supported in ActionManifestManager")
+                };
+                result.ExpressionFunctions.Add(newFunc);
             }
 
             // Add the file table from the Execution Context
@@ -368,7 +382,7 @@ namespace GitHub.Runner.Worker
             var postToken = default(StringToken);
             var postEntrypointToken = default(StringToken);
             var postIfToken = default(StringToken);
-            var steps = default(List<Pipelines.Step>);
+            var steps = default(List<GitHub.Actions.WorkflowParser.IStep>);
 
             foreach (var run in runsMapping)
             {
@@ -416,7 +430,7 @@ namespace GitHub.Runner.Worker
                         break;
                     case "steps":
                         var stepsToken = run.Value.AssertSequence("steps");
-                        steps = PipelineTemplateConverter.ConvertToSteps(templateContext, stepsToken);
+                        steps = WorkflowTemplateConverter.ConvertToSteps(templateContext, stepsToken);
                         templateContext.Errors.Check();
                         break;
                     default:
@@ -435,7 +449,7 @@ namespace GitHub.Runner.Worker
                     }
                     else
                     {
-                        return new ContainerActionExecutionData()
+                        return new ContainerActionExecutionDataNew()
                         {
                             Image = imageToken.Value,
                             Arguments = argsToken,
@@ -478,11 +492,11 @@ namespace GitHub.Runner.Worker
                     }
                     else
                     {
-                        return new CompositeActionExecutionData()
+                        return new CompositeActionExecutionDataNew()
                         {
-                            Steps = steps.Cast<Pipelines.ActionStep>().ToList(),
-                            PreSteps = new List<Pipelines.ActionStep>(),
-                            PostSteps = new Stack<Pipelines.ActionStep>(),
+                            Steps = steps,
+                            PreSteps = new List<GitHub.Actions.WorkflowParser.IStep>(),
+                            PostSteps = new Stack<GitHub.Actions.WorkflowParser.IStep>(),
                             InitCondition = "always()",
                             CleanupCondition = "always()",
                             Outputs = outputs
@@ -507,7 +521,7 @@ namespace GitHub.Runner.Worker
 
         private void ConvertInputs(
             TemplateToken inputsToken,
-            ActionDefinitionData actionDefinition)
+            ActionDefinitionDataNew actionDefinition)
         {
             actionDefinition.Inputs = new MappingToken(null, null, null);
             var inputsMapping = inputsToken.AssertMapping("inputs");
@@ -542,5 +556,49 @@ namespace GitHub.Runner.Worker
             }
         }
     }
+
+    public sealed class ActionDefinitionDataNew
+    {
+        public string Name { get; set; }
+
+        public string Description { get; set; }
+
+        public MappingToken Inputs { get; set; }
+
+        public ActionExecutionData Execution { get; set; }
+
+        public Dictionary<String, String> Deprecated { get; set; }
+    }
+
+    public sealed class ContainerActionExecutionDataNew : ActionExecutionData
+    {
+        public override ActionExecutionType ExecutionType => ActionExecutionType.Container;
+
+        public override bool HasPre => !string.IsNullOrEmpty(Pre);
+        public override bool HasPost => !string.IsNullOrEmpty(Post);
+
+        public string Image { get; set; }
+
+        public string EntryPoint { get; set; }
+
+        public SequenceToken Arguments { get; set; }
+
+        public MappingToken Environment { get; set; }
+
+        public string Pre { get; set; }
+
+        public string Post { get; set; }
+    }
+
+    public sealed class CompositeActionExecutionDataNew : ActionExecutionData
+    {
+        public override ActionExecutionType ExecutionType => ActionExecutionType.Composite;
+        public override bool HasPre => PreSteps.Count > 0;
+        public override bool HasPost => PostSteps.Count > 0;
+        public List<GitHub.Actions.WorkflowParser.IStep> PreSteps { get; set; }
+        public List<GitHub.Actions.WorkflowParser.IStep> Steps { get; set; }
+        public Stack<GitHub.Actions.WorkflowParser.IStep> PostSteps { get; set; }
+        public MappingToken Outputs { get; set; }
+    }
 }
 

src/Runner.Worker/ActionManifestManagerLegacy.cs

@@ -0,0 +1,547 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using System.Reflection;
+using GitHub.DistributedTask.Pipelines.ObjectTemplating;
+using GitHub.DistributedTask.ObjectTemplating.Schema;
+using GitHub.DistributedTask.ObjectTemplating;
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using System.Linq;
+using Pipelines = GitHub.DistributedTask.Pipelines;
+
+namespace GitHub.Runner.Worker
+{
+    [ServiceLocator(Default = typeof(ActionManifestManagerLegacy))]
+    public interface IActionManifestManagerLegacy : IRunnerService
+    {
+        ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile);
+
+        DictionaryContextData EvaluateCompositeOutputs(IExecutionContext executionContext, TemplateToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+
+        List<string> EvaluateContainerArguments(IExecutionContext executionContext, SequenceToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+
+        Dictionary<string, string> EvaluateContainerEnvironment(IExecutionContext executionContext, MappingToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+
+        string EvaluateDefaultInput(IExecutionContext executionContext, string inputName, TemplateToken token);
+    }
+
+    public sealed class ActionManifestManagerLegacy : RunnerService, IActionManifestManagerLegacy
+    {
+        private TemplateSchema _actionManifestSchema;
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+
+            var assembly = Assembly.GetExecutingAssembly();
+            var json = default(string);
+            using (var stream = assembly.GetManifestResourceStream("GitHub.Runner.Worker.action_yaml.json"))
+            using (var streamReader = new StreamReader(stream))
+            {
+                json = streamReader.ReadToEnd();
+            }
+
+            var objectReader = new JsonObjectReader(null, json);
+            _actionManifestSchema = TemplateSchema.Load(objectReader);
+            ArgUtil.NotNull(_actionManifestSchema, nameof(_actionManifestSchema));
+            Trace.Info($"Load schema file with definitions: {StringUtil.ConvertToJson(_actionManifestSchema.Definitions.Keys)}");
+        }
+
+        public ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile)
+        {
+            var templateContext = CreateTemplateContext(executionContext);
+            ActionDefinitionData actionDefinition = new();
+
+            // Clean up file name real quick
+            // Instead of using Regex which can be computationally expensive, 
+            // we can just remove the # of characters from the fileName according to the length of the basePath
+            string basePath = HostContext.GetDirectory(WellKnownDirectory.Actions);
+            string fileRelativePath = manifestFile;
+            if (manifestFile.Contains(basePath))
+            {
+                fileRelativePath = manifestFile.Remove(0, basePath.Length + 1);
+            }
+
+            try
+            {
+                var token = default(TemplateToken);
+
+                // Get the file ID
+                var fileId = templateContext.GetFileId(fileRelativePath);
+
+                // Add this file to the FileTable in executionContext if it hasn't been added already
+                // we use > since fileID is 1 indexed
+                if (fileId > executionContext.Global.FileTable.Count)
+                {
+                    executionContext.Global.FileTable.Add(fileRelativePath);
+                }
+
+                // Read the file
+                var fileContent = File.ReadAllText(manifestFile);
+                using (var stringReader = new StringReader(fileContent))
+                {
+                    var yamlObjectReader = new YamlObjectReader(fileId, stringReader);
+                    token = TemplateReader.Read(templateContext, "action-root", yamlObjectReader, fileId, out _);
+                }
+
+                var actionMapping = token.AssertMapping("action manifest root");
+                var actionOutputs = default(MappingToken);
+                var actionRunValueToken = default(TemplateToken);
+
+                foreach (var actionPair in actionMapping)
+                {
+                    var propertyName = actionPair.Key.AssertString($"action.yml property key");
+
+                    switch (propertyName.Value)
+                    {
+                        case "name":
+                            actionDefinition.Name = actionPair.Value.AssertString("name").Value;
+                            break;
+
+                        case "outputs":
+                            actionOutputs = actionPair.Value.AssertMapping("outputs");
+                            break;
+
+                        case "description":
+                            actionDefinition.Description = actionPair.Value.AssertString("description").Value;
+                            break;
+
+                        case "inputs":
+                            ConvertInputs(actionPair.Value, actionDefinition);
+                            break;
+
+                        case "runs":
+                            // Defer runs token evaluation to after for loop to ensure that order of outputs doesn't matter.
+                            actionRunValueToken = actionPair.Value;
+                            break;
+
+                        default:
+                            Trace.Info($"Ignore action property {propertyName}.");
+                            break;
+                    }
+                }
+
+                // Evaluate Runs Last
+                if (actionRunValueToken != null)
+                {
+                    actionDefinition.Execution = ConvertRuns(executionContext, templateContext, actionRunValueToken, fileRelativePath, actionOutputs);
+                }
+            }
+            catch (Exception ex)
+            {
+                Trace.Error(ex);
+                templateContext.Errors.Add(ex);
+            }
+
+            if (templateContext.Errors.Count > 0)
+            {
+                foreach (var error in templateContext.Errors)
+                {
+                    Trace.Error($"Action.yml load error: {error.Message}");
+                    executionContext.Error(error.Message);
+                }
+
+                throw new ArgumentException($"Failed to load {fileRelativePath}");
+            }
+
+            if (actionDefinition.Execution == null)
+            {
+                executionContext.Debug($"Loaded action.yml file: {StringUtil.ConvertToJson(actionDefinition)}");
+                throw new ArgumentException($"Top level 'runs:' section is required for {fileRelativePath}");
+            }
+            else
+            {
+                Trace.Info($"Loaded action.yml file: {StringUtil.ConvertToJson(actionDefinition)}");
+            }
+
+            return actionDefinition;
+        }
+
+        public DictionaryContextData EvaluateCompositeOutputs(
+            IExecutionContext executionContext,
+            TemplateToken token,
+            IDictionary<string, PipelineContextData> extraExpressionValues)
+        {
+            var result = default(DictionaryContextData);
+
+            if (token != null)
+            {
+                var templateContext = CreateTemplateContext(executionContext, extraExpressionValues);
+                try
+                {
+                    token = TemplateEvaluator.Evaluate(templateContext, "outputs", token, 0, null, omitHeader: true);
+                    templateContext.Errors.Check();
+                    result = token.ToContextData().AssertDictionary("composite outputs");
+                }
+                catch (Exception ex) when (!(ex is TemplateValidationException))
+                {
+                    templateContext.Errors.Add(ex);
+                }
+
+                templateContext.Errors.Check();
+            }
+
+            return result ?? new DictionaryContextData();
+        }
+
+        public List<string> EvaluateContainerArguments(
+            IExecutionContext executionContext,
+            SequenceToken token,
+            IDictionary<string, PipelineContextData> extraExpressionValues)
+        {
+            var result = new List<string>();
+
+            if (token != null)
+            {
+                var templateContext = CreateTemplateContext(executionContext, extraExpressionValues);
+                try
+                {
+                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "container-runs-args", token, 0, null, omitHeader: true);
+                    templateContext.Errors.Check();
+
+                    Trace.Info($"Arguments evaluate result: {StringUtil.ConvertToJson(evaluateResult)}");
+
+                    // Sequence
+                    var args = evaluateResult.AssertSequence("container args");
+
+                    foreach (var arg in args)
+                    {
+                        var str = arg.AssertString("container arg").Value;
+                        result.Add(str);
+                        Trace.Info($"Add argument {str}");
+                    }
+                }
+                catch (Exception ex) when (!(ex is TemplateValidationException))
+                {
+                    Trace.Error(ex);
+                    templateContext.Errors.Add(ex);
+                }
+
+                templateContext.Errors.Check();
+            }
+
+            return result;
+        }
+
+        public Dictionary<string, string> EvaluateContainerEnvironment(
+            IExecutionContext executionContext,
+            MappingToken token,
+            IDictionary<string, PipelineContextData> extraExpressionValues)
+        {
+            var result = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
+            if (token != null)
+            {
+                var templateContext = CreateTemplateContext(executionContext, extraExpressionValues);
+                try
+                {
+                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "container-runs-env", token, 0, null, omitHeader: true);
+                    templateContext.Errors.Check();
+
+                    Trace.Info($"Environments evaluate result: {StringUtil.ConvertToJson(evaluateResult)}");
+
+                    // Mapping
+                    var mapping = evaluateResult.AssertMapping("container env");
+
+                    foreach (var pair in mapping)
+                    {
+                        // Literal key
+                        var key = pair.Key.AssertString("container env key");
+
+                        // Literal value
+                        var value = pair.Value.AssertString("container env value");
+                        result[key.Value] = value.Value;
+
+                        Trace.Info($"Add env {key} = {value}");
+                    }
+                }
+                catch (Exception ex) when (!(ex is TemplateValidationException))
+                {
+                    Trace.Error(ex);
+                    templateContext.Errors.Add(ex);
+                }
+
+                templateContext.Errors.Check();
+            }
+
+            return result;
+        }
+
+        public string EvaluateDefaultInput(
+            IExecutionContext executionContext,
+            string inputName,
+            TemplateToken token)
+        {
+            string result = "";
+            if (token != null)
+            {
+                var templateContext = CreateTemplateContext(executionContext);
+                try
+                {
+                    var evaluateResult = TemplateEvaluator.Evaluate(templateContext, "input-default-context", token, 0, null, omitHeader: true);
+                    templateContext.Errors.Check();
+
+                    Trace.Info($"Input '{inputName}': default value evaluate result: {StringUtil.ConvertToJson(evaluateResult)}");
+
+                    // String
+                    result = evaluateResult.AssertString($"default value for input '{inputName}'").Value;
+                }
+                catch (Exception ex) when (!(ex is TemplateValidationException))
+                {
+                    Trace.Error(ex);
+                    templateContext.Errors.Add(ex);
+                }
+
+                templateContext.Errors.Check();
+            }
+
+            return result;
+        }
+
+        private TemplateContext CreateTemplateContext(
+            IExecutionContext executionContext,
+            IDictionary<string, PipelineContextData> extraExpressionValues = null)
+        {
+            var result = new TemplateContext
+            {
+                CancellationToken = CancellationToken.None,
+                Errors = new TemplateValidationErrors(10, int.MaxValue), // Don't truncate error messages otherwise we might not scrub secrets correctly
+                Memory = new TemplateMemory(
+                    maxDepth: 100,
+                    maxEvents: 1000000,
+                    maxBytes: 10 * 1024 * 1024),
+                Schema = _actionManifestSchema,
+                TraceWriter = executionContext.ToTemplateTraceWriter(),
+                AllowCaseFunction = false,
+            };
+
+            // Expression values from execution context
+            foreach (var pair in executionContext.ExpressionValues)
+            {
+                result.ExpressionValues[pair.Key] = pair.Value;
+            }
+
+            // Extra expression values
+            if (extraExpressionValues?.Count > 0)
+            {
+                foreach (var pair in extraExpressionValues)
+                {
+                    result.ExpressionValues[pair.Key] = pair.Value;
+                }
+            }
+
+            // Expression functions from execution context
+            foreach (var item in executionContext.ExpressionFunctions)
+            {
+                result.ExpressionFunctions.Add(item);
+            }
+
+            // Add the file table from the Execution Context
+            for (var i = 0; i < executionContext.Global.FileTable.Count; i++)
+            {
+                result.GetFileId(executionContext.Global.FileTable[i]);
+            }
+
+            return result;
+        }
+
+        private ActionExecutionData ConvertRuns(
+            IExecutionContext executionContext,
+            TemplateContext templateContext,
+            TemplateToken inputsToken,
+            String fileRelativePath,
+            MappingToken outputs = null)
+        {
+            var runsMapping = inputsToken.AssertMapping("runs");
+            var usingToken = default(StringToken);
+            var imageToken = default(StringToken);
+            var argsToken = default(SequenceToken);
+            var entrypointToken = default(StringToken);
+            var envToken = default(MappingToken);
+            var mainToken = default(StringToken);
+            var pluginToken = default(StringToken);
+            var preToken = default(StringToken);
+            var preEntrypointToken = default(StringToken);
+            var preIfToken = default(StringToken);
+            var postToken = default(StringToken);
+            var postEntrypointToken = default(StringToken);
+            var postIfToken = default(StringToken);
+            var steps = default(List<Pipelines.Step>);
+
+            foreach (var run in runsMapping)
+            {
+                var runsKey = run.Key.AssertString("runs key").Value;
+                switch (runsKey)
+                {
+                    case "using":
+                        usingToken = run.Value.AssertString("using");
+                        break;
+                    case "image":
+                        imageToken = run.Value.AssertString("image");
+                        break;
+                    case "args":
+                        argsToken = run.Value.AssertSequence("args");
+                        break;
+                    case "entrypoint":
+                        entrypointToken = run.Value.AssertString("entrypoint");
+                        break;
+                    case "env":
+                        envToken = run.Value.AssertMapping("env");
+                        break;
+                    case "main":
+                        mainToken = run.Value.AssertString("main");
+                        break;
+                    case "plugin":
+                        pluginToken = run.Value.AssertString("plugin");
+                        break;
+                    case "post":
+                        postToken = run.Value.AssertString("post");
+                        break;
+                    case "post-entrypoint":
+                        postEntrypointToken = run.Value.AssertString("post-entrypoint");
+                        break;
+                    case "post-if":
+                        postIfToken = run.Value.AssertString("post-if");
+                        break;
+                    case "pre":
+                        preToken = run.Value.AssertString("pre");
+                        break;
+                    case "pre-entrypoint":
+                        preEntrypointToken = run.Value.AssertString("pre-entrypoint");
+                        break;
+                    case "pre-if":
+                        preIfToken = run.Value.AssertString("pre-if");
+                        break;
+                    case "steps":
+                        var stepsToken = run.Value.AssertSequence("steps");
+                        steps = PipelineTemplateConverter.ConvertToSteps(templateContext, stepsToken);
+                        templateContext.Errors.Check();
+                        break;
+                    default:
+                        Trace.Info($"Ignore run property {runsKey}.");
+                        break;
+                }
+            }
+
+            if (usingToken != null)
+            {
+                if (string.Equals(usingToken.Value, "docker", StringComparison.OrdinalIgnoreCase))
+                {
+                    if (string.IsNullOrEmpty(imageToken?.Value))
+                    {
+                        throw new ArgumentNullException($"You are using a Container Action but an image is not provided in {fileRelativePath}.");
+                    }
+                    else
+                    {
+                        return new ContainerActionExecutionData()
+                        {
+                            Image = imageToken.Value,
+                            Arguments = argsToken,
+                            EntryPoint = entrypointToken?.Value,
+                            Environment = envToken,
+                            Pre = preEntrypointToken?.Value,
+                            InitCondition = preIfToken?.Value ?? "always()",
+                            Post = postEntrypointToken?.Value,
+                            CleanupCondition = postIfToken?.Value ?? "always()"
+                        };
+                    }
+                }
+                else if (string.Equals(usingToken.Value, "node12", StringComparison.OrdinalIgnoreCase) ||
+                         string.Equals(usingToken.Value, "node16", StringComparison.OrdinalIgnoreCase) ||
+                         string.Equals(usingToken.Value, "node20", StringComparison.OrdinalIgnoreCase) ||
+                         string.Equals(usingToken.Value, "node24", StringComparison.OrdinalIgnoreCase))
+                {
+                    if (string.IsNullOrEmpty(mainToken?.Value))
+                    {
+                        throw new ArgumentNullException($"You are using a JavaScript Action but there is not an entry JavaScript file provided in {fileRelativePath}.");
+                    }
+                    else
+                    {
+                        return new NodeJSActionExecutionData()
+                        {
+                            NodeVersion = usingToken.Value,
+                            Script = mainToken.Value,
+                            Pre = preToken?.Value,
+                            InitCondition = preIfToken?.Value ?? "always()",
+                            Post = postToken?.Value,
+                            CleanupCondition = postIfToken?.Value ?? "always()"
+                        };
+                    }
+                }
+                else if (string.Equals(usingToken.Value, "composite", StringComparison.OrdinalIgnoreCase))
+                {
+                    if (steps == null)
+                    {
+                        throw new ArgumentNullException($"You are using a composite action but there are no steps provided in {fileRelativePath}.");
+                    }
+                    else
+                    {
+                        return new CompositeActionExecutionData()
+                        {
+                            Steps = steps.Cast<Pipelines.ActionStep>().ToList(),
+                            PreSteps = new List<Pipelines.ActionStep>(),
+                            PostSteps = new Stack<Pipelines.ActionStep>(),
+                            InitCondition = "always()",
+                            CleanupCondition = "always()",
+                            Outputs = outputs
+                        };
+                    }
+                }
+                else
+                {
+                    throw new ArgumentOutOfRangeException($"'using: {usingToken.Value}' is not supported, use 'docker', 'node12', 'node16', 'node20' or 'node24' instead.");
+                }
+            }
+            else if (pluginToken != null)
+            {
+                return new PluginActionExecutionData()
+                {
+                    Plugin = pluginToken.Value
+                };
+            }
+
+            throw new NotSupportedException("Missing 'using' value. 'using' requires 'composite', 'docker', 'node12', 'node16', 'node20' or 'node24'.");
+        }
+
+        private void ConvertInputs(
+            TemplateToken inputsToken,
+            ActionDefinitionData actionDefinition)
+        {
+            actionDefinition.Inputs = new MappingToken(null, null, null);
+            var inputsMapping = inputsToken.AssertMapping("inputs");
+            foreach (var input in inputsMapping)
+            {
+                bool hasDefault = false;
+                var inputName = input.Key.AssertString("input name");
+                var inputMetadata = input.Value.AssertMapping("input metadata");
+                foreach (var metadata in inputMetadata)
+                {
+                    var metadataName = metadata.Key.AssertString("input metadata").Value;
+                    if (string.Equals(metadataName, "default", StringComparison.OrdinalIgnoreCase))
+                    {
+                        hasDefault = true;
+                        actionDefinition.Inputs.Add(inputName, metadata.Value);
+                    }
+                    else if (string.Equals(metadataName, "deprecationMessage", StringComparison.OrdinalIgnoreCase))
+                    {
+                        if (actionDefinition.Deprecated == null)
+                        {
+                            actionDefinition.Deprecated = new Dictionary<String, String>();
+                        }
+                        var message = metadata.Value.AssertString("input deprecationMessage");
+                        actionDefinition.Deprecated.Add(inputName.Value, message.Value);
+                    }
+                }
+
+                if (!hasDefault)
+                {
+                    actionDefinition.Inputs.Add(inputName, new StringToken(null, null, null, string.Empty));
+                }
+            }
+        }
+    }
+}
+

src/Runner.Worker/ActionManifestManagerWrapper.cs

@@ -0,0 +1,852 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using GitHub.Actions.WorkflowParser;
+using GitHub.DistributedTask.Pipelines;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using ObjectTemplating = GitHub.DistributedTask.ObjectTemplating;
+
+namespace GitHub.Runner.Worker
+{
+    [ServiceLocator(Default = typeof(ActionManifestManagerWrapper))]
+    public interface IActionManifestManagerWrapper : IRunnerService
+    {
+        ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile);
+
+        DictionaryContextData EvaluateCompositeOutputs(IExecutionContext executionContext, TemplateToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+
+        List<string> EvaluateContainerArguments(IExecutionContext executionContext, SequenceToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+
+        Dictionary<string, string> EvaluateContainerEnvironment(IExecutionContext executionContext, MappingToken token, IDictionary<string, PipelineContextData> extraExpressionValues);
+
+        string EvaluateDefaultInput(IExecutionContext executionContext, string inputName, TemplateToken token);
+    }
+
+    public sealed class ActionManifestManagerWrapper : RunnerService, IActionManifestManagerWrapper
+    {
+        private IActionManifestManagerLegacy _legacyManager;
+        private IActionManifestManager _newManager;
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _legacyManager = hostContext.GetService<IActionManifestManagerLegacy>();
+            _newManager = hostContext.GetService<IActionManifestManager>();
+        }
+
+        public ActionDefinitionData Load(IExecutionContext executionContext, string manifestFile)
+        {
+            return EvaluateAndCompare(
+                executionContext,
+                "Load",
+                () => _legacyManager.Load(executionContext, manifestFile),
+                () => ConvertToLegacyActionDefinitionData(_newManager.Load(executionContext, manifestFile)),
+                (legacyResult, newResult) => CompareActionDefinition(legacyResult, newResult));
+        }
+
+        public DictionaryContextData EvaluateCompositeOutputs(
+            IExecutionContext executionContext,
+            TemplateToken token,
+            IDictionary<string, PipelineContextData> extraExpressionValues)
+        {
+            return EvaluateAndCompare(
+                executionContext,
+                "EvaluateCompositeOutputs",
+                () => _legacyManager.EvaluateCompositeOutputs(executionContext, token, extraExpressionValues),
+                () => ConvertToLegacyContextData<DictionaryContextData>(_newManager.EvaluateCompositeOutputs(executionContext, ConvertToNewToken(token), ConvertToNewExpressionValues(extraExpressionValues))),
+                (legacyResult, newResult) => CompareDictionaryContextData(legacyResult, newResult));
+        }
+
+        public List<string> EvaluateContainerArguments(
+            IExecutionContext executionContext,
+            SequenceToken token,
+            IDictionary<string, PipelineContextData> extraExpressionValues)
+        {
+            return EvaluateAndCompare(
+                executionContext,
+                "EvaluateContainerArguments",
+                () => _legacyManager.EvaluateContainerArguments(executionContext, token, extraExpressionValues),
+                () => _newManager.EvaluateContainerArguments(executionContext, ConvertToNewToken(token) as GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.SequenceToken, ConvertToNewExpressionValues(extraExpressionValues)),
+                (legacyResult, newResult) => CompareLists(legacyResult, newResult, "ContainerArguments"));
+        }
+
+        public Dictionary<string, string> EvaluateContainerEnvironment(
+            IExecutionContext executionContext,
+            MappingToken token,
+            IDictionary<string, PipelineContextData> extraExpressionValues)
+        {
+            return EvaluateAndCompare(
+                executionContext,
+                "EvaluateContainerEnvironment",
+                () => _legacyManager.EvaluateContainerEnvironment(executionContext, token, extraExpressionValues),
+                () => _newManager.EvaluateContainerEnvironment(executionContext, ConvertToNewToken(token) as GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.MappingToken, ConvertToNewExpressionValues(extraExpressionValues)),
+                (legacyResult, newResult) =>
+                {
+                    var trace = HostContext.GetTrace(nameof(ActionManifestManagerWrapper));
+                    return CompareDictionaries(trace, legacyResult, newResult, "ContainerEnvironment");
+                });
+        }
+
+        public string EvaluateDefaultInput(
+            IExecutionContext executionContext,
+            string inputName,
+            TemplateToken token)
+        {
+            return EvaluateAndCompare(
+                executionContext,
+                "EvaluateDefaultInput",
+                () => _legacyManager.EvaluateDefaultInput(executionContext, inputName, token),
+                () => _newManager.EvaluateDefaultInput(executionContext, inputName, ConvertToNewToken(token)),
+                (legacyResult, newResult) => string.Equals(legacyResult, newResult, StringComparison.Ordinal));
+        }
+
+        // Conversion helper methods
+        private ActionDefinitionData ConvertToLegacyActionDefinitionData(ActionDefinitionDataNew newData)
+        {
+            if (newData == null)
+            {
+                return null;
+            }
+
+            return new ActionDefinitionData
+            {
+                Name = newData.Name,
+                Description = newData.Description,
+                Inputs = ConvertToLegacyToken<MappingToken>(newData.Inputs),
+                Deprecated = newData.Deprecated,
+                Execution = ConvertToLegacyExecution(newData.Execution)
+            };
+        }
+
+        private ActionExecutionData ConvertToLegacyExecution(ActionExecutionData execution)
+        {
+            if (execution == null)
+            {
+                return null;
+            }
+
+            // Handle different execution types
+            if (execution is ContainerActionExecutionDataNew containerNew)
+            {
+                return new ContainerActionExecutionData
+                {
+                    Image = containerNew.Image,
+                    EntryPoint = containerNew.EntryPoint,
+                    Arguments = ConvertToLegacyToken<SequenceToken>(containerNew.Arguments),
+                    Environment = ConvertToLegacyToken<MappingToken>(containerNew.Environment),
+                    Pre = containerNew.Pre,
+                    Post = containerNew.Post,
+                    InitCondition = containerNew.InitCondition,
+                    CleanupCondition = containerNew.CleanupCondition
+                };
+            }
+            else if (execution is CompositeActionExecutionDataNew compositeNew)
+            {
+                return new CompositeActionExecutionData
+                {
+                    Steps = ConvertToLegacySteps(compositeNew.Steps),
+                    Outputs = ConvertToLegacyToken<MappingToken>(compositeNew.Outputs)
+                };
+            }
+            else
+            {
+                // For NodeJS and Plugin execution, they don't use new token types, so just return as-is
+                return execution;
+            }
+        }
+
+        private List<GitHub.DistributedTask.Pipelines.ActionStep> ConvertToLegacySteps(List<GitHub.Actions.WorkflowParser.IStep> newSteps)
+        {
+            if (newSteps == null)
+            {
+                return null;
+            }
+
+            var result = new List<GitHub.DistributedTask.Pipelines.ActionStep>();
+            foreach (var step in newSteps)
+            {
+                var actionStep = new GitHub.DistributedTask.Pipelines.ActionStep
+                {
+                    ContextName = step.Id,
+                };
+
+                if (step is GitHub.Actions.WorkflowParser.RunStep runStep)
+                {
+                    actionStep.Condition = ExtractConditionString(runStep.If);
+                    actionStep.DisplayNameToken = ConvertToLegacyToken<TemplateToken>(runStep.Name);
+                    actionStep.ContinueOnError = ConvertToLegacyToken<TemplateToken>(runStep.ContinueOnError);
+                    actionStep.TimeoutInMinutes = ConvertToLegacyToken<TemplateToken>(runStep.TimeoutMinutes);
+                    actionStep.Environment = ConvertToLegacyToken<TemplateToken>(runStep.Env);
+                    actionStep.Reference = new GitHub.DistributedTask.Pipelines.ScriptReference();
+                    actionStep.Inputs = BuildRunStepInputs(runStep);
+                }
+                else if (step is GitHub.Actions.WorkflowParser.ActionStep usesStep)
+                {
+                    actionStep.Condition = ExtractConditionString(usesStep.If);
+                    actionStep.DisplayNameToken = ConvertToLegacyToken<TemplateToken>(usesStep.Name);
+                    actionStep.ContinueOnError = ConvertToLegacyToken<TemplateToken>(usesStep.ContinueOnError);
+                    actionStep.TimeoutInMinutes = ConvertToLegacyToken<TemplateToken>(usesStep.TimeoutMinutes);
+                    actionStep.Environment = ConvertToLegacyToken<TemplateToken>(usesStep.Env);
+                    actionStep.Reference = ParseActionReference(usesStep.Uses?.Value);
+                    actionStep.Inputs = ConvertToLegacyToken<MappingToken>(usesStep.With);
+                }
+
+                result.Add(actionStep);
+            }
+            return result;
+        }
+
+        private string ExtractConditionString(GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.BasicExpressionToken ifToken)
+        {
+            if (ifToken == null)
+            {
+                return null;
+            }
+
+            // The Expression property is internal, so we use ToString() which formats as "${{ expr }}"
+            // Then strip the delimiters to get just the expression
+            var str = ifToken.ToString();
+            if (str.StartsWith("${{") && str.EndsWith("}}"))
+            {
+                return str.Substring(3, str.Length - 5).Trim();
+            }
+            return str;
+        }
+
+        private MappingToken BuildRunStepInputs(GitHub.Actions.WorkflowParser.RunStep runStep)
+        {
+            var inputs = new MappingToken(null, null, null);
+
+            // script (from run)
+            if (runStep.Run != null)
+            {
+                inputs.Add(
+                    new StringToken(null, null, null, "script"),
+                    ConvertToLegacyToken<TemplateToken>(runStep.Run));
+            }
+
+            // shell
+            if (runStep.Shell != null)
+            {
+                inputs.Add(
+                    new StringToken(null, null, null, "shell"),
+                    ConvertToLegacyToken<TemplateToken>(runStep.Shell));
+            }
+
+            // working-directory
+            if (runStep.WorkingDirectory != null)
+            {
+                inputs.Add(
+                    new StringToken(null, null, null, "workingDirectory"),
+                    ConvertToLegacyToken<TemplateToken>(runStep.WorkingDirectory));
+            }
+
+            return inputs.Count > 0 ? inputs : null;
+        }
+
+        private GitHub.DistributedTask.Pipelines.ActionStepDefinitionReference ParseActionReference(string uses)
+        {
+            if (string.IsNullOrEmpty(uses))
+            {
+                return null;
+            }
+
+            // Docker reference: docker://image:tag
+            if (uses.StartsWith("docker://", StringComparison.OrdinalIgnoreCase))
+            {
+                return new GitHub.DistributedTask.Pipelines.ContainerRegistryReference
+                {
+                    Image = uses.Substring("docker://".Length)
+                };
+            }
+
+            // Local path reference: ./path/to/action
+            if (uses.StartsWith("./") || uses.StartsWith(".\\"))
+            {
+                return new GitHub.DistributedTask.Pipelines.RepositoryPathReference
+                {
+                    RepositoryType = "self",
+                    Path = uses
+                };
+            }
+
+            // Repository reference: owner/repo@ref or owner/repo/path@ref
+            var atIndex = uses.LastIndexOf('@');
+            string refPart = null;
+            string repoPart = uses;
+
+            if (atIndex > 0)
+            {
+                refPart = uses.Substring(atIndex + 1);
+                repoPart = uses.Substring(0, atIndex);
+            }
+
+            // Split by / to get owner/repo and optional path
+            var parts = repoPart.Split('/');
+            string name;
+            string path = null;
+
+            if (parts.Length >= 2)
+            {
+                name = $"{parts[0]}/{parts[1]}";
+                if (parts.Length > 2)
+                {
+                    path = string.Join("/", parts, 2, parts.Length - 2);
+                }
+            }
+            else
+            {
+                name = repoPart;
+            }
+
+            return new GitHub.DistributedTask.Pipelines.RepositoryPathReference
+            {
+                RepositoryType = "GitHub",
+                Name = name,
+                Ref = refPart,
+                Path = path
+            };
+        }
+
+        private T ConvertToLegacyToken<T>(GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.TemplateToken newToken) where T : TemplateToken
+        {
+            if (newToken == null)
+            {
+                return null;
+            }
+
+            // Serialize and deserialize to convert between token types
+            var json = StringUtil.ConvertToJson(newToken, Newtonsoft.Json.Formatting.None);
+            return StringUtil.ConvertFromJson<T>(json);
+        }
+
+        private GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.TemplateToken ConvertToNewToken(TemplateToken legacyToken)
+        {
+            if (legacyToken == null)
+            {
+                return null;
+            }
+
+            var json = StringUtil.ConvertToJson(legacyToken, Newtonsoft.Json.Formatting.None);
+            return StringUtil.ConvertFromJson<GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.TemplateToken>(json);
+        }
+
+        private IDictionary<string, GitHub.Actions.Expressions.Data.ExpressionData> ConvertToNewExpressionValues(IDictionary<string, PipelineContextData> legacyValues)
+        {
+            if (legacyValues == null)
+            {
+                return null;
+            }
+
+            var json = StringUtil.ConvertToJson(legacyValues, Newtonsoft.Json.Formatting.None);
+            return StringUtil.ConvertFromJson<IDictionary<string, GitHub.Actions.Expressions.Data.ExpressionData>>(json);
+        }
+
+        private T ConvertToLegacyContextData<T>(GitHub.Actions.Expressions.Data.ExpressionData newData) where T : PipelineContextData
+        {
+            if (newData == null)
+            {
+                return null;
+            }
+
+            var json = StringUtil.ConvertToJson(newData, Newtonsoft.Json.Formatting.None);
+            return StringUtil.ConvertFromJson<T>(json);
+        }
+
+        // Comparison helper methods
+        private TLegacy EvaluateAndCompare<TLegacy, TNew>(
+            IExecutionContext context,
+            string methodName,
+            Func<TLegacy> legacyEvaluator,
+            Func<TNew> newEvaluator,
+            Func<TLegacy, TNew, bool> resultComparer)
+        {
+            // Legacy only?
+            if (!((context.Global.Variables.GetBoolean(Constants.Runner.Features.CompareWorkflowParser) ?? false)
+                || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_COMPARE_WORKFLOW_PARSER"))))
+            {
+                return legacyEvaluator();
+            }
+
+            var trace = HostContext.GetTrace(nameof(ActionManifestManagerWrapper));
+
+            // Legacy evaluator
+            var legacyException = default(Exception);
+            var legacyResult = default(TLegacy);
+            try
+            {
+                legacyResult = legacyEvaluator();
+            }
+            catch (Exception ex)
+            {
+                legacyException = ex;
+            }
+
+            // Compare with new evaluator
+            try
+            {
+                ArgUtil.NotNull(context, nameof(context));
+                trace.Info(methodName);
+
+                // New evaluator
+                var newException = default(Exception);
+                var newResult = default(TNew);
+                try
+                {
+                    newResult = newEvaluator();
+                }
+                catch (Exception ex)
+                {
+                    newException = ex;
+                }
+
+                // Compare results or exceptions
+                if (legacyException != null || newException != null)
+                {
+                    // Either one or both threw exceptions - compare them
+                    if (!CompareExceptions(trace, legacyException, newException))
+                    {
+                        trace.Info($"{methodName} exception mismatch");
+                        RecordMismatch(context, $"{methodName}");
+                    }
+                }
+                else
+                {
+                    // Both succeeded - compare results
+                    // Skip comparison if new implementation returns null (not yet implemented)
+                    if (newResult != null && !resultComparer(legacyResult, newResult))
+                    {
+                        trace.Info($"{methodName} mismatch");
+                        RecordMismatch(context, $"{methodName}");
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                trace.Info($"Comparison failed: {ex.Message}");
+                RecordComparisonError(context, $"{methodName}: {ex.Message}");
+            }
+
+            // Re-throw legacy exception if any
+            if (legacyException != null)
+            {
+                throw legacyException;
+            }
+
+            return legacyResult;
+        }
+
+        private void RecordMismatch(IExecutionContext context, string methodName)
+        {
+            if (!context.Global.HasActionManifestMismatch)
+            {
+                context.Global.HasActionManifestMismatch = true;
+                var telemetry = new JobTelemetry { Type = JobTelemetryType.General, Message = $"ActionManifestMismatch: {methodName}" };
+                context.Global.JobTelemetry.Add(telemetry);
+            }
+        }
+
+        private void RecordComparisonError(IExecutionContext context, string errorDetails)
+        {
+            if (!context.Global.HasActionManifestMismatch)
+            {
+                context.Global.HasActionManifestMismatch = true;
+                var telemetry = new JobTelemetry { Type = JobTelemetryType.General, Message = $"ActionManifestComparisonError: {errorDetails}" };
+                context.Global.JobTelemetry.Add(telemetry);
+            }
+        }
+
+        private bool CompareActionDefinition(ActionDefinitionData legacyResult, ActionDefinitionData newResult)
+        {
+            var trace = HostContext.GetTrace(nameof(ActionManifestManagerWrapper));
+            if (legacyResult == null && newResult == null)
+            {
+                return true;
+            }
+
+            if (legacyResult == null || newResult == null)
+            {
+                trace.Info($"CompareActionDefinition mismatch - one result is null (legacy={legacyResult == null}, new={newResult == null})");
+                return false;
+            }
+
+            if (!string.Equals(legacyResult.Name, newResult.Name, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareActionDefinition mismatch - Name differs (legacy='{legacyResult.Name}', new='{newResult.Name}')");
+                return false;
+            }
+
+            if (!string.Equals(legacyResult.Description, newResult.Description, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareActionDefinition mismatch - Description differs (legacy='{legacyResult.Description}', new='{newResult.Description}')");
+                return false;
+            }
+
+            // Compare Inputs token
+            var legacyInputsJson = legacyResult.Inputs != null ? StringUtil.ConvertToJson(legacyResult.Inputs) : null;
+            var newInputsJson = newResult.Inputs != null ? StringUtil.ConvertToJson(newResult.Inputs) : null;
+            if (!string.Equals(legacyInputsJson, newInputsJson, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareActionDefinition mismatch - Inputs differ");
+                return false;
+            }
+
+            // Compare Deprecated
+            if (!CompareDictionaries(trace, legacyResult.Deprecated, newResult.Deprecated, "Deprecated"))
+            {
+                return false;
+            }
+
+            // Compare Execution
+            if (!CompareExecution(trace, legacyResult.Execution, newResult.Execution))
+            {
+                return false;
+            }
+
+            return true;
+        }
+
+        private bool CompareExecution(Tracing trace, ActionExecutionData legacy, ActionExecutionData newExecution)
+        {
+            if (legacy == null && newExecution == null)
+            {
+                return true;
+            }
+
+            if (legacy == null || newExecution == null)
+            {
+                trace.Info($"CompareExecution mismatch - one is null (legacy={legacy == null}, new={newExecution == null})");
+                return false;
+            }
+
+            if (legacy.GetType() != newExecution.GetType())
+            {
+                trace.Info($"CompareExecution mismatch - different types (legacy={legacy.GetType().Name}, new={newExecution.GetType().Name})");
+                return false;
+            }
+
+            // Compare based on type
+            if (legacy is NodeJSActionExecutionData legacyNode && newExecution is NodeJSActionExecutionData newNode)
+            {
+                return CompareNodeJSExecution(trace, legacyNode, newNode);
+            }
+            else if (legacy is ContainerActionExecutionData legacyContainer && newExecution is ContainerActionExecutionData newContainer)
+            {
+                return CompareContainerExecution(trace, legacyContainer, newContainer);
+            }
+            else if (legacy is CompositeActionExecutionData legacyComposite && newExecution is CompositeActionExecutionData newComposite)
+            {
+                return CompareCompositeExecution(trace, legacyComposite, newComposite);
+            }
+            else if (legacy is PluginActionExecutionData legacyPlugin && newExecution is PluginActionExecutionData newPlugin)
+            {
+                return ComparePluginExecution(trace, legacyPlugin, newPlugin);
+            }
+
+            return true;
+        }
+
+        private bool CompareNodeJSExecution(Tracing trace, NodeJSActionExecutionData legacy, NodeJSActionExecutionData newExecution)
+        {
+            if (!string.Equals(legacy.NodeVersion, newExecution.NodeVersion, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareNodeJSExecution mismatch - NodeVersion differs (legacy='{legacy.NodeVersion}', new='{newExecution.NodeVersion}')");
+                return false;
+            }
+
+            if (!string.Equals(legacy.Script, newExecution.Script, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareNodeJSExecution mismatch - Script differs (legacy='{legacy.Script}', new='{newExecution.Script}')");
+                return false;
+            }
+
+            if (!string.Equals(legacy.Pre, newExecution.Pre, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareNodeJSExecution mismatch - Pre differs");
+                return false;
+            }
+
+            if (!string.Equals(legacy.Post, newExecution.Post, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareNodeJSExecution mismatch - Post differs");
+                return false;
+            }
+
+            if (!string.Equals(legacy.InitCondition, newExecution.InitCondition, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareNodeJSExecution mismatch - InitCondition differs");
+                return false;
+            }
+
+            if (!string.Equals(legacy.CleanupCondition, newExecution.CleanupCondition, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareNodeJSExecution mismatch - CleanupCondition differs");
+                return false;
+            }
+
+            return true;
+        }
+
+        private bool CompareContainerExecution(Tracing trace, ContainerActionExecutionData legacy, ContainerActionExecutionData newExecution)
+        {
+            if (!string.Equals(legacy.Image, newExecution.Image, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareContainerExecution mismatch - Image differs");
+                return false;
+            }
+
+            if (!string.Equals(legacy.EntryPoint, newExecution.EntryPoint, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareContainerExecution mismatch - EntryPoint differs");
+                return false;
+            }
+
+            // Compare Arguments token
+            var legacyArgsJson = legacy.Arguments != null ? StringUtil.ConvertToJson(legacy.Arguments) : null;
+            var newArgsJson = newExecution.Arguments != null ? StringUtil.ConvertToJson(newExecution.Arguments) : null;
+            if (!string.Equals(legacyArgsJson, newArgsJson, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareContainerExecution mismatch - Arguments differ");
+                return false;
+            }
+
+            // Compare Environment token
+            var legacyEnvJson = legacy.Environment != null ? StringUtil.ConvertToJson(legacy.Environment) : null;
+            var newEnvJson = newExecution.Environment != null ? StringUtil.ConvertToJson(newExecution.Environment) : null;
+            if (!string.Equals(legacyEnvJson, newEnvJson, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareContainerExecution mismatch - Environment differs");
+                return false;
+            }
+
+            return true;
+        }
+
+        private bool CompareCompositeExecution(Tracing trace, CompositeActionExecutionData legacy, CompositeActionExecutionData newExecution)
+        {
+            // Compare Steps
+            if (legacy.Steps?.Count != newExecution.Steps?.Count)
+            {
+                trace.Info($"CompareCompositeExecution mismatch - Steps.Count differs (legacy={legacy.Steps?.Count}, new={newExecution.Steps?.Count})");
+                return false;
+            }
+
+            // Compare Outputs token
+            var legacyOutputsJson = legacy.Outputs != null ? StringUtil.ConvertToJson(legacy.Outputs) : null;
+            var newOutputsJson = newExecution.Outputs != null ? StringUtil.ConvertToJson(newExecution.Outputs) : null;
+            if (!string.Equals(legacyOutputsJson, newOutputsJson, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareCompositeExecution mismatch - Outputs differ");
+                return false;
+            }
+
+            return true;
+        }
+
+        private bool ComparePluginExecution(Tracing trace, PluginActionExecutionData legacy, PluginActionExecutionData newExecution)
+        {
+            if (!string.Equals(legacy.Plugin, newExecution.Plugin, StringComparison.Ordinal))
+            {
+                trace.Info($"ComparePluginExecution mismatch - Plugin differs");
+                return false;
+            }
+
+            return true;
+        }
+
+        private bool CompareDictionaryContextData(DictionaryContextData legacy, DictionaryContextData newData)
+        {
+            var trace = HostContext.GetTrace(nameof(ActionManifestManagerWrapper));
+            if (legacy == null && newData == null)
+            {
+                return true;
+            }
+
+            if (legacy == null || newData == null)
+            {
+                trace.Info($"CompareDictionaryContextData mismatch - one is null (legacy={legacy == null}, new={newData == null})");
+                return false;
+            }
+
+            var legacyJson = StringUtil.ConvertToJson(legacy);
+            var newJson = StringUtil.ConvertToJson(newData);
+
+            if (!string.Equals(legacyJson, newJson, StringComparison.Ordinal))
+            {
+                trace.Info($"CompareDictionaryContextData mismatch");
+                return false;
+            }
+
+            return true;
+        }
+
+        private bool CompareLists(IList<string> legacyList, IList<string> newList, string fieldName)
+        {
+            var trace = HostContext.GetTrace(nameof(ActionManifestManagerWrapper));
+            if (legacyList == null && newList == null)
+            {
+                return true;
+            }
+
+            if (legacyList == null || newList == null)
+            {
+                trace.Info($"CompareLists mismatch - {fieldName} - one is null (legacy={legacyList == null}, new={newList == null})");
+                return false;
+            }
+
+            if (legacyList.Count != newList.Count)
+            {
+                trace.Info($"CompareLists mismatch - {fieldName}.Count differs (legacy={legacyList.Count}, new={newList.Count})");
+                return false;
+            }
+
+            for (int i = 0; i < legacyList.Count; i++)
+            {
+                if (!string.Equals(legacyList[i], newList[i], StringComparison.Ordinal))
+                {
+                    trace.Info($"CompareLists mismatch - {fieldName}[{i}] differs (legacy='{legacyList[i]}', new='{newList[i]}')");
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        private bool CompareDictionaries(Tracing trace, IDictionary<string, string> legacyDict, IDictionary<string, string> newDict, string fieldName)
+        {
+            if (legacyDict == null && newDict == null)
+            {
+                return true;
+            }
+
+            if (legacyDict == null || newDict == null)
+            {
+                trace.Info($"CompareDictionaries mismatch - {fieldName} - one is null (legacy={legacyDict == null}, new={newDict == null})");
+                return false;
+            }
+
+            if (legacyDict is Dictionary<string, string> legacyTypedDict && newDict is Dictionary<string, string> newTypedDict)
+            {
+                if (!object.Equals(legacyTypedDict.Comparer, newTypedDict.Comparer))
+                {
+                    trace.Info($"CompareDictionaries mismatch - {fieldName} - different comparers (legacy={legacyTypedDict.Comparer.GetType().Name}, new={newTypedDict.Comparer.GetType().Name})");
+                    return false;
+                }
+            }
+
+            if (legacyDict.Count != newDict.Count)
+            {
+                trace.Info($"CompareDictionaries mismatch - {fieldName}.Count differs (legacy={legacyDict.Count}, new={newDict.Count})");
+                return false;
+            }
+
+            foreach (var kvp in legacyDict)
+            {
+                if (!newDict.TryGetValue(kvp.Key, out var newValue))
+                {
+                    trace.Info($"CompareDictionaries mismatch - {fieldName} - key '{kvp.Key}' missing in new result");
+                    return false;
+                }
+
+                if (!string.Equals(kvp.Value, newValue, StringComparison.Ordinal))
+                {
+                    trace.Info($"CompareDictionaries mismatch - {fieldName}['{kvp.Key}'] differs (legacy='{kvp.Value}', new='{newValue}')");
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        private bool CompareExceptions(Tracing trace, Exception legacyException, Exception newException)
+        {
+            if (legacyException == null && newException == null)
+            {
+                return true;
+            }
+
+            if (legacyException == null || newException == null)
+            {
+                trace.Info($"CompareExceptions mismatch - one exception is null (legacy={legacyException == null}, new={newException == null})");
+                return false;
+            }
+
+            // Check for known equivalent error patterns (e.g., JSON parse errors)
+            // where both parsers correctly reject invalid input but with different wording
+            if (PipelineTemplateEvaluatorWrapper.HasJsonExceptionType(legacyException) && PipelineTemplateEvaluatorWrapper.HasJsonExceptionType(newException))
+            {
+                trace.Info("CompareExceptions - both exceptions are JSON parse errors, treating as matched");
+                return true;
+            }
+
+            // Compare exception messages recursively (including inner exceptions)
+            var legacyMessages = GetExceptionMessages(legacyException);
+            var newMessages = GetExceptionMessages(newException);
+
+            if (legacyMessages.Count != newMessages.Count)
+            {
+                trace.Info($"CompareExceptions mismatch - different number of exception messages (legacy={legacyMessages.Count}, new={newMessages.Count})");
+                return false;
+            }
+
+            for (int i = 0; i < legacyMessages.Count; i++)
+            {
+                if (!string.Equals(legacyMessages[i], newMessages[i], StringComparison.Ordinal))
+                {
+                    trace.Info($"CompareExceptions mismatch - exception messages differ at level {i} (legacy='{legacyMessages[i]}', new='{newMessages[i]}')");
+                    return false;
+                }
+            }
+
+            return true;
+        }
+
+        private IList<string> GetExceptionMessages(Exception ex)
+        {
+            var trace = HostContext.GetTrace(nameof(ActionManifestManagerWrapper));
+            var messages = new List<string>();
+            var toProcess = new Queue<Exception>();
+            toProcess.Enqueue(ex);
+            int count = 0;
+
+            while (toProcess.Count > 0 && count < 50)
+            {
+                var current = toProcess.Dequeue();
+                if (current == null) continue;
+
+                messages.Add(current.Message);
+                count++;
+
+                // Special handling for AggregateException - enqueue all inner exceptions
+                if (current is AggregateException aggregateEx)
+                {
+                    foreach (var innerEx in aggregateEx.InnerExceptions)
+                    {
+                        if (innerEx != null && count < 50)
+                        {
+                            toProcess.Enqueue(innerEx);
+                        }
+                    }
+                }
+                else if (current.InnerException != null)
+                {
+                    toProcess.Enqueue(current.InnerException);
+                }
+
+                // Failsafe: if we have too many exceptions, stop and return what we have
+                if (count >= 50)
+                {
+                    trace.Info("CompareExceptions failsafe triggered - too many exceptions (50+)");
+                    break;
+                }
+            }
+
+            return messages;
+        }
+
+    }
+}

src/Runner.Worker/ActionRunner.cs

@@ -206,7 +206,7 @@ namespace GitHub.Runner.Worker
             // Merge the default inputs from the definition
             if (definition.Data?.Inputs != null)
             {
-                var manifestManager = HostContext.GetService<IActionManifestManager>();
+                var manifestManager = HostContext.GetService<IActionManifestManagerWrapper>();
                 foreach (var input in definition.Data.Inputs)
                 {
                     string key = input.Key.AssertString("action input name").Value;
@@ -379,7 +379,14 @@ namespace GitHub.Runner.Worker
             {
                 prefix = PipelineTemplateConstants.RunDisplayPrefix;
                 var repositoryReference = action.Reference as RepositoryPathReference;
-                var pathString = string.IsNullOrEmpty(repositoryReference.Path) ? string.Empty : $"/{repositoryReference.Path}";
+                var pathString = string.Empty;
+                if (!string.IsNullOrEmpty(repositoryReference.Path))
+                {
+                    // For local actions (Name is empty), don't prepend "/" to avoid "/./"
+                    pathString = string.IsNullOrEmpty(repositoryReference.Name)
+                        ? repositoryReference.Path
+                        : $"/{repositoryReference.Path}";
+                }
                 var repoString = string.IsNullOrEmpty(repositoryReference.Ref) ? $"{repositoryReference.Name}{pathString}" :
                     $"{repositoryReference.Name}{pathString}@{repositoryReference.Ref}";
                 tokenToParse = new StringToken(null, null, null, repoString);

src/Runner.Worker/Container/ContainerInfo.cs

@@ -36,6 +36,8 @@ namespace GitHub.Runner.Worker.Container
             this.ContainerImage = containerImage;
             this.ContainerDisplayName = $"{container.Alias}_{Pipelines.Validation.NameValidation.Sanitize(containerImage)}_{Guid.NewGuid().ToString("N").Substring(0, 6)}";
             this.ContainerCreateOptions = container.Options;
+            this.ContainerEntryPoint = container.Entrypoint;
+            this.ContainerEntryPointArgs = container.Command;
             _environmentVariables = container.Environment;
             this.IsJobContainer = isJobContainer;
             this.ContainerNetworkAlias = networkAlias;

src/Runner.Worker/ExecutionContext.cs

@@ -499,7 +499,7 @@ namespace GitHub.Runner.Worker
 
             PublishStepTelemetry();
 
-            if (_record.RecordType == "Task")
+            if (_record.RecordType == ExecutionContextType.Task)
             {
                 var stepResult = new StepResult
                 {
@@ -532,6 +532,25 @@ namespace GitHub.Runner.Worker
                 Global.StepsResult.Add(stepResult);
             }
 
+            if (Global.Variables.GetBoolean(Constants.Runner.Features.SendJobLevelAnnotations) ?? false)
+            {
+                if (_record.RecordType == ExecutionContextType.Job)
+                {
+                    _record.Issues?.ForEach(issue =>
+                    {
+                        var annotation = issue.ToAnnotation();
+                        if (annotation != null)
+                        {
+                            Global.JobAnnotations.Add(annotation.Value);
+                            if (annotation.Value.IsInfrastructureIssue && string.IsNullOrEmpty(Global.InfrastructureFailureCategory))
+                            {
+                                Global.InfrastructureFailureCategory = issue.Category;
+                            }
+                        }
+                    });
+                }
+            }
+
             if (Root != this)
             {
                 // only dispose TokenSource for step level ExecutionContext
@@ -837,6 +856,9 @@ namespace GitHub.Runner.Worker
             // Job level annotations
             Global.JobAnnotations = new List<Annotation>();
 
+            // Track Node.js 20 actions for deprecation warning
+            Global.DeprecatedNode20Actions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
             // Job Outputs
             JobOutputs = new Dictionary<string, VariableValue>(StringComparer.OrdinalIgnoreCase);
 
@@ -1306,9 +1328,9 @@ namespace GitHub.Runner.Worker
             UpdateGlobalStepsContext();
         }
 
-        internal IPipelineTemplateEvaluator ToPipelineTemplateEvaluatorInternal(ObjectTemplating.ITraceWriter traceWriter = null)
+        internal IPipelineTemplateEvaluator ToPipelineTemplateEvaluatorInternal(bool allowServiceContainerCommand, ObjectTemplating.ITraceWriter traceWriter = null)
         {
-            return new PipelineTemplateEvaluatorWrapper(HostContext, this, traceWriter);
+            return new PipelineTemplateEvaluatorWrapper(HostContext, this, allowServiceContainerCommand, traceWriter);
         }
 
         private static void NoOp()
@@ -1396,10 +1418,13 @@ namespace GitHub.Runner.Worker
 
         public static IPipelineTemplateEvaluator ToPipelineTemplateEvaluator(this IExecutionContext context, ObjectTemplating.ITraceWriter traceWriter = null)
         {
+            var allowServiceContainerCommand = (context.Global.Variables.GetBoolean(Constants.Runner.Features.ServiceContainerCommand) ?? false)
+                || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_SERVICE_CONTAINER_COMMAND"));
+
             // Create wrapper?
-            if ((context.Global.Variables.GetBoolean(Constants.Runner.Features.CompareTemplateEvaluator) ?? false) || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_COMPARE_TEMPLATE_EVALUATOR")))
+            if ((context.Global.Variables.GetBoolean(Constants.Runner.Features.CompareWorkflowParser) ?? false) || StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("ACTIONS_RUNNER_COMPARE_WORKFLOW_PARSER")))
             {
-                return (context as ExecutionContext).ToPipelineTemplateEvaluatorInternal(traceWriter);
+                return (context as ExecutionContext).ToPipelineTemplateEvaluatorInternal(allowServiceContainerCommand, traceWriter);
             }
 
             // Legacy
@@ -1411,6 +1436,7 @@ namespace GitHub.Runner.Worker
             return new PipelineTemplateEvaluator(traceWriter, schema, context.Global.FileTable)
             {
                 MaxErrorMessageLength = int.MaxValue, // Don't truncate error messages otherwise we might not scrub secrets correctly
+                AllowServiceContainerCommand = allowServiceContainerCommand,
             };
         }
 

src/Runner.Worker/FeatureManager.cs

@@ -11,10 +11,5 @@ namespace GitHub.Runner.Worker
             var isContainerHooksPathSet = !string.IsNullOrEmpty(Environment.GetEnvironmentVariable(Constants.Hooks.ContainerHooksPath));
             return isContainerHookFeatureFlagSet && isContainerHooksPathSet;
         }
-
-        public static bool IsContainerActionRunnerTempEnabled(Variables variables)
-        {
-            return variables?.GetBoolean(Constants.Runner.Features.ContainerActionRunnerTemp) ?? false;
-        }
     }
 }

src/Runner.Worker/GlobalContext.cs

@@ -30,5 +30,9 @@ namespace GitHub.Runner.Worker
         public string InfrastructureFailureCategory { get; set; }
         public JObject ContainerHookState { get; set; }
         public bool HasTemplateEvaluatorMismatch { get; set; }
+        public bool HasActionManifestMismatch { get; set; }
+        public bool HasDeprecatedSetOutput { get; set; }
+        public bool HasDeprecatedSaveState { get; set; }
+        public HashSet<string> DeprecatedNode20Actions { get; set; }
     }
 }

src/Runner.Worker/Handlers/CompositeActionHandler.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Diagnostics;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
@@ -187,7 +188,7 @@ namespace GitHub.Runner.Worker.Handlers
             if (Data.Outputs != null)
             {
                 // Evaluate the outputs in the steps context to easily retrieve the values
-                var actionManifestManager = HostContext.GetService<IActionManifestManager>();
+                var actionManifestManager = HostContext.GetService<IActionManifestManagerWrapper>();
 
                 // Format ExpressionValues to Dictionary<string, PipelineContextData>
                 var evaluateContext = new Dictionary<string, PipelineContextData>(StringComparer.OrdinalIgnoreCase);
@@ -226,6 +227,11 @@ namespace GitHub.Runner.Worker.Handlers
         {
             ArgUtil.NotNull(embeddedSteps, nameof(embeddedSteps));
 
+            bool emitCompositeMarkers =
+                (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.EmitCompositeMarkers) ?? false)
+                || StringUtil.ConvertToBoolean(
+                    System.Environment.GetEnvironmentVariable(Constants.Variables.Agent.EmitCompositeMarkers));
+
             foreach (IStep step in embeddedSteps)
             {
                 Trace.Info($"Processing embedded step: DisplayName='{step.DisplayName}'");
@@ -297,6 +303,27 @@ namespace GitHub.Runner.Worker.Handlers
                     SetStepConclusion(step, TaskResult.Failed);
                 }
 
+                // Marker ID uses the step's fully qualified context name (ScopeName.ContextName),
+                // which encodes the full composite nesting chain at any depth.
+                var markerId = emitCompositeMarkers ? step.ExecutionContext.GetFullyQualifiedContextName() : null;
+                var stepStopwatch = default(Stopwatch);
+                var endMarkerEmitted = false;
+
+                // Emit start marker after full context setup so display name expressions resolve correctly
+                if (emitCompositeMarkers)
+                {
+                    try
+                    {
+                        step.EvaluateDisplayName(step.ExecutionContext.ExpressionValues, step.ExecutionContext, out _);
+                    }
+                    catch (Exception ex)
+                    {
+                        Trace.Warning("Caught exception while evaluating embedded step display name. {0}", ex);
+                    }
+                    ExecutionContext.Output($"##[start-action display={EscapeProperty(SanitizeDisplayName(step.DisplayName))};id={EscapeProperty(markerId)}]");
+                    stepStopwatch = Stopwatch.StartNew();
+                }
+
                 // Register Callback
                 CancellationTokenRegistration? jobCancelRegister = null;
                 try
@@ -381,6 +408,14 @@ namespace GitHub.Runner.Worker.Handlers
                         // Condition is false
                         Trace.Info("Skipping step due to condition evaluation.");
                         SetStepConclusion(step, TaskResult.Skipped);
+
+                        if (emitCompositeMarkers)
+                        {
+                            stepStopwatch.Stop();
+                            ExecutionContext.Output($"##[end-action id={EscapeProperty(markerId)};outcome=skipped;conclusion=skipped;duration_ms=0]");
+                            endMarkerEmitted = true;
+                        }
+
                         continue;
                     }
                     else if (conditionEvaluateError != null)
@@ -389,13 +424,31 @@ namespace GitHub.Runner.Worker.Handlers
                         step.ExecutionContext.Error(conditionEvaluateError);
                         SetStepConclusion(step, TaskResult.Failed);
                         ExecutionContext.Result = TaskResult.Failed;
+
+                        if (emitCompositeMarkers)
+                        {
+                            stepStopwatch.Stop();
+                            ExecutionContext.Output($"##[end-action id={EscapeProperty(markerId)};outcome=failure;conclusion=failure;duration_ms={stepStopwatch.ElapsedMilliseconds}]");
+                            endMarkerEmitted = true;
+                        }
+
                         break;
                     }
                     else
                     {
                         await RunStepAsync(step);
-                    }
 
+                        if (emitCompositeMarkers)
+                        {
+                            stepStopwatch.Stop();
+                            // Outcome = raw result before continue-on-error (null when continue-on-error didn't fire)
+                            // Result = final result after continue-on-error
+                            var outcome = (step.ExecutionContext.Outcome ?? step.ExecutionContext.Result ?? TaskResult.Succeeded).ToActionResult().ToString().ToLowerInvariant();
+                            var conclusion = (step.ExecutionContext.Result ?? TaskResult.Succeeded).ToActionResult().ToString().ToLowerInvariant();
+                            ExecutionContext.Output($"##[end-action id={EscapeProperty(markerId)};outcome={outcome};conclusion={conclusion};duration_ms={stepStopwatch.ElapsedMilliseconds}]");
+                            endMarkerEmitted = true;
+                        }
+                    }
                 }
                 finally
                 {
@@ -404,6 +457,14 @@ namespace GitHub.Runner.Worker.Handlers
                         jobCancelRegister?.Dispose();
                         jobCancelRegister = null;
                     }
+
+                    if (emitCompositeMarkers && !endMarkerEmitted)
+                    {
+                        stepStopwatch.Stop();
+                        var outcome = (step.ExecutionContext.Outcome ?? step.ExecutionContext.Result ?? TaskResult.Failed).ToActionResult().ToString().ToLowerInvariant();
+                        var conclusion = (step.ExecutionContext.Result ?? TaskResult.Failed).ToActionResult().ToString().ToLowerInvariant();
+                        ExecutionContext.Output($"##[end-action id={EscapeProperty(markerId)};outcome={outcome};conclusion={conclusion};duration_ms={stepStopwatch.ElapsedMilliseconds}]");
+                    }
                 }
                 // Check failed or cancelled
                 if (step.ExecutionContext.Result == TaskResult.Failed || step.ExecutionContext.Result == TaskResult.Canceled)
@@ -470,5 +531,44 @@ namespace GitHub.Runner.Worker.Handlers
             step.ExecutionContext.Result = result;
             step.ExecutionContext.UpdateGlobalStepsContext();
         }
+
+        /// <summary>
+        /// Escapes marker property values so they cannot break the ##[command key=value] format.
+        /// Delegates to ActionCommand.EscapeValue which escapes `;`, `]`, `\r`, `\n`, and `%`.
+        /// </summary>
+        internal static string EscapeProperty(string value)
+        {
+            return ActionCommand.EscapeValue(value);
+        }
+
+        /// <summary>Maximum character length for display names in markers to prevent log bloat.</summary>
+        internal const int MaxDisplayNameLength = 1000;
+
+        /// <summary>
+        /// Normalizes a step display name for safe embedding in a marker property.
+        /// Trims leading whitespace, drops everything after the first newline, and
+        /// truncates to <see cref="MaxDisplayNameLength"/> characters.
+        /// </summary>
+        internal static string SanitizeDisplayName(string displayName)
+        {
+            if (string.IsNullOrEmpty(displayName)) return displayName;
+
+            // Take first line only (FormatStepName in ActionRunner.cs already does this
+            // for most cases, but be defensive for any code path that skips it)
+            var result = displayName.TrimStart(' ', '\t', '\r', '\n');
+            var firstNewLine = result.IndexOfAny(new[] { '\r', '\n' });
+            if (firstNewLine >= 0)
+            {
+                result = result.Substring(0, firstNewLine);
+            }
+
+            // Truncate excessively long names
+            if (result.Length > MaxDisplayNameLength)
+            {
+                result = result.Substring(0, MaxDisplayNameLength);
+            }
+
+            return result;
+        }
     }
 }

src/Runner.Worker/Handlers/ContainerActionHandler.cs

@@ -135,7 +135,7 @@ namespace GitHub.Runner.Worker.Handlers
             var extraExpressionValues = new Dictionary<string, PipelineContextData>(StringComparer.OrdinalIgnoreCase);
             extraExpressionValues["inputs"] = inputsContext;
 
-            var manifestManager = HostContext.GetService<IActionManifestManager>();
+            var manifestManager = HostContext.GetService<IActionManifestManagerWrapper>();
             if (Data.Arguments != null)
             {
                 container.ContainerEntryPointArgs = "";
@@ -191,19 +191,13 @@ namespace GitHub.Runner.Worker.Handlers
             ArgUtil.Directory(tempWorkflowDirectory, nameof(tempWorkflowDirectory));
 
             container.MountVolumes.Add(new MountVolume("/var/run/docker.sock", "/var/run/docker.sock"));
-            if (FeatureManager.IsContainerActionRunnerTempEnabled(ExecutionContext.Global.Variables))
-            {
-                container.MountVolumes.Add(new MountVolume(tempDirectory, "/github/runner_temp"));
-            }
+            container.MountVolumes.Add(new MountVolume(tempDirectory, "/github/runner_temp"));
             container.MountVolumes.Add(new MountVolume(tempHomeDirectory, "/github/home"));
             container.MountVolumes.Add(new MountVolume(tempWorkflowDirectory, "/github/workflow"));
             container.MountVolumes.Add(new MountVolume(tempFileCommandDirectory, "/github/file_commands"));
             container.MountVolumes.Add(new MountVolume(defaultWorkingDirectory, "/github/workspace"));
 
-            if (FeatureManager.IsContainerActionRunnerTempEnabled(ExecutionContext.Global.Variables))
-            {
-                container.AddPathTranslateMapping(tempDirectory, "/github/runner_temp");
-            }
+            container.AddPathTranslateMapping(tempDirectory, "/github/runner_temp");
             container.AddPathTranslateMapping(tempHomeDirectory, "/github/home");
             container.AddPathTranslateMapping(tempWorkflowDirectory, "/github/workflow");
             container.AddPathTranslateMapping(tempFileCommandDirectory, "/github/file_commands");
@@ -245,6 +239,14 @@ namespace GitHub.Runner.Worker.Handlers
                 Environment["ACTIONS_RESULTS_URL"] = resultsUrl;
             }
 
+            if (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.SetOrchestrationIdEnvForActions) ?? false)
+            {
+                if (ExecutionContext.Global.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out var orchestrationId) && !string.IsNullOrEmpty(orchestrationId))
+                {
+                    Environment["ACTIONS_ORCHESTRATION_ID"] = orchestrationId;
+                }
+            }
+
             foreach (var variable in this.Environment)
             {
                 container.ContainerEnvironmentVariables[variable.Key] = container.TranslateToContainerPath(variable.Value);

src/Runner.Worker/Handlers/HandlerFactory.cs

@@ -65,6 +65,20 @@ namespace GitHub.Runner.Worker.Handlers
                     nodeData.NodeVersion = Common.Constants.Runner.NodeMigration.Node20;
                 }
 
+                // Track Node.js 20 actions for deprecation annotation
+                if (string.Equals(nodeData.NodeVersion, Constants.Runner.NodeMigration.Node20, StringComparison.InvariantCultureIgnoreCase))
+                {
+                    bool warnOnNode20 = executionContext.Global.Variables?.GetBoolean(Constants.Runner.NodeMigration.WarnOnNode20Flag) ?? false;
+                    if (warnOnNode20)
+                    {
+                        string actionName = GetActionName(action);
+                        if (!string.IsNullOrEmpty(actionName))
+                        {
+                            executionContext.Global.DeprecatedNode20Actions?.Add(actionName);
+                        }
+                    }
+                }
+
                 // Check if node20 was explicitly specified in the action
                 // We don't modify if node24 was explicitly specified
                 if (string.Equals(nodeData.NodeVersion, Constants.Runner.NodeMigration.Node20, StringComparison.InvariantCultureIgnoreCase))
@@ -90,7 +104,8 @@ namespace GitHub.Runner.Worker.Handlers
                     if (useNode24ByDefault && !requireNode24 && string.Equals(finalNodeVersion, Constants.Runner.NodeMigration.Node24, StringComparison.OrdinalIgnoreCase))
                     {
                         string infoMessage = "Node 20 is being deprecated. This workflow is running with Node 24 by default. " +
-                                             "If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable.";
+                                             "If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. " +
+                                             $"For more information see: {Constants.Runner.NodeMigration.Node20DeprecationUrl}";
                         executionContext.Output(infoMessage);
                     }
                 }
@@ -129,5 +144,25 @@ namespace GitHub.Runner.Worker.Handlers
             handler.LocalActionContainerSetupSteps = localActionContainerSetupSteps;
             return handler;
         }
+
+        private static string GetActionName(Pipelines.ActionStepDefinitionReference action)
+        {
+            if (action is Pipelines.RepositoryPathReference repoRef)
+            {
+                var pathString = string.Empty;
+                if (!string.IsNullOrEmpty(repoRef.Path))
+                {
+                    pathString = string.IsNullOrEmpty(repoRef.Name)
+                        ? repoRef.Path
+                        : $"/{repoRef.Path}";
+                }
+                var repoString = string.IsNullOrEmpty(repoRef.Ref)
+                    ? $"{repoRef.Name}{pathString}"
+                    : $"{repoRef.Name}{pathString}@{repoRef.Ref}";
+                return string.IsNullOrEmpty(repoString) ? null : repoString;
+            }
+
+            return null;
+        }
     }
 }

src/Runner.Worker/Handlers/NodeScriptActionHandler.cs

@@ -77,6 +77,14 @@ namespace GitHub.Runner.Worker.Handlers
                 Environment["ACTIONS_CACHE_SERVICE_V2"] = bool.TrueString;
             }
 
+            if (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.SetOrchestrationIdEnvForActions) ?? false)
+            {
+                if (ExecutionContext.Global.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out var orchestrationId) && !string.IsNullOrEmpty(orchestrationId))
+                {
+                    Environment["ACTIONS_ORCHESTRATION_ID"] = orchestrationId;
+                }
+            }
+
             // Resolve the target script.
             string target = null;
             if (stage == ActionRunStage.Main)

src/Runner.Worker/Handlers/OutputManager.cs

@@ -90,6 +90,14 @@ namespace GitHub.Runner.Worker.Handlers
                 }
             }
 
+            // Strip runner-controlled markers from user output to prevent injection
+            if (!String.IsNullOrEmpty(line) &&
+                (line.Contains("##[start-action") || line.Contains("##[end-action")))
+            {
+                line = line.Replace("##[start-action", @"##[\start-action")
+                           .Replace("##[end-action", @"##[\end-action");
+            }
+
             // Problem matchers
             if (_matchers.Length > 0)
             {

src/Runner.Worker/Handlers/ScriptHandler.cs

@@ -318,6 +318,14 @@ namespace GitHub.Runner.Worker.Handlers
                 Environment["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] = systemConnection.Authorization.Parameters[EndpointAuthorizationParameters.AccessToken];
             }
 
+            if (ExecutionContext.Global.Variables.GetBoolean(Constants.Runner.Features.SetOrchestrationIdEnvForActions) ?? false)
+            {
+                if (ExecutionContext.Global.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out var orchestrationId) && !string.IsNullOrEmpty(orchestrationId))
+                {
+                    Environment["ACTIONS_ORCHESTRATION_ID"] = orchestrationId;
+                }
+            }
+
             ExecutionContext.Debug($"{fileName} {arguments}");
 
             Inputs.TryGetValue("standardInInput", out var standardInInput);

src/Runner.Worker/InternalsVisibleTo.cs

@@ -0,0 +1,3 @@
+using System.Runtime.CompilerServices;
+
+[assembly: InternalsVisibleTo("Test")]

src/Runner.Worker/JobExtension.cs

@@ -112,6 +112,13 @@ namespace GitHub.Runner.Worker
                                             groupName = "Machine Setup Info";
                                         }
 
+                                        // not output internal groups
+                                        if (groupName.StartsWith("_internal_", StringComparison.OrdinalIgnoreCase))
+                                        {
+                                            jobContext.Global.JobTelemetry.Add(new JobTelemetry() { Type = JobTelemetryType.General, Message = info.Detail });
+                                            continue;
+                                        }
+
                                         context.Output($"##[group]{groupName}");
                                         var multiLines = info.Detail.Replace("\r\n", "\n").TrimEnd('\n').Split('\n');
                                         foreach (var line in multiLines)
@@ -728,6 +735,15 @@ namespace GitHub.Runner.Worker
                             context.Global.JobTelemetry.Add(new JobTelemetry() { Type = JobTelemetryType.ConnectivityCheck, Message = $"Fail to check service connectivity. {ex.Message}" });
                         }
                     }
+
+                    // Add deprecation warning annotation for Node.js 20 actions
+                    if (context.Global.DeprecatedNode20Actions?.Count > 0)
+                    {
+                        var sortedActions = context.Global.DeprecatedNode20Actions.OrderBy(a => a, StringComparer.OrdinalIgnoreCase);
+                        var actionsList = string.Join(", ", sortedActions);
+                        var deprecationMessage = $"Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: {actionsList}. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: {Constants.Runner.NodeMigration.Node20DeprecationUrl}";
+                        context.Warning(deprecationMessage);
+                    }
                 }
                 catch (Exception ex)
                 {

src/Runner.Worker/PipelineTemplateEvaluatorWrapper.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using GitHub.Actions.WorkflowParser;
 using GitHub.DistributedTask.Expressions2;
@@ -23,6 +23,7 @@ namespace GitHub.Runner.Worker
         public PipelineTemplateEvaluatorWrapper(
             IHostContext hostContext,
             IExecutionContext context,
+            bool allowServiceContainerCommand,
             ObjectTemplating.ITraceWriter traceWriter = null)
         {
             ArgUtil.NotNull(hostContext, nameof(hostContext));
@@ -40,11 +41,14 @@ namespace GitHub.Runner.Worker
             _legacyEvaluator = new PipelineTemplateEvaluator(traceWriter, schema, context.Global.FileTable)
             {
                 MaxErrorMessageLength = int.MaxValue, // Don't truncate error messages otherwise we might not scrub secrets correctly
+                AllowServiceContainerCommand = allowServiceContainerCommand,
             };
 
             // New evaluator
             var newTraceWriter = new GitHub.Actions.WorkflowParser.ObjectTemplating.EmptyTraceWriter();
-            _newEvaluator = new WorkflowTemplateEvaluator(newTraceWriter, context.Global.FileTable, features: null)
+            var features = WorkflowFeatures.GetDefaults();
+            features.AllowServiceContainerCommand = allowServiceContainerCommand;
+            _newEvaluator = new WorkflowTemplateEvaluator(newTraceWriter, context.Global.FileTable, features)
             {
                 MaxErrorMessageLength = int.MaxValue, // Don't truncate error messages otherwise we might not scrub secrets correctly
             };
@@ -216,12 +220,15 @@ namespace GitHub.Runner.Worker
             }
         }
 
-        private TLegacy EvaluateAndCompare<TLegacy, TNew>(
+        internal TLegacy EvaluateAndCompare<TLegacy, TNew>(
             string methodName,
             Func<TLegacy> legacyEvaluator,
             Func<TNew> newEvaluator,
             Func<TLegacy, TNew, bool> resultComparer)
         {
+            // Capture cancellation state before evaluation
+            var cancellationRequestedBefore = _context.CancellationToken.IsCancellationRequested;
+
             // Legacy evaluator
             var legacyException = default(Exception);
             var legacyResult = default(TLegacy);
@@ -253,14 +260,18 @@ namespace GitHub.Runner.Worker
                     newException = ex;
                 }
 
+                // Capture cancellation state after evaluation
+                var cancellationRequestedAfter = _context.CancellationToken.IsCancellationRequested;
+
                 // Compare results or exceptions
+                bool hasMismatch = false;
                 if (legacyException != null || newException != null)
                 {
                     // Either one or both threw exceptions - compare them
                     if (!CompareExceptions(legacyException, newException))
                     {
                         _trace.Info($"{methodName} exception mismatch");
-                        RecordMismatch($"{methodName}");
+                        hasMismatch = true;
                     }
                 }
                 else
@@ -269,6 +280,20 @@ namespace GitHub.Runner.Worker
                     if (!resultComparer(legacyResult, newResult))
                     {
                         _trace.Info($"{methodName} mismatch");
+                        hasMismatch = true;
+                    }
+                }
+
+                // Only record mismatch if it wasn't caused by a cancellation race condition
+                if (hasMismatch)
+                {
+                    if (!cancellationRequestedBefore && cancellationRequestedAfter)
+                    {
+                        // Cancellation state changed during evaluation window - skip recording
+                        _trace.Info($"{methodName} mismatch skipped due to cancellation race condition");
+                    }
+                    else
+                    {
                         RecordMismatch($"{methodName}");
                     }
                 }
@@ -380,6 +405,18 @@ namespace GitHub.Runner.Worker
                 return false;
             }
 
+            if (!string.Equals(legacyResult.Entrypoint, newResult.Entrypoint, StringComparison.Ordinal))
+            {
+                _trace.Info($"CompareJobContainer mismatch - Entrypoint differs (legacy='{legacyResult.Entrypoint}', new='{newResult.Entrypoint}')");
+                return false;
+            }
+
+            if (!string.Equals(legacyResult.Command, newResult.Command, StringComparison.Ordinal))
+            {
+                _trace.Info($"CompareJobContainer mismatch - Command differs (legacy='{legacyResult.Command}', new='{newResult.Command}')");
+                return false;
+            }
+
             if (!CompareDictionaries(legacyResult.Environment, newResult.Environment, "Environment"))
             {
                 return false;
@@ -612,6 +649,13 @@ namespace GitHub.Runner.Worker
                 return false;
             }
 
+            // Check for known equivalent error patterns (e.g., JSON parse errors)
+            // where both parsers correctly reject invalid input but with different wording
+            if (IsKnownEquivalentErrorPattern(legacyException, newException))
+            {
+                return true;
+            }
+
             // Compare exception messages recursively (including inner exceptions)
             var legacyMessages = GetExceptionMessages(legacyException);
             var newMessages = GetExceptionMessages(newException);
@@ -634,6 +678,67 @@ namespace GitHub.Runner.Worker
             return true;
         }
 
+        /// <summary>
+        /// Checks if two exceptions match a known pattern where both parsers correctly reject
+        /// invalid input but with different error messages (e.g., JSON parse errors from fromJSON).
+        /// </summary>
+        private bool IsKnownEquivalentErrorPattern(Exception legacyException, Exception newException)
+        {
+            // fromJSON('') - both parsers fail when parsing empty string as JSON
+            // The error messages differ but both indicate JSON parsing failure.
+            // Legacy throws raw JsonReaderException: "Error reading JToken from JsonReader..."
+            // New wraps it: "Error parsing fromJson" with inner JsonReaderException
+            // Both may be wrapped in TemplateValidationException: "The template is not valid..."
+            if (HasJsonExceptionType(legacyException) && HasJsonExceptionType(newException))
+            {
+                _trace.Info("CompareExceptions - both exceptions are JSON parse errors, treating as matched");
+                return true;
+            }
+
+            return false;
+        }
+
+        /// <summary>
+        /// Checks if the exception chain contains a JSON-related exception type.
+        /// </summary>
+        internal static bool HasJsonExceptionType(Exception ex)
+        {
+            var toProcess = new Queue<Exception>();
+            toProcess.Enqueue(ex);
+            int count = 0;
+
+            while (toProcess.Count > 0 && count < 50)
+            {
+                var current = toProcess.Dequeue();
+                if (current == null) continue;
+
+                count++;
+
+                if (current is Newtonsoft.Json.JsonReaderException ||
+                    current is System.Text.Json.JsonException)
+                {
+                    return true;
+                }
+
+                if (current is AggregateException aggregateEx)
+                {
+                    foreach (var innerEx in aggregateEx.InnerExceptions)
+                    {
+                        if (innerEx != null && count < 50)
+                        {
+                            toProcess.Enqueue(innerEx);
+                        }
+                    }
+                }
+                else if (current.InnerException != null)
+                {
+                    toProcess.Enqueue(current.InnerException);
+                }
+            }
+
+            return false;
+        }
+
         private IList<string> GetExceptionMessages(Exception ex)
         {
             var messages = new List<string>();

src/Sdk/DTExpressions2/Expressions2/ExpressionConstants.cs

@@ -9,6 +9,7 @@ namespace GitHub.DistributedTask.Expressions2
     {
         static ExpressionConstants()
         {
+            AddFunction<Case>("case", 3, Byte.MaxValue);
             AddFunction<Contains>("contains", 2, 2);
             AddFunction<EndsWith>("endsWith", 2, 2);
             AddFunction<Format>("format", 1, Byte.MaxValue);

src/Sdk/DTExpressions2/Expressions2/ExpressionParser.cs

@@ -17,9 +17,10 @@ namespace GitHub.DistributedTask.Expressions2
             String expression,
             ITraceWriter trace,
             IEnumerable<INamedValueInfo> namedValues,
-            IEnumerable<IFunctionInfo> functions)
+            IEnumerable<IFunctionInfo> functions,
+            Boolean allowCaseFunction = true)
         {
-            var context = new ParseContext(expression, trace, namedValues, functions);
+            var context = new ParseContext(expression, trace, namedValues, functions, allowCaseFunction: allowCaseFunction);
             context.Trace.Info($"Parsing expression: <{expression}>");
             return CreateTree(context);
         }
@@ -349,6 +350,10 @@ namespace GitHub.DistributedTask.Expressions2
             {
                 throw new ParseException(ParseExceptionKind.TooManyParameters, token: @operator, expression: context.Expression);
             }
+            else if (functionInfo.Name.Equals("case", StringComparison.OrdinalIgnoreCase) && function.Parameters.Count % 2 == 0)
+            {
+                throw new ParseException(ParseExceptionKind.EvenParameters, token: @operator, expression: context.Expression);
+            }
         }
 
         /// <summary>
@@ -411,6 +416,12 @@ namespace GitHub.DistributedTask.Expressions2
             String name,
             out IFunctionInfo functionInfo)
         {
+            if (String.Equals(name, "case", StringComparison.OrdinalIgnoreCase) && !context.AllowCaseFunction)
+            {
+                functionInfo = null;
+                return false;
+            }
+
             return ExpressionConstants.WellKnownFunctions.TryGetValue(name, out functionInfo) ||
                 context.ExtensionFunctions.TryGetValue(name, out functionInfo);
         }
@@ -418,6 +429,7 @@ namespace GitHub.DistributedTask.Expressions2
         private sealed class ParseContext
         {
             public Boolean AllowUnknownKeywords;
+            public Boolean AllowCaseFunction;
             public readonly String Expression;
             public readonly Dictionary<String, IFunctionInfo> ExtensionFunctions = new Dictionary<String, IFunctionInfo>(StringComparer.OrdinalIgnoreCase);
             public readonly Dictionary<String, INamedValueInfo> ExtensionNamedValues = new Dictionary<String, INamedValueInfo>(StringComparer.OrdinalIgnoreCase);
@@ -433,7 +445,8 @@ namespace GitHub.DistributedTask.Expressions2
                 ITraceWriter trace,
                 IEnumerable<INamedValueInfo> namedValues,
                 IEnumerable<IFunctionInfo> functions,
-                Boolean allowUnknownKeywords = false)
+                Boolean allowUnknownKeywords = false,
+                Boolean allowCaseFunction = true)
             {
                 Expression = expression ?? String.Empty;
                 if (Expression.Length > ExpressionConstants.MaxLength)
@@ -454,6 +467,7 @@ namespace GitHub.DistributedTask.Expressions2
 
                 LexicalAnalyzer = new LexicalAnalyzer(Expression);
                 AllowUnknownKeywords = allowUnknownKeywords;
+                AllowCaseFunction = allowCaseFunction;
             }
 
             private class NoOperationTraceWriter : ITraceWriter

src/Sdk/DTExpressions2/Expressions2/ParseException.cs

@@ -29,6 +29,9 @@ namespace GitHub.DistributedTask.Expressions2
                 case ParseExceptionKind.TooManyParameters:
                     description = "Too many parameters supplied";
                     break;
+                case ParseExceptionKind.EvenParameters:
+                    description = "Even number of parameters supplied, requires an odd number of parameters";
+                    break;
                 case ParseExceptionKind.UnexpectedEndOfExpression:
                     description = "Unexpected end of expression";
                     break;

src/Sdk/DTExpressions2/Expressions2/ParseExceptionKind.cs

@@ -6,6 +6,7 @@
         ExceededMaxLength,
         TooFewParameters,
         TooManyParameters,
+        EvenParameters,
         UnexpectedEndOfExpression,
         UnexpectedSymbol,
         UnrecognizedFunction,

src/Sdk/DTExpressions2/Expressions2/Sdk/Functions/Case.cs

@@ -0,0 +1,45 @@
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+
+using System;
+using GitHub.Actions.Expressions.Data;
+
+namespace GitHub.DistributedTask.Expressions2.Sdk.Functions
+{
+    internal sealed class Case : Function
+    {
+        protected sealed override Object EvaluateCore(
+            EvaluationContext context,
+            out ResultMemory resultMemory)
+        {
+            resultMemory = null;
+            // Validate argument count - must be odd (pairs of predicate-result plus default)
+            if (Parameters.Count % 2 == 0)
+            {
+                throw new InvalidOperationException("case requires an odd number of arguments");
+            }
+
+            // Evaluate predicate-result pairs
+            for (var i = 0; i < Parameters.Count - 1; i += 2)
+            {
+                var predicate = Parameters[i].Evaluate(context);
+
+                // Predicate must be a boolean
+                if (predicate.Kind != ValueKind.Boolean)
+                {
+                    throw new InvalidOperationException("case predicate must evaluate to a boolean value");
+                }
+
+                // If predicate is true, return the corresponding result
+                if ((Boolean)predicate.Value)
+                {
+                    var result = Parameters[i + 1].Evaluate(context);
+                    return result.Value;
+                }
+            }
+
+            // No predicate matched, return default (last argument)
+            var defaultResult = Parameters[Parameters.Count - 1].Evaluate(context);
+            return defaultResult.Value;
+        }
+    }
+}

src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateContext.cs

@@ -86,6 +86,12 @@ namespace GitHub.DistributedTask.ObjectTemplating
 
         internal ITraceWriter TraceWriter { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether the case expression function is allowed.
+        /// Defaults to true. Set to false to disable the case function.
+        /// </summary>
+        internal Boolean AllowCaseFunction { get; set; } = true;
+
         private IDictionary<String, Int32> FileIds
         {
             get

src/Sdk/DTObjectTemplating/ObjectTemplating/Tokens/TemplateToken.cs

@@ -57,7 +57,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -94,7 +94,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -123,7 +123,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -152,7 +152,7 @@ namespace GitHub.DistributedTask.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,

src/Sdk/DTPipelines/Pipelines/JobContainer.cs

@@ -39,6 +39,24 @@ namespace GitHub.DistributedTask.Pipelines
             set;
         }
 
+        /// <summary>
+        /// Gets or sets the container entrypoint override.
+        /// </summary>
+        public String Entrypoint
+        {
+            get;
+            set;
+        }
+
+        /// <summary>
+        /// Gets or sets the container command and args (after the image name).
+        /// </summary>
+        public String Command
+        {
+            get;
+            set;
+        }
+
         /// <summary>
         /// Gets or sets the volumes which are mounted into the container.
         /// </summary>

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConstants.cs

@@ -47,6 +47,8 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         public const String NumberStrategyContext = "number-strategy-context";
         public const String On = "on";
         public const String Options = "options";
+        public const String Entrypoint = "entrypoint";
+        public const String Command = "command";
         public const String Outputs = "outputs";
         public const String OutputsPattern = "needs.*.outputs";
         public const String Password = "password";

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConverter.cs

@@ -237,7 +237,8 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         internal static JobContainer ConvertToJobContainer(
             TemplateContext context,
             TemplateToken value,
-            bool allowExpressions = false)
+            bool allowExpressions = false,
+            bool allowServiceContainerCommand = false)
         {
             var result = new JobContainer();
             if (allowExpressions && value.Traverse().Any(x => x is ExpressionToken))
@@ -280,6 +281,22 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
                         case PipelineTemplateConstants.Options:
                             result.Options = containerPropertyPair.Value.AssertString($"{PipelineTemplateConstants.Container} {propertyName}").Value;
                             break;
+                        case PipelineTemplateConstants.Entrypoint:
+                            if (!allowServiceContainerCommand)
+                            {
+                                context.Error(containerPropertyPair.Key, $"The key '{PipelineTemplateConstants.Entrypoint}' is not allowed");
+                                break;
+                            }
+                            result.Entrypoint = containerPropertyPair.Value.AssertString($"{PipelineTemplateConstants.Container} {propertyName}").Value;
+                            break;
+                        case PipelineTemplateConstants.Command:
+                            if (!allowServiceContainerCommand)
+                            {
+                                context.Error(containerPropertyPair.Key, $"The key '{PipelineTemplateConstants.Command}' is not allowed");
+                                break;
+                            }
+                            result.Command = containerPropertyPair.Value.AssertString($"{PipelineTemplateConstants.Container} {propertyName}").Value;
+                            break;
                         case PipelineTemplateConstants.Ports:
                             var ports = containerPropertyPair.Value.AssertSequence($"{PipelineTemplateConstants.Container} {propertyName}");
                             var portList = new List<String>(ports.Count);
@@ -326,7 +343,8 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         internal static List<KeyValuePair<String, JobContainer>> ConvertToJobServiceContainers(
             TemplateContext context,
             TemplateToken services,
-            bool allowExpressions = false)
+            bool allowExpressions = false,
+            bool allowServiceContainerCommand = false)
         {
             var result = new List<KeyValuePair<String, JobContainer>>();
 
@@ -340,7 +358,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
             foreach (var servicePair in servicesMapping)
             {
                 var networkAlias = servicePair.Key.AssertString("services key").Value;
-                var container = ConvertToJobContainer(context, servicePair.Value);
+                var container = ConvertToJobContainer(context, servicePair.Value, allowExpressions, allowServiceContainerCommand);
                 result.Add(new KeyValuePair<String, JobContainer>(networkAlias, container));
             }
 
@@ -663,7 +681,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
             var node = default(ExpressionNode);
             try
             {
-                node = expressionParser.CreateTree(condition, null, namedValues, functions) as ExpressionNode;
+                node = expressionParser.CreateTree(condition, null, namedValues, functions, allowCaseFunction: context.AllowCaseFunction) as ExpressionNode;
             }
             catch (Exception ex)
             {

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateEvaluator.cs

@@ -51,6 +51,8 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
 
         public Int32 MaxResultSize { get; set; } = 10 * 1024 * 1024; // 10 mb
 
+        public bool AllowServiceContainerCommand { get; set; }
+
         public Boolean EvaluateStepContinueOnError(
             TemplateToken token,
             DictionaryContextData contextData,
@@ -357,7 +359,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
                 {
                     token = TemplateEvaluator.Evaluate(context, PipelineTemplateConstants.Services, token, 0, null, omitHeader: true);
                     context.Errors.Check();
-                    result = PipelineTemplateConverter.ConvertToJobServiceContainers(context, token);
+                    result = PipelineTemplateConverter.ConvertToJobServiceContainers(context, token, allowServiceContainerCommand: AllowServiceContainerCommand);
                 }
                 catch (Exception ex) when (!(ex is TemplateValidationException))
                 {

src/Sdk/DTPipelines/workflow-v1.0.json

@@ -421,7 +421,22 @@
       "mapping": {
         "properties": {
           "image": "string",
-          "options": "non-empty-string",
+          "options": "string",
+          "env": "container-env",
+          "ports": "sequence-of-non-empty-string",
+          "volumes": "sequence-of-non-empty-string",
+          "credentials": "container-registry-credentials"
+        }
+      }
+    },
+
+    "service-container-mapping": {
+      "mapping": {
+        "properties": {
+          "image": "string",
+          "options": "string",
+          "entrypoint": "string",
+          "command": "string",
           "env": "container-env",
           "ports": "sequence-of-non-empty-string",
           "volumes": "sequence-of-non-empty-string",
@@ -454,7 +469,7 @@
       ],
       "one-of": [
         "string",
-        "container-mapping"
+        "service-container-mapping"
       ]
     },
 

src/Sdk/Expressions/ExpressionConstants.cs

@@ -10,6 +10,7 @@ namespace GitHub.Actions.Expressions
     {
         static ExpressionConstants()
         {
+            AddFunction<Case>("case", 3, Byte.MaxValue);
             AddFunction<Contains>("contains", 2, 2);
             AddFunction<EndsWith>("endsWith", 2, 2);
             AddFunction<Format>("format", 1, Byte.MaxValue);

src/Sdk/Expressions/ExpressionParser.cs

@@ -17,9 +17,10 @@ namespace GitHub.Actions.Expressions
             String expression,
             ITraceWriter trace,
             IEnumerable<INamedValueInfo> namedValues,
-            IEnumerable<IFunctionInfo> functions)
+            IEnumerable<IFunctionInfo> functions,
+            Boolean allowCaseFunction = true)
         {
-            var context = new ParseContext(expression, trace, namedValues, functions);
+            var context = new ParseContext(expression, trace, namedValues, functions, allowCaseFunction: allowCaseFunction);
             context.Trace.Info($"Parsing expression: <{expression}>");
             return CreateTree(context);
         }
@@ -349,6 +350,10 @@ namespace GitHub.Actions.Expressions
             {
                 throw new ParseException(ParseExceptionKind.TooManyParameters, token: @operator, expression: context.Expression);
             }
+            else if (functionInfo.Name.Equals("case", StringComparison.OrdinalIgnoreCase) && function.Parameters.Count % 2 == 0)
+            {
+                throw new ParseException(ParseExceptionKind.EvenParameters, token: @operator, expression: context.Expression);
+            }
         }
 
         /// <summary>
@@ -411,6 +416,12 @@ namespace GitHub.Actions.Expressions
             String name,
             out IFunctionInfo functionInfo)
         {
+            if (String.Equals(name, "case", StringComparison.OrdinalIgnoreCase) && !context.AllowCaseFunction)
+            {
+                functionInfo = null;
+                return false;
+            }
+
             return ExpressionConstants.WellKnownFunctions.TryGetValue(name, out functionInfo) ||
                 context.ExtensionFunctions.TryGetValue(name, out functionInfo);
         }
@@ -418,6 +429,7 @@ namespace GitHub.Actions.Expressions
         private sealed class ParseContext
         {
             public Boolean AllowUnknownKeywords;
+            public Boolean AllowCaseFunction;
             public readonly String Expression;
             public readonly Dictionary<String, IFunctionInfo> ExtensionFunctions = new Dictionary<String, IFunctionInfo>(StringComparer.OrdinalIgnoreCase);
             public readonly Dictionary<String, INamedValueInfo> ExtensionNamedValues = new Dictionary<String, INamedValueInfo>(StringComparer.OrdinalIgnoreCase);
@@ -433,7 +445,8 @@ namespace GitHub.Actions.Expressions
                 ITraceWriter trace,
                 IEnumerable<INamedValueInfo> namedValues,
                 IEnumerable<IFunctionInfo> functions,
-                Boolean allowUnknownKeywords = false)
+                Boolean allowUnknownKeywords = false,
+                Boolean allowCaseFunction = true)
             {
                 Expression = expression ?? String.Empty;
                 if (Expression.Length > ExpressionConstants.MaxLength)
@@ -454,6 +467,7 @@ namespace GitHub.Actions.Expressions
 
                 LexicalAnalyzer = new LexicalAnalyzer(Expression);
                 AllowUnknownKeywords = allowUnknownKeywords;
+                AllowCaseFunction = allowCaseFunction;
             }
 
             private class NoOperationTraceWriter : ITraceWriter
@@ -468,4 +482,4 @@ namespace GitHub.Actions.Expressions
             }
         }
     }
-}
+}

src/Sdk/Expressions/ParseException.cs

@@ -29,6 +29,9 @@ namespace GitHub.Actions.Expressions
                 case ParseExceptionKind.TooManyParameters:
                     description = "Too many parameters supplied";
                     break;
+                case ParseExceptionKind.EvenParameters:
+                    description = "Even number of parameters supplied, requires an odd number of parameters";
+                    break;
                 case ParseExceptionKind.UnexpectedEndOfExpression:
                     description = "Unexpected end of expression";
                     break;

src/Sdk/Expressions/ParseExceptionKind.cs

@@ -6,6 +6,7 @@ namespace GitHub.Actions.Expressions
         ExceededMaxLength,
         TooFewParameters,
         TooManyParameters,
+        EvenParameters,
         UnexpectedEndOfExpression,
         UnexpectedSymbol,
         UnrecognizedFunction,

src/Sdk/Expressions/Sdk/Functions/Case.cs

@@ -0,0 +1,45 @@
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+
+using System;
+using GitHub.Actions.Expressions.Data;
+
+namespace GitHub.Actions.Expressions.Sdk.Functions
+{
+    internal sealed class Case : Function
+    {
+        protected sealed override Object EvaluateCore(
+            EvaluationContext context,
+            out ResultMemory resultMemory)
+        {
+            resultMemory = null;
+            // Validate argument count - must be odd (pairs of predicate-result plus default)
+            if (Parameters.Count % 2 == 0)
+            {
+                throw new InvalidOperationException("case requires an odd number of arguments");
+            }
+
+            // Evaluate predicate-result pairs
+            for (var i = 0; i < Parameters.Count - 1; i += 2)
+            {
+                var predicate = Parameters[i].Evaluate(context);
+
+                // Predicate must be a boolean
+                if (predicate.Kind != ValueKind.Boolean)
+                {
+                    throw new InvalidOperationException("case predicate must evaluate to a boolean value");
+                }
+
+                // If predicate is true, return the corresponding result
+                if ((Boolean)predicate.Value)
+                {
+                    var result = Parameters[i + 1].Evaluate(context);
+                    return result.Value;
+                }
+            }
+
+            // No predicate matched, return default (last argument)
+            var defaultResult = Parameters[Parameters.Count - 1].Evaluate(context);
+            return defaultResult.Value;
+        }
+    }
+}

src/Sdk/Sdk.csproj

@@ -14,19 +14,23 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Azure.Storage.Blobs" Version="12.26.0" />
+        <InternalsVisibleTo Include="Test" />
+    </ItemGroup>
+
+    <ItemGroup>
+        <PackageReference Include="Azure.Storage.Blobs" Version="12.27.0" />
         <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
         <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
         <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
         <PackageReference Include="System.Security.Cryptography.Cng" Version="5.0.0" />
-        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
+        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.2" />
         <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
         <PackageReference Include="Minimatch" Version="2.0.0" />
         <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
         <PackageReference Include="System.Net.Http" Version="4.3.4" />
         <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
         <PackageReference Include="System.Private.Uri" Version="4.3.2" />
-        <PackageReference Include="System.Formats.Asn1" Version="8.0.1" />
+        <PackageReference Include="System.Formats.Asn1" Version="10.0.2" />
     </ItemGroup>
 
     <ItemGroup>

src/Sdk/WorkflowParser/Conversion/WorkflowTemplateConstants.cs

@@ -62,6 +62,8 @@ namespace GitHub.Actions.WorkflowParser.Conversion
         public const String NumberStrategyContext = "number-strategy-context";
         public const String On = "on";
         public const String Options = "options";
+        public const String Entrypoint = "entrypoint";
+        public const String Command = "command";
         public const String Org = "org";
         public const String Organization = "organization";
         public const String Outputs = "outputs";

src/Sdk/WorkflowParser/Conversion/WorkflowTemplateConverter.cs

@@ -1,4 +1,4 @@
-#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
+#nullable disable // Consider removing in the future to minimize likelihood of NullReferenceException; refer https://learn.microsoft.com/en-us/dotnet/csharp/nullable-references
 
 using System;
 using System.Collections.Generic;
@@ -43,7 +43,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                     {
                         case WorkflowTemplateConstants.On:
                             var inputTypes = ConvertToOnWorkflowDispatchInputTypes(workflowPair.Value);
-                            foreach(var item in inputTypes)
+                            foreach (var item in inputTypes)
                             {
                                 result.InputTypes.TryAdd(item.Key, item.Value);
                             }
@@ -432,7 +432,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                 context.Error(snapshotToken, $"job {WorkflowTemplateConstants.Snapshot} {WorkflowTemplateConstants.ImageName} is required.");
                 return null;
             }
-            
+
             return new Snapshot
             {
                 ImageName = imageName,
@@ -445,7 +445,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
         {
             var versionSegments = versionString.Split(".");
 
-            if (versionSegments.Length != 2 || 
+            if (versionSegments.Length != 2 ||
                 !versionSegments[1].Equals("*") ||
                 !Int32.TryParse(versionSegments[0], NumberStyles.None, CultureInfo.InvariantCulture, result: out int parsedMajor) ||
                 parsedMajor < 0)
@@ -1079,7 +1079,8 @@ namespace GitHub.Actions.WorkflowParser.Conversion
         internal static JobContainer ConvertToJobContainer(
             TemplateContext context,
             TemplateToken value,
-            bool isEarlyValidation = false)
+            bool isEarlyValidation = false,
+            bool isServiceContainer = false)
         {
             var result = new JobContainer();
             if (isEarlyValidation && value.Traverse().Any(x => x is ExpressionToken))
@@ -1089,11 +1090,34 @@ namespace GitHub.Actions.WorkflowParser.Conversion
 
             if (value is StringToken containerLiteral)
             {
-                if (String.IsNullOrEmpty(containerLiteral.Value))
+                // Trim "docker://"
+                var trimmedImage = containerLiteral.Value;
+                var hasDockerPrefix = containerLiteral.Value.StartsWith(WorkflowTemplateConstants.DockerUriPrefix, StringComparison.Ordinal);
+                if (hasDockerPrefix)
                 {
+                    trimmedImage = trimmedImage.Substring(WorkflowTemplateConstants.DockerUriPrefix.Length);
+                }
+
+                // Empty shorthand after trimming "docker://" ?
+                if (String.IsNullOrEmpty(trimmedImage))
+                {
+                    // Error at parse-time for:
+                    //   1. container: 'docker://'
+                    //   2. services.foo: ''
+                    //   3. services.foo: 'docker://'
+                    //
+                    // Do not error for:
+                    //   1. container: ''
+                    if (isEarlyValidation && (hasDockerPrefix || isServiceContainer))
+                    {
+                        context.Error(value, "Container image cannot be empty");
+                    }
+
+                    // Short-circuit
                     return null;
                 }
 
+                // Store original, trimmed further below
                 result.Image = containerLiteral.Value;
             }
             else
@@ -1122,6 +1146,22 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                         case WorkflowTemplateConstants.Options:
                             result.Options = containerPropertyPair.Value.AssertString($"{WorkflowTemplateConstants.Container} {propertyName}").Value;
                             break;
+                        case WorkflowTemplateConstants.Entrypoint:
+                            if (!context.GetFeatures().AllowServiceContainerCommand)
+                            {
+                                context.Error(containerPropertyPair.Key, $"The key '{WorkflowTemplateConstants.Entrypoint}' is not allowed");
+                                break;
+                            }
+                            result.Entrypoint = containerPropertyPair.Value.AssertString($"{WorkflowTemplateConstants.Container} {propertyName}").Value;
+                            break;
+                        case WorkflowTemplateConstants.Command:
+                            if (!context.GetFeatures().AllowServiceContainerCommand)
+                            {
+                                context.Error(containerPropertyPair.Key, $"The key '{WorkflowTemplateConstants.Command}' is not allowed");
+                                break;
+                            }
+                            result.Command = containerPropertyPair.Value.AssertString($"{WorkflowTemplateConstants.Container} {propertyName}").Value;
+                            break;
                         case WorkflowTemplateConstants.Ports:
                             var ports = containerPropertyPair.Value.AssertSequence($"{WorkflowTemplateConstants.Container} {propertyName}");
                             var portList = new List<String>(ports.Count);
@@ -1152,15 +1192,28 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                 }
             }
 
-            if (String.IsNullOrEmpty(result.Image))
+            // Trim "docker://"
+            var hadDockerPrefix = false;
+            if (!String.IsNullOrEmpty(result.Image) && result.Image.StartsWith(WorkflowTemplateConstants.DockerUriPrefix, StringComparison.Ordinal))
             {
-                context.Error(value, "Container image cannot be empty");
-                return null;
+                hadDockerPrefix = true;
+                result.Image = result.Image.Substring(WorkflowTemplateConstants.DockerUriPrefix.Length);
             }
 
-            if (result.Image.StartsWith(WorkflowTemplateConstants.DockerUriPrefix, StringComparison.Ordinal))
+            if (String.IsNullOrEmpty(result.Image))
             {
-                result.Image = result.Image.Substring(WorkflowTemplateConstants.DockerUriPrefix.Length);
+                // Error at parse-time for:
+                //   1. container: {image: 'docker://'}
+                //   2. services.foo: {image: ''}
+                //   3. services.foo: {image: 'docker://'}
+                //
+                // Do not error for:
+                //   1. container: {image: ''}
+                if (isEarlyValidation && (hadDockerPrefix || isServiceContainer))
+                {
+                    context.Error(value, "Container image cannot be empty");
+                }
+                return null;
             }
 
             return result;
@@ -1183,7 +1236,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
             foreach (var servicePair in servicesMapping)
             {
                 var networkAlias = servicePair.Key.AssertString("services key").Value;
-                var container = ConvertToJobContainer(context, servicePair.Value);
+                var container = ConvertToJobContainer(context, servicePair.Value, isEarlyValidation, isServiceContainer: true);
                 result.Add(new KeyValuePair<String, JobContainer>(networkAlias, container));
             }
 
@@ -1775,7 +1828,7 @@ namespace GitHub.Actions.WorkflowParser.Conversion
             var node = default(ExpressionNode);
             try
             {
-                node = expressionParser.CreateTree(condition, null, namedValues, functions) as ExpressionNode;
+                node = expressionParser.CreateTree(condition, null, namedValues, functions, allowCaseFunction: context.AllowCaseFunction) as ExpressionNode;
             }
             catch (Exception ex)
             {
@@ -1838,9 +1891,9 @@ namespace GitHub.Actions.WorkflowParser.Conversion
                     case "actions":
                         permissions.Actions = permissionLevel;
                         break;
-					case "artifact-metadata":
-						permissions.ArtifactMetadata = permissionLevel;
-						break;
+                    case "artifact-metadata":
+                        permissions.ArtifactMetadata = permissionLevel;
+                        break;
                     case "attestations":
                         permissions.Attestations = permissionLevel;
                         break;

src/Sdk/WorkflowParser/JobContainer.cs

@@ -35,6 +35,24 @@ namespace GitHub.Actions.WorkflowParser
             set;
         }
 
+        /// <summary>
+        /// Gets or sets the container entrypoint override.
+        /// </summary>
+        public String Entrypoint
+        {
+            get;
+            set;
+        }
+
+        /// <summary>
+        /// Gets or sets the container command and args (after the image name).
+        /// </summary>
+        public String Command
+        {
+            get;
+            set;
+        }
+
         /// <summary>
         /// Gets or sets the volumes which are mounted into the container.
         /// </summary>

src/Sdk/WorkflowParser/ObjectTemplating/TemplateContext.cs

@@ -113,6 +113,12 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating
         /// </summary>
         internal Boolean StrictJsonParsing { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether the case expression function is allowed.
+        /// Defaults to true. Set to false to disable the case function.
+        /// </summary>
+        internal Boolean AllowCaseFunction { get; set; } = true;
+
         internal ITraceWriter TraceWriter { get; set; }
 
         private IDictionary<String, Int32> FileIds

src/Sdk/WorkflowParser/ObjectTemplating/Tokens/TemplateToken.cs

@@ -55,7 +55,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -93,7 +93,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -123,7 +123,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,
@@ -153,7 +153,7 @@ namespace GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens
             var originalBytes = context.Memory.CurrentBytes;
             try
             {
-                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions);
+                var tree = new ExpressionParser().CreateTree(expression, null, context.GetExpressionNamedValues(), context.ExpressionFunctions, allowCaseFunction: context.AllowCaseFunction);
                 var options = new EvaluationOptions
                 {
                     MaxMemory = context.Memory.MaxBytes,

src/Sdk/WorkflowParser/WorkflowFeatures.cs

@@ -48,6 +48,13 @@ namespace GitHub.Actions.WorkflowParser
         [DataMember(EmitDefaultValue = false)]
         public bool StrictJsonParsing { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether service containers may specify "entrypoint" and "command".
+        /// Used during parsing and evaluation.
+        /// </summary>
+        [DataMember(EmitDefaultValue = false)]
+        public bool AllowServiceContainerCommand { get; set; }
+
         /// <summary>
         /// Gets the default workflow features.
         /// </summary>
@@ -60,6 +67,7 @@ namespace GitHub.Actions.WorkflowParser
                 Snapshot = false,           // Default to false since this feature is still in an experimental phase
                 StrictJsonParsing = false,  // Default to false since this is temporary for telemetry purposes only
                 AllowModelsPermission = false, // Default to false since we want this to be disabled for all non-production environments
+                AllowServiceContainerCommand = false, // Default to false since this feature is gated by actions_service_container_command
             };
         }
 

src/Sdk/WorkflowParser/workflow-v1.0.json

@@ -2589,21 +2589,53 @@
       "mapping": {
         "properties": {
           "image": {
-            "type": "non-empty-string",
-            "description": "Use `jobs.<job_id>.container.image` to define the Docker image to use as the container to run the action. The value can be the Docker Hub image or a registry name."
+            "type": "string",
+            "description": "The Docker image to use as the container. The value can be the Docker Hub image or a registry name."
           },
           "options": {
-            "type": "non-empty-string",
-            "description": "Use `jobs.<job_id>.container.options` to configure additional Docker container resource options."
+            "type": "string",
+            "description": "Additional Docker container resource options."
           },
           "env": "container-env",
           "ports": {
             "type": "sequence-of-non-empty-string",
-            "description": "Use `jobs.<job_id>.container.ports` to set an array of ports to expose on the container."
+            "description": "An array of ports to expose on the container."
           },
           "volumes": {
             "type": "sequence-of-non-empty-string",
-            "description": "Use `jobs.<job_id>.container.volumes` to set an array of volumes for the container to use. You can use volumes to share data between services or other steps in a job. You can specify named Docker volumes, anonymous Docker volumes, or bind mounts on the host."
+            "description": "An array of volumes for the container to use. You can use volumes to share data between services or other steps in a job. You can specify named Docker volumes, anonymous Docker volumes, or bind mounts on the host."
+          },
+          "credentials": "container-registry-credentials"
+        }
+      }
+    },
+    "service-container-mapping": {
+      "mapping": {
+        "properties": {
+          "image": {
+            "type": "string",
+            "description": "The Docker image to use as the container. The value can be the Docker Hub image or a registry name."
+          },
+          "options": {
+            "type": "string",
+            "description": "Additional Docker container resource options."
+          },
+          "entrypoint": {
+            "type": "string",
+            "description": "Override the default ENTRYPOINT in the service container image."
+          },
+          "command": {
+            "type": "string",
+            "description": "Override the default CMD in the service container image."
+          },
+          "env": "container-env",
+          "ports": {
+            "type": "sequence-of-non-empty-string",
+            "description": "An array of ports to expose on the container."
+          },
+          "volumes": {
+            "type": "sequence-of-non-empty-string",
+            "description": "An array of volumes for the container to use. You can use volumes to share data between services or other steps in a job. You can specify named Docker volumes, anonymous Docker volumes, or bind mounts on the host."
           },
           "credentials": "container-registry-credentials"
         }
@@ -2634,12 +2666,12 @@
         "matrix"
       ],
       "one-of": [
-        "non-empty-string",
-        "container-mapping"
+        "string",
+        "service-container-mapping"
       ]
     },
     "container-registry-credentials": {
-      "description": "If the image's container registry requires authentication to pull the image, you can use `jobs.<job_id>.container.credentials` to set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.",
+      "description": "If the container registry requires authentication to pull the image, set a map of the username and password. The credentials are the same values that you would provide to the `docker login` command.",
       "context": [
         "github",
         "inputs",
@@ -2655,7 +2687,7 @@
       }
     },
     "container-env": {
-      "description": "Use `jobs.<job_id>.container.env` to set a map of variables in the container.",
+      "description": "A map of environment variables to set in the container.",
       "mapping": {
         "loose-key-type": "non-empty-string",
         "loose-value-type": "string-runner-context"

src/Test/L0/Listener/JobDispatcherL0.cs

@@ -739,7 +739,8 @@ namespace GitHub.Runner.Common.Tests.Listener
                 Assert.True(jobDispatcher.RunOnceJobCompleted.Task.IsCompleted, "JobDispatcher should set task complete token for one time agent.");
                 if (jobDispatcher.RunOnceJobCompleted.Task.IsCompleted)
                 {
-                    Assert.True(await jobDispatcher.RunOnceJobCompleted.Task, "JobDispatcher should set task complete token to 'TRUE' for one time agent.");
+                    var result = await jobDispatcher.RunOnceJobCompleted.Task;
+                    Assert.Equal(TaskResult.Succeeded, result);
                 }
             }
         }

src/Test/L0/Listener/RunnerL0.cs

@@ -295,13 +295,13 @@ namespace GitHub.Runner.Common.Tests.Listener
                 _messageListener.Setup(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()))
                     .Returns(Task.CompletedTask);
 
-                var runOnceJobCompleted = new TaskCompletionSource<bool>();
+                var runOnceJobCompleted = new TaskCompletionSource<TaskResult>();
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted)
                     .Returns(runOnceJobCompleted);
                 _jobDispatcher.Setup(x => x.Run(It.IsAny<Pipelines.AgentJobRequestMessage>(), It.IsAny<bool>()))
                     .Callback(() =>
                     {
-                        runOnceJobCompleted.TrySetResult(true);
+                        runOnceJobCompleted.TrySetResult(TaskResult.Succeeded);
                     });
                 _jobNotification.Setup(x => x.StartClient(It.IsAny<String>()))
                     .Callback(() =>
@@ -399,13 +399,13 @@ namespace GitHub.Runner.Common.Tests.Listener
                 _messageListener.Setup(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()))
                     .Returns(Task.CompletedTask);
 
-                var runOnceJobCompleted = new TaskCompletionSource<bool>();
+                var runOnceJobCompleted = new TaskCompletionSource<TaskResult>();
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted)
                     .Returns(runOnceJobCompleted);
                 _jobDispatcher.Setup(x => x.Run(It.IsAny<Pipelines.AgentJobRequestMessage>(), It.IsAny<bool>()))
                     .Callback(() =>
                     {
-                        runOnceJobCompleted.TrySetResult(true);
+                        runOnceJobCompleted.TrySetResult(TaskResult.Succeeded);
                     });
                 _jobNotification.Setup(x => x.StartClient(It.IsAny<String>()))
                     .Callback(() =>
@@ -733,8 +733,8 @@ namespace GitHub.Runner.Common.Tests.Listener
 
                 _configStore.Setup(x => x.IsServiceConfigured()).Returns(false);
 
-                var completedTask = new TaskCompletionSource<bool>();
-                completedTask.SetResult(true);
+                var completedTask = new TaskCompletionSource<TaskResult>();
+                completedTask.SetResult(TaskResult.Succeeded);
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted).Returns(completedTask);
 
                 //Act
@@ -834,8 +834,8 @@ namespace GitHub.Runner.Common.Tests.Listener
 
                 _configStore.Setup(x => x.IsServiceConfigured()).Returns(false);
 
-                var completedTask = new TaskCompletionSource<bool>();
-                completedTask.SetResult(true);
+                var completedTask = new TaskCompletionSource<TaskResult>();
+                completedTask.SetResult(TaskResult.Succeeded);
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted).Returns(completedTask);
 
                 //Act
@@ -954,8 +954,8 @@ namespace GitHub.Runner.Common.Tests.Listener
 
                 _configStore.Setup(x => x.IsServiceConfigured()).Returns(false);
 
-                var completedTask = new TaskCompletionSource<bool>();
-                completedTask.SetResult(true);
+                var completedTask = new TaskCompletionSource<TaskResult>();
+                completedTask.SetResult(TaskResult.Succeeded);
                 _jobDispatcher.Setup(x => x.RunOnceJobCompleted).Returns(completedTask);
 
                 //Act

src/Test/L0/Listener/SelfUpdaterL0.cs

@@ -228,8 +228,8 @@ namespace GitHub.Runner.Common.Tests.Listener
                                  .Returns(Task.FromResult(new TaskAgent()));
 
 
-                    var ex = await Assert.ThrowsAsync<TaskCanceledException>(() => updater.SelfUpdate(_refreshMessage, _jobDispatcher.Object, true, hc.RunnerShutdownToken));
-                    Assert.Contains($"failed after {Constants.RunnerDownloadRetryMaxAttempts} download attempts", ex.Message);
+                    var result = await updater.SelfUpdate(_refreshMessage, _jobDispatcher.Object, true, hc.RunnerShutdownToken);
+                    Assert.False(result);
                 }
             }
             finally
@@ -281,8 +281,8 @@ namespace GitHub.Runner.Common.Tests.Listener
                                  .Returns(Task.FromResult(new TaskAgent()));
 
 
-                    var ex = await Assert.ThrowsAsync<Exception>(() => updater.SelfUpdate(_refreshMessage, _jobDispatcher.Object, true, hc.RunnerShutdownToken));
-                    Assert.Contains("did not match expected Runner Hash", ex.Message);
+                    var result = await updater.SelfUpdate(_refreshMessage, _jobDispatcher.Object, true, hc.RunnerShutdownToken);
+                    Assert.False(result);
                 }
             }
             finally

src/Test/L0/Listener/SelfUpdaterV2L0.cs

@@ -170,8 +170,8 @@ namespace GitHub.Runner.Common.Tests.Listener
                         DownloadUrl = "https://github.com/actions/runner/notexists"
                     };
 
-                    var ex = await Assert.ThrowsAsync<TaskCanceledException>(() => updater.SelfUpdate(message, _jobDispatcher.Object, true, hc.RunnerShutdownToken));
-                    Assert.Contains($"failed after {Constants.RunnerDownloadRetryMaxAttempts} download attempts", ex.Message);
+                    var result = await updater.SelfUpdate(message, _jobDispatcher.Object, true, hc.RunnerShutdownToken);
+                    Assert.False(result);
                 }
             }
             finally
@@ -220,8 +220,8 @@ namespace GitHub.Runner.Common.Tests.Listener
                         SHA256Checksum = "badhash"
                     };
 
-                    var ex = await Assert.ThrowsAsync<Exception>(() => updater.SelfUpdate(message, _jobDispatcher.Object, true, hc.RunnerShutdownToken));
-                    Assert.Contains("did not match expected Runner Hash", ex.Message);
+                    var result = await updater.SelfUpdate(message, _jobDispatcher.Object, true, hc.RunnerShutdownToken);
+                    Assert.False(result);
                 }
             }
             finally

src/Test/L0/Sdk/ExpressionParserL0.cs

@@ -0,0 +1,104 @@
+using GitHub.DistributedTask.Expressions2;
+using GitHub.DistributedTask.Expressions2.Sdk;
+using GitHub.DistributedTask.ObjectTemplating;
+using System;
+using System.Collections.Generic;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Sdk
+{
+    /// <summary>
+    /// Regression tests for ExpressionParser.CreateTree to verify that
+    /// allowCaseFunction does not accidentally set allowUnknownKeywords.
+    /// </summary>
+    public sealed class ExpressionParserL0
+    {
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Sdk")]
+        public void CreateTree_RejectsUnrecognizedNamedValue()
+        {
+            // Regression: allowCaseFunction was passed positionally into
+            // the allowUnknownKeywords parameter, causing all named values
+            // to be silently accepted.
+            var parser = new ExpressionParser();
+            var namedValues = new List<INamedValueInfo>
+            {
+                new NamedValueInfo<ContextValueNode>("inputs"),
+            };
+
+            var ex = Assert.Throws<ParseException>(() =>
+                parser.CreateTree("github.event.repository.private", null, namedValues, null));
+
+            Assert.Contains("Unrecognized named-value", ex.Message);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Sdk")]
+        public void CreateTree_AcceptsRecognizedNamedValue()
+        {
+            var parser = new ExpressionParser();
+            var namedValues = new List<INamedValueInfo>
+            {
+                new NamedValueInfo<ContextValueNode>("inputs"),
+            };
+
+            var node = parser.CreateTree("inputs.foo", null, namedValues, null);
+
+            Assert.NotNull(node);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Sdk")]
+        public void CreateTree_CaseFunctionWorks_WhenAllowed()
+        {
+            var parser = new ExpressionParser();
+            var namedValues = new List<INamedValueInfo>
+            {
+                new NamedValueInfo<ContextValueNode>("github"),
+            };
+
+            var node = parser.CreateTree("case(github.event_name, 'push', 'Push Event')", null, namedValues, null, allowCaseFunction: true);
+
+            Assert.NotNull(node);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Sdk")]
+        public void CreateTree_CaseFunctionRejected_WhenDisallowed()
+        {
+            var parser = new ExpressionParser();
+            var namedValues = new List<INamedValueInfo>
+            {
+                new NamedValueInfo<ContextValueNode>("github"),
+            };
+
+            var ex = Assert.Throws<ParseException>(() =>
+                parser.CreateTree("case(github.event_name, 'push', 'Push Event')", null, namedValues, null, allowCaseFunction: false));
+
+            Assert.Contains("Unrecognized function", ex.Message);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Sdk")]
+        public void CreateTree_CaseFunctionDoesNotAffectUnknownKeywords()
+        {
+            // The key regression test: with allowCaseFunction=true (default),
+            // unrecognized named values must still be rejected.
+            var parser = new ExpressionParser();
+            var namedValues = new List<INamedValueInfo>
+            {
+                new NamedValueInfo<ContextValueNode>("inputs"),
+            };
+
+            var ex = Assert.Throws<ParseException>(() =>
+                parser.CreateTree("github.ref", null, namedValues, null, allowCaseFunction: true));
+
+            Assert.Contains("Unrecognized named-value", ex.Message);
+        }
+    }
+}

src/Test/L0/Worker/ActionCommandManagerL0.cs

@@ -457,6 +457,8 @@ namespace GitHub.Runner.Common.Tests.Worker
                 new SetEnvCommandExtension(),
                 new WarningCommandExtension(),
                 new AddMaskCommandExtension(),
+                new SetOutputCommandExtension(),
+                new SaveStateCommandExtension(),
             };
             foreach (var command in commands)
             {
@@ -499,5 +501,53 @@ namespace GitHub.Runner.Common.Tests.Worker
             };
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetOutputCommand_EmitsTelemetryOnce()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Object.Global.JobTelemetry = new List<JobTelemetry>();
+                var reference = string.Empty;
+                _ec.Setup(x => x.SetOutput(It.IsAny<string>(), It.IsAny<string>(), out reference));
+
+                // First set-output should add telemetry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::set-output name=foo::bar", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+                Assert.Equal(JobTelemetryType.ActionCommand, _ec.Object.Global.JobTelemetry[0].Type);
+                Assert.Equal("DeprecatedCommand: set-output", _ec.Object.Global.JobTelemetry[0].Message);
+                Assert.True(_ec.Object.Global.HasDeprecatedSetOutput);
+
+                // Second set-output should not add another telemetry entry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::set-output name=foo2::bar2", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SaveStateCommand_EmitsTelemetryOnce()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Object.Global.JobTelemetry = new List<JobTelemetry>();
+                _ec.Setup(x => x.IsEmbedded).Returns(false);
+                _ec.Setup(x => x.IntraActionState).Returns(new Dictionary<string, string>());
+
+                // First save-state should add telemetry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::save-state name=foo::bar", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+                Assert.Equal(JobTelemetryType.ActionCommand, _ec.Object.Global.JobTelemetry[0].Type);
+                Assert.Equal("DeprecatedCommand: save-state", _ec.Object.Global.JobTelemetry[0].Message);
+                Assert.True(_ec.Object.Global.HasDeprecatedSaveState);
+
+                // Second save-state should not add another telemetry entry
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "::save-state name=foo2::bar2", null));
+                Assert.Single(_ec.Object.Global.JobTelemetry);
+            }
+        }
+
     }
 }

src/Test/L0/Worker/ActionManagerL0.cs

@@ -468,6 +468,73 @@ runs:
             }
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async void PrepareActions_SymlinkCacheIsReentrant()
+        {
+            try
+            {
+                //Arrange
+                Environment.SetEnvironmentVariable(Constants.Variables.Agent.SymlinkCachedActions, "true");
+                Setup();
+                var actionId = Guid.NewGuid();
+                var actions = new List<Pipelines.ActionStep>
+                {
+                    new Pipelines.ActionStep()
+                    {
+                        Name = "action",
+                        Id = actionId,
+                        Reference = new Pipelines.RepositoryPathReference()
+                        {
+                            Name = "actions/checkout",
+                            Ref = "master",
+                            RepositoryType = "GitHub"
+                        }
+                    },
+                    new Pipelines.ActionStep()
+                    {
+                        Name = "action",
+                        Id = actionId,
+                        Reference = new Pipelines.RepositoryPathReference()
+                        {
+                            Name = "actions/checkout",
+                            Ref = "master",
+                            RepositoryType = "GitHub"
+                        }
+                    }
+                };
+
+                const string Content = @"
+name: 'Test'
+runs:
+  using: 'node20'
+  main: 'dist/index.js'
+";
+
+                string actionsArchive = Path.Combine(_hc.GetDirectory(WellKnownDirectory.Temp), "actions_archive", "action_checkout");
+                Directory.CreateDirectory(actionsArchive);
+                Directory.CreateDirectory(Path.Combine(actionsArchive, "actions_checkout", "master-sha"));
+                Directory.CreateDirectory(Path.Combine(actionsArchive, "actions_checkout", "master-sha", "content"));
+                await File.WriteAllTextAsync(Path.Combine(actionsArchive, "actions_checkout", "master-sha", "content", "action.yml"), Content);
+                Environment.SetEnvironmentVariable(Constants.Variables.Agent.ActionArchiveCacheDirectory, actionsArchive);
+
+                //Act
+                await _actionManager.PrepareActionsAsync(_ec.Object, actions);
+
+                //Assert
+                string destDirectory = Path.Combine(_hc.GetDirectory(WellKnownDirectory.Actions), "actions", "checkout", "master");
+                Assert.True(Directory.Exists(destDirectory), "Destination directory does not exist");  
+                var di = new DirectoryInfo(destDirectory);   
+                Assert.NotNull(di.LinkTarget); 
+            }
+            finally
+            {
+                Environment.SetEnvironmentVariable(Constants.Variables.Agent.SymlinkCachedActions, null);
+                Teardown();
+            }
+        }
+
 #if OS_LINUX
         [Fact]
         [Trait("Level", "L0")]
@@ -2504,14 +2571,20 @@ runs:
             _pluginManager = new Mock<IRunnerPluginManager>();
             _pluginManager.Setup(x => x.GetPluginAction(It.IsAny<string>())).Returns(new RunnerPluginActionInfo() { PluginTypeName = "plugin.class, plugin", PostPluginTypeName = "plugin.cleanup, plugin" });
 
-            var actionManifest = new ActionManifestManager();
-            actionManifest.Initialize(_hc);
+            var actionManifestLegacy = new ActionManifestManagerLegacy();
+            actionManifestLegacy.Initialize(_hc);
+            _hc.SetSingleton<IActionManifestManagerLegacy>(actionManifestLegacy);
+            var actionManifestNew = new ActionManifestManager();
+            actionManifestNew.Initialize(_hc);
+            _hc.SetSingleton<IActionManifestManager>(actionManifestNew);
+            var actionManifestWrapper = new ActionManifestManagerWrapper();
+            actionManifestWrapper.Initialize(_hc);
 
             _hc.SetSingleton<IDockerCommandManager>(_dockerManager.Object);
             _hc.SetSingleton<IJobServer>(_jobServer.Object);
             _hc.SetSingleton<ILaunchServer>(_launchServer.Object);
             _hc.SetSingleton<IRunnerPluginManager>(_pluginManager.Object);
-            _hc.SetSingleton<IActionManifestManager>(actionManifest);
+            _hc.SetSingleton<IActionManifestManagerWrapper>(actionManifestWrapper);
             _hc.SetSingleton<IHttpClientHandlerFactory>(new HttpClientHandlerFactory());
 
             _configurationStore = new Mock<IConfigurationStore>();

src/Test/L0/Worker/ActionManifestManagerL0.cs

@@ -1,9 +1,11 @@
-using GitHub.DistributedTask.Expressions2;
-using GitHub.DistributedTask.ObjectTemplating.Tokens;
-using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.Actions.Expressions;
+using GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens;
+using GitHub.Actions.Expressions.Data;
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Worker;
-using GitHub.Runner.Worker.Expressions;
+using GitHub.Actions.WorkflowParser;
+using LegacyContextData = GitHub.DistributedTask.Pipelines.ContextData;
+using LegacyExpressions = GitHub.DistributedTask.Expressions2;
 using Moq;
 using System;
 using System.Collections.Generic;
@@ -49,7 +51,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -93,7 +95,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -139,7 +141,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -185,7 +187,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -231,7 +233,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -276,7 +278,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
             }
@@ -314,7 +316,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("Dockerfile", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -357,7 +359,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
 
-                var containerAction = result.Execution as ContainerActionExecutionData;
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
 
                 Assert.Equal("docker://ubuntu:18.04", containerAction.Image);
                 Assert.Equal("main.sh", containerAction.EntryPoint);
@@ -826,10 +828,10 @@ namespace GitHub.Runner.Common.Tests.Worker
                 arguments.Add(new BasicExpressionToken(null, null, null, "inputs.greeting"));
                 arguments.Add(new StringToken(null, null, null, "test"));
 
-                var inputsContext = new DictionaryContextData();
-                inputsContext.Add("greeting", new StringContextData("hello"));
+                var inputsContext = new DictionaryExpressionData();
+                inputsContext.Add("greeting", new StringExpressionData("hello"));
 
-                var evaluateContext = new Dictionary<string, PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+                var evaluateContext = new Dictionary<string, ExpressionData>(StringComparer.OrdinalIgnoreCase);
                 evaluateContext["inputs"] = inputsContext;
                 //Act
 
@@ -863,10 +865,10 @@ namespace GitHub.Runner.Common.Tests.Worker
                 environment.Add(new StringToken(null, null, null, "hello"), new BasicExpressionToken(null, null, null, "inputs.greeting"));
                 environment.Add(new StringToken(null, null, null, "test"), new StringToken(null, null, null, "test"));
 
-                var inputsContext = new DictionaryContextData();
-                inputsContext.Add("greeting", new StringContextData("hello"));
+                var inputsContext = new DictionaryExpressionData();
+                inputsContext.Add("greeting", new StringExpressionData("hello"));
 
-                var evaluateContext = new Dictionary<string, PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+                var evaluateContext = new Dictionary<string, ExpressionData>(StringComparer.OrdinalIgnoreCase);
                 evaluateContext["inputs"] = inputsContext;
 
                 //Act
@@ -896,17 +898,17 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var actionManifest = new ActionManifestManager();
                 actionManifest.Initialize(_hc);
 
-                _ec.Object.ExpressionValues["github"] = new DictionaryContextData
+                _ec.Object.ExpressionValues["github"] = new LegacyContextData.DictionaryContextData
                 {
-                    { "ref", new StringContextData("refs/heads/main") },
+                    { "ref", new LegacyContextData.StringContextData("refs/heads/main") },
                 };
-                _ec.Object.ExpressionValues["strategy"] = new DictionaryContextData();
-                _ec.Object.ExpressionValues["matrix"] = new DictionaryContextData();
-                _ec.Object.ExpressionValues["steps"] = new DictionaryContextData();
-                _ec.Object.ExpressionValues["job"] = new DictionaryContextData();
-                _ec.Object.ExpressionValues["runner"] = new DictionaryContextData();
-                _ec.Object.ExpressionValues["env"] = new DictionaryContextData();
-                _ec.Object.ExpressionFunctions.Add(new FunctionInfo<HashFilesFunction>("hashFiles", 1, 255));
+                _ec.Object.ExpressionValues["strategy"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["matrix"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["steps"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["job"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["runner"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["env"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionFunctions.Add(new LegacyExpressions.FunctionInfo<GitHub.Runner.Worker.Expressions.HashFilesFunction>("hashFiles", 1, 255));
 
                 //Act
                 var result = actionManifest.EvaluateDefaultInput(_ec.Object, "testInput", new StringToken(null, null, null, "defaultValue"));
@@ -926,6 +928,58 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Load_ContainerAction_RejectsInvalidExpressionContext()
+        {
+            try
+            {
+                // Arrange
+                Setup();
+
+                var actionManifest = new ActionManifestManager();
+                actionManifest.Initialize(_hc);
+
+                // Act & Assert — github is not a valid context for container-runs-env (only inputs is allowed)
+                var ex = Assert.Throws<ArgumentException>(() =>
+                    actionManifest.Load(_ec.Object, Path.Combine(TestUtil.GetTestDataPath(), "dockerfileaction_env_invalid_context.yml")));
+
+                Assert.Contains("Failed to load", ex.Message);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Load_ContainerAction_AcceptsValidExpressionContext()
+        {
+            try
+            {
+                // Arrange
+                Setup();
+
+                var actionManifest = new ActionManifestManager();
+                actionManifest.Initialize(_hc);
+
+                // Act — inputs is a valid context for container-runs-env
+                var result = actionManifest.Load(_ec.Object, Path.Combine(TestUtil.GetTestDataPath(), "dockerfileaction_arg_env_expression.yml"));
+
+                // Assert
+                var containerAction = result.Execution as ContainerActionExecutionDataNew;
+                Assert.NotNull(containerAction);
+                Assert.Equal("${{ inputs.entryPoint }}", containerAction.Environment[1].Value.ToString());
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
         private void Setup([CallerMemberName] string name = "")
         {
             _ecTokenSource?.Dispose();
@@ -934,6 +988,9 @@ namespace GitHub.Runner.Common.Tests.Worker
             // Test host context.
             _hc = new TestHostContext(this, name);
 
+            var expressionValues = new LegacyContextData.DictionaryContextData();
+            var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
             _ec = new Mock<IExecutionContext>();
             _ec.Setup(x => x.Global)
                 .Returns(new GlobalContext
@@ -943,8 +1000,8 @@ namespace GitHub.Runner.Common.Tests.Worker
                     WriteDebug = true,
                 });
             _ec.Setup(x => x.CancellationToken).Returns(_ecTokenSource.Token);
-            _ec.Setup(x => x.ExpressionValues).Returns(new DictionaryContextData());
-            _ec.Setup(x => x.ExpressionFunctions).Returns(new List<IFunctionInfo>());
+            _ec.Setup(x => x.ExpressionValues).Returns(expressionValues);
+            _ec.Setup(x => x.ExpressionFunctions).Returns(expressionFunctions);
             _ec.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>())).Callback((string tag, string message) => { _hc.GetTrace().Info($"{tag}{message}"); });
             _ec.Setup(x => x.AddIssue(It.IsAny<Issue>(), It.IsAny<ExecutionContextLogOptions>())).Callback((Issue issue, ExecutionContextLogOptions logOptions) => { _hc.GetTrace().Info($"[{issue.Type}]{logOptions.LogMessageOverride ?? issue.Message}"); });
         }

src/Test/L0/Worker/ActionManifestParserComparisonL0.cs

@@ -0,0 +1,458 @@
+using GitHub.Actions.WorkflowParser;
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.Pipelines.ObjectTemplating;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker;
+using LegacyContextData = GitHub.DistributedTask.Pipelines.ContextData;
+using LegacyExpressions = GitHub.DistributedTask.Expressions2;
+using Moq;
+using Newtonsoft.Json;
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Worker
+{
+    /// <summary>
+    /// Tests for parser comparison wrapper classes.
+    /// </summary>
+    public sealed class ActionManifestParserComparisonL0
+    {
+        private CancellationTokenSource _ecTokenSource;
+        private Mock<IExecutionContext> _ec;
+        private TestHostContext _hc;
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void ConvertToLegacySteps_ProducesCorrectSteps_WithExplicitPropertyMapping()
+        {
+            try
+            {
+                // Arrange - Test that ActionManifestManagerWrapper properly converts new steps to legacy format
+                Setup();
+
+                // Enable comparison feature
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                // Register required services
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var manifestPath = Path.Combine(TestUtil.GetTestDataPath(), "conditional_composite_action.yml");
+
+                // Act - Load through the wrapper (which internally converts)
+                var result = wrapper.Load(_ec.Object, manifestPath);
+
+                // Assert
+                Assert.NotNull(result);
+                Assert.Equal(ActionExecutionType.Composite, result.Execution.ExecutionType);
+
+                var compositeExecution = result.Execution as CompositeActionExecutionData;
+                Assert.NotNull(compositeExecution);
+                Assert.NotNull(compositeExecution.Steps);
+                Assert.Equal(6, compositeExecution.Steps.Count);
+
+                // Verify steps are NOT null (this was the bug - JSON round-trip produced nulls)
+                foreach (var step in compositeExecution.Steps)
+                {
+                    Assert.NotNull(step);
+                    Assert.NotNull(step.Reference);
+                    Assert.IsType<GitHub.DistributedTask.Pipelines.ScriptReference>(step.Reference);
+                }
+
+                // Verify step with condition
+                var successStep = compositeExecution.Steps[2];
+                Assert.Equal("success-conditional", successStep.ContextName);
+                Assert.Equal("success()", successStep.Condition);
+
+                // Verify step with complex condition
+                var lastStep = compositeExecution.Steps[5];
+                Assert.Contains("inputs.exit-code == 1", lastStep.Condition);
+                Assert.Contains("failure()", lastStep.Condition);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_EmptyImage_BothParsersReturnNull()
+        {
+            try
+            {
+                // Arrange - Test that both parsers return null for empty container image at runtime
+                Setup();
+
+                var fileTable = new List<string>();
+
+                // Create legacy evaluator
+                var legacyTraceWriter = new GitHub.DistributedTask.ObjectTemplating.EmptyTraceWriter();
+                var schema = PipelineTemplateSchemaFactory.GetSchema();
+                var legacyEvaluator = new PipelineTemplateEvaluator(legacyTraceWriter, schema, fileTable);
+
+                // Create new evaluator
+                var newTraceWriter = new GitHub.Actions.WorkflowParser.ObjectTemplating.EmptyTraceWriter();
+                var newEvaluator = new WorkflowTemplateEvaluator(newTraceWriter, fileTable, features: null);
+
+                // Create a token representing an empty container image (simulates expression evaluated to empty string)
+                var emptyImageToken = new StringToken(null, null, null, "");
+
+                var contextData = new DictionaryContextData();
+                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
+                // Act - Call both evaluators
+                var legacyResult = legacyEvaluator.EvaluateJobContainer(emptyImageToken, contextData, expressionFunctions);
+
+                // Convert token for new evaluator
+                var newToken = new GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.StringToken(null, null, null, "");
+                var newContextData = new GitHub.Actions.Expressions.Data.DictionaryExpressionData();
+                var newExpressionFunctions = new List<GitHub.Actions.Expressions.IFunctionInfo>();
+
+                var newResult = newEvaluator.EvaluateJobContainer(newToken, newContextData, newExpressionFunctions);
+
+                // Assert - Both should return null for empty image (no container)
+                Assert.Null(legacyResult);
+                Assert.Null(newResult);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void FromJsonEmptyString_BothParsersFail_WithDifferentMessages()
+        {
+            // This test verifies that both parsers fail with different error messages when parsing fromJSON('')
+            // The comparison layer should treat these as semantically equivalent (both are JSON parse errors)
+            try
+            {
+                Setup();
+
+                var fileTable = new List<string>();
+
+                // Create legacy evaluator
+                var legacyTraceWriter = new GitHub.DistributedTask.ObjectTemplating.EmptyTraceWriter();
+                var schema = PipelineTemplateSchemaFactory.GetSchema();
+                var legacyEvaluator = new PipelineTemplateEvaluator(legacyTraceWriter, schema, fileTable);
+
+                // Create new evaluator
+                var newTraceWriter = new GitHub.Actions.WorkflowParser.ObjectTemplating.EmptyTraceWriter();
+                var newEvaluator = new WorkflowTemplateEvaluator(newTraceWriter, fileTable, features: null);
+
+                // Create expression token for fromJSON('')
+                var legacyToken = new BasicExpressionToken(null, null, null, "fromJson('')");
+                var newToken = new GitHub.Actions.WorkflowParser.ObjectTemplating.Tokens.BasicExpressionToken(null, null, null, "fromJson('')");
+
+                var contextData = new DictionaryContextData();
+                var newContextData = new GitHub.Actions.Expressions.Data.DictionaryExpressionData();
+                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+                var newExpressionFunctions = new List<GitHub.Actions.Expressions.IFunctionInfo>();
+
+                // Act - Both should throw
+                Exception legacyException = null;
+                Exception newException = null;
+
+                try
+                {
+                    legacyEvaluator.EvaluateStepDisplayName(legacyToken, contextData, expressionFunctions);
+                }
+                catch (Exception ex)
+                {
+                    legacyException = ex;
+                }
+
+                try
+                {
+                    newEvaluator.EvaluateStepName(newToken, newContextData, newExpressionFunctions);
+                }
+                catch (Exception ex)
+                {
+                    newException = ex;
+                }
+
+                // Assert - Both threw exceptions
+                Assert.NotNull(legacyException);
+                Assert.NotNull(newException);
+
+                // Verify the error messages are different (which is why we need semantic comparison)
+                Assert.NotEqual(legacyException.Message, newException.Message);
+
+                // Verify both are JSON parse errors (contain JSON-related error indicators)
+                var legacyFullMsg = GetFullExceptionMessage(legacyException);
+                var newFullMsg = GetFullExceptionMessage(newException);
+
+                // At least one should contain indicators of JSON parsing failure
+                var legacyIsJsonError = legacyFullMsg.Contains("JToken") ||
+                                        legacyFullMsg.Contains("JsonReader") ||
+                                        legacyFullMsg.Contains("fromJson");
+                var newIsJsonError = newFullMsg.Contains("JToken") ||
+                                     newFullMsg.Contains("JsonReader") ||
+                                     newFullMsg.Contains("fromJson");
+
+                Assert.True(legacyIsJsonError, $"Legacy exception should be JSON error: {legacyFullMsg}");
+                Assert.True(newIsJsonError, $"New exception should be JSON error: {newFullMsg}");
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateDefaultInput_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                _ec.Object.ExpressionValues["github"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["strategy"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["matrix"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["steps"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["job"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["runner"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionValues["env"] = new LegacyContextData.DictionaryContextData();
+                _ec.Object.ExpressionFunctions.Add(new LegacyExpressions.FunctionInfo<GitHub.Runner.Worker.Expressions.HashFilesFunction>("hashFiles", 1, 255));
+
+                var result = wrapper.EvaluateDefaultInput(_ec.Object, "testInput", new StringToken(null, null, null, "defaultValue"));
+
+                Assert.Equal("defaultValue", result);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateContainerArguments_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var arguments = new SequenceToken(null, null, null);
+                arguments.Add(new StringToken(null, null, null, "arg1"));
+                arguments.Add(new StringToken(null, null, null, "arg2"));
+
+                var evaluateContext = new Dictionary<string, LegacyContextData.PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+
+                var result = wrapper.EvaluateContainerArguments(_ec.Object, arguments, evaluateContext);
+
+                Assert.Equal(2, result.Count);
+                Assert.Equal("arg1", result[0]);
+                Assert.Equal("arg2", result[1]);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateContainerEnvironment_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var environment = new MappingToken(null, null, null);
+                environment.Add(new StringToken(null, null, null, "hello"), new StringToken(null, null, null, "world"));
+
+                var evaluateContext = new Dictionary<string, LegacyContextData.PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+
+                var result = wrapper.EvaluateContainerEnvironment(_ec.Object, environment, evaluateContext);
+
+                Assert.Equal(1, result.Count);
+                Assert.Equal("world", result["hello"]);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateCompositeOutputs_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var outputDef = new MappingToken(null, null, null);
+                outputDef.Add(new StringToken(null, null, null, "description"), new StringToken(null, null, null, "test output"));
+                outputDef.Add(new StringToken(null, null, null, "value"), new StringToken(null, null, null, "value1"));
+
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "output1"), outputDef);
+
+                var evaluateContext = new Dictionary<string, LegacyContextData.PipelineContextData>(StringComparer.OrdinalIgnoreCase);
+
+                var result = wrapper.EvaluateCompositeOutputs(_ec.Object, token, evaluateContext);
+
+                Assert.NotNull(result);
+                Assert.False(_ec.Object.Global.HasActionManifestMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Load_BothParsersRejectInvalidExpressionContext()
+        {
+            try
+            {
+                // Arrange — regression test: both parsers must reject github context
+                // in container-runs-env (only inputs is allowed per schema)
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var legacyManager = new ActionManifestManagerLegacy();
+                legacyManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManagerLegacy>(legacyManager);
+
+                var newManager = new ActionManifestManager();
+                newManager.Initialize(_hc);
+                _hc.SetSingleton<IActionManifestManager>(newManager);
+
+                var wrapper = new ActionManifestManagerWrapper();
+                wrapper.Initialize(_hc);
+
+                var manifestPath = Path.Combine(TestUtil.GetTestDataPath(), "dockerfileaction_env_invalid_context.yml");
+
+                // Act & Assert — both parsers should reject, wrapper should throw
+                Assert.Throws<ArgumentException>(() => wrapper.Load(_ec.Object, manifestPath));
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        private string GetFullExceptionMessage(Exception ex)
+        {
+            var messages = new List<string>();
+            var current = ex;
+            while (current != null)
+            {
+                messages.Add(current.Message);
+                current = current.InnerException;
+            }
+            return string.Join(" -> ", messages);
+        }
+
+        private void Setup([CallerMemberName] string name = "")
+        {
+            _ecTokenSource?.Dispose();
+            _ecTokenSource = new CancellationTokenSource();
+
+            _hc = new TestHostContext(this, name);
+
+            var expressionValues = new LegacyContextData.DictionaryContextData();
+            var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
+            _ec = new Mock<IExecutionContext>();
+            _ec.Setup(x => x.Global)
+                .Returns(new GlobalContext
+                {
+                    FileTable = new List<String>(),
+                    Variables = new Variables(_hc, new Dictionary<string, VariableValue>()),
+                    WriteDebug = true,
+                });
+            _ec.Setup(x => x.CancellationToken).Returns(_ecTokenSource.Token);
+            _ec.Setup(x => x.ExpressionValues).Returns(expressionValues);
+            _ec.Setup(x => x.ExpressionFunctions).Returns(expressionFunctions);
+            _ec.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>())).Callback((string tag, string message) => { _hc.GetTrace().Info($"{tag}{message}"); });
+            _ec.Setup(x => x.AddIssue(It.IsAny<Issue>(), It.IsAny<ExecutionContextLogOptions>())).Callback((Issue issue, ExecutionContextLogOptions logOptions) => { _hc.GetTrace().Info($"[{issue.Type}]{logOptions.LogMessageOverride ?? issue.Message}"); });
+        }
+
+        private void Teardown()
+        {
+            _hc?.Dispose();
+        }
+    }
+}

src/Test/L0/Worker/ActionRunnerL0.cs

@@ -25,7 +25,7 @@ namespace GitHub.Runner.Common.Tests.Worker
         private Mock<IExecutionContext> _ec;
         private TestHostContext _hc;
         private ActionRunner _actionRunner;
-        private IActionManifestManager _actionManifestManager;
+        private IActionManifestManagerWrapper _actionManifestManager;
         private Mock<IFileCommandManager> _fileCommandManager;
 
         private DictionaryContextData _context = new();
@@ -316,6 +316,94 @@ namespace GitHub.Runner.Common.Tests.Worker
             Assert.Equal("${{ matrix.node }}", _actionRunner.DisplayName);
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateDisplayNameForLocalAction()
+        {
+            // Arrange
+            Setup();
+            var actionId = Guid.NewGuid();
+            var action = new Pipelines.ActionStep()
+            {
+                Name = "action",
+                Id = actionId,
+                Reference = new Pipelines.RepositoryPathReference()
+                {
+                    RepositoryType = Pipelines.PipelineConstants.SelfAlias,
+                    Path = "./"
+                }
+            };
+            _actionRunner.Action = action;
+
+            // Act
+            var validDisplayName = _actionRunner.EvaluateDisplayName(_context, _actionRunner.ExecutionContext, out bool updated);
+
+            // Assert
+            Assert.True(validDisplayName);
+            Assert.True(updated);
+            Assert.Equal("Run ./", _actionRunner.DisplayName);  // NOT "Run /./"
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateDisplayNameForLocalActionWithPath()
+        {
+            // Arrange
+            Setup();
+            var actionId = Guid.NewGuid();
+            var action = new Pipelines.ActionStep()
+            {
+                Name = "action",
+                Id = actionId,
+                Reference = new Pipelines.RepositoryPathReference()
+                {
+                    RepositoryType = Pipelines.PipelineConstants.SelfAlias,
+                    Path = "./.github/actions/my-action"
+                }
+            };
+            _actionRunner.Action = action;
+
+            // Act
+            var validDisplayName = _actionRunner.EvaluateDisplayName(_context, _actionRunner.ExecutionContext, out bool updated);
+
+            // Assert
+            Assert.True(validDisplayName);
+            Assert.True(updated);
+            Assert.Equal("Run ./.github/actions/my-action", _actionRunner.DisplayName);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateDisplayNameForRemoteActionWithPath()
+        {
+            // Arrange
+            Setup();
+            var actionId = Guid.NewGuid();
+            var action = new Pipelines.ActionStep()
+            {
+                Name = "action",
+                Id = actionId,
+                Reference = new Pipelines.RepositoryPathReference()
+                {
+                    Name = "owner/repo",
+                    Path = "subdir",
+                    Ref = "v1"
+                }
+            };
+            _actionRunner.Action = action;
+
+            // Act
+            var validDisplayName = _actionRunner.EvaluateDisplayName(_context, _actionRunner.ExecutionContext, out bool updated);
+
+            // Assert
+            Assert.True(validDisplayName);
+            Assert.True(updated);
+            Assert.Equal("Run owner/repo/subdir@v1", _actionRunner.DisplayName);
+        }
+
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]
@@ -459,9 +547,16 @@ namespace GitHub.Runner.Common.Tests.Worker
 
             _handlerFactory = new Mock<IHandlerFactory>();
             _defaultStepHost = new Mock<IDefaultStepHost>();
-            _actionManifestManager = new ActionManifestManager();
-            _fileCommandManager = new Mock<IFileCommandManager>();
+
+            var actionManifestLegacy = new ActionManifestManagerLegacy();
+            actionManifestLegacy.Initialize(_hc);
+            _hc.SetSingleton<IActionManifestManagerLegacy>(actionManifestLegacy);
+            var actionManifestNew = new ActionManifestManager();
+            actionManifestNew.Initialize(_hc);
+            _hc.SetSingleton<IActionManifestManager>(actionManifestNew);
+            _actionManifestManager = new ActionManifestManagerWrapper();
             _actionManifestManager.Initialize(_hc);
+            _fileCommandManager = new Mock<IFileCommandManager>();
 
             var githubContext = new GitHubContext();
             githubContext.Add("event", JToken.Parse("{\"foo\":\"bar\"}").ToPipelineContextData());
@@ -489,7 +584,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
             _hc.SetSingleton<IActionManager>(_actionManager.Object);
             _hc.SetSingleton<IHandlerFactory>(_handlerFactory.Object);
-            _hc.SetSingleton<IActionManifestManager>(_actionManifestManager);
+            _hc.SetSingleton<IActionManifestManagerWrapper>(_actionManifestManager);
 
             _hc.EnqueueInstance<IDefaultStepHost>(_defaultStepHost.Object);
 

src/Test/L0/Worker/HandlerFactoryL0.cs

@@ -74,7 +74,7 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
-      
+
 
         [Fact]
         [Trait("Level", "L0")]
@@ -116,5 +116,259 @@ namespace GitHub.Runner.Common.Tests.Worker
                 Assert.Equal("node24", handler.Data.NodeVersion);
             }
         }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Node20Action_TrackedWhenWarnFlagEnabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var hf = new HandlerFactory();
+                hf.Initialize(hc);
+
+                var variables = new Dictionary<string, VariableValue>
+                {
+                    { Constants.Runner.NodeMigration.WarnOnNode20Flag, new VariableValue("true") }
+                };
+                Variables serverVariables = new(hc, variables);
+                var deprecatedActions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                _ec.Setup(x => x.Global).Returns(new GlobalContext()
+                {
+                    Variables = serverVariables,
+                    EnvironmentVariables = new Dictionary<string, string>(),
+                    DeprecatedNode20Actions = deprecatedActions
+                });
+
+                var actionRef = new RepositoryPathReference
+                {
+                    Name = "actions/checkout",
+                    Ref = "v4"
+                };
+
+                // Act.
+                var data = new NodeJSActionExecutionData();
+                data.NodeVersion = "node20";
+                hf.Create(
+                    _ec.Object,
+                    actionRef,
+                    new Mock<IStepHost>().Object,
+                    data,
+                    new Dictionary<string, string>(),
+                    new Dictionary<string, string>(),
+                    new Variables(hc, new Dictionary<string, VariableValue>()),
+                    "",
+                    new List<JobExtensionRunner>()
+                );
+
+                // Assert.
+                Assert.Contains("actions/checkout@v4", deprecatedActions);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Node20Action_NotTrackedWhenWarnFlagDisabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var hf = new HandlerFactory();
+                hf.Initialize(hc);
+
+                var variables = new Dictionary<string, VariableValue>();
+                Variables serverVariables = new(hc, variables);
+                var deprecatedActions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                _ec.Setup(x => x.Global).Returns(new GlobalContext()
+                {
+                    Variables = serverVariables,
+                    EnvironmentVariables = new Dictionary<string, string>(),
+                    DeprecatedNode20Actions = deprecatedActions
+                });
+
+                var actionRef = new RepositoryPathReference
+                {
+                    Name = "actions/checkout",
+                    Ref = "v4"
+                };
+
+                // Act.
+                var data = new NodeJSActionExecutionData();
+                data.NodeVersion = "node20";
+                hf.Create(
+                    _ec.Object,
+                    actionRef,
+                    new Mock<IStepHost>().Object,
+                    data,
+                    new Dictionary<string, string>(),
+                    new Dictionary<string, string>(),
+                    new Variables(hc, new Dictionary<string, VariableValue>()),
+                    "",
+                    new List<JobExtensionRunner>()
+                );
+
+                // Assert - should not track when flag is disabled
+                Assert.Empty(deprecatedActions);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Node24Action_NotTrackedEvenWhenWarnFlagEnabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var hf = new HandlerFactory();
+                hf.Initialize(hc);
+
+                var variables = new Dictionary<string, VariableValue>
+                {
+                    { Constants.Runner.NodeMigration.WarnOnNode20Flag, new VariableValue("true") }
+                };
+                Variables serverVariables = new(hc, variables);
+                var deprecatedActions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                _ec.Setup(x => x.Global).Returns(new GlobalContext()
+                {
+                    Variables = serverVariables,
+                    EnvironmentVariables = new Dictionary<string, string>(),
+                    DeprecatedNode20Actions = deprecatedActions
+                });
+
+                var actionRef = new RepositoryPathReference
+                {
+                    Name = "actions/checkout",
+                    Ref = "v5"
+                };
+
+                // Act.
+                var data = new NodeJSActionExecutionData();
+                data.NodeVersion = "node24";
+                hf.Create(
+                    _ec.Object,
+                    actionRef,
+                    new Mock<IStepHost>().Object,
+                    data,
+                    new Dictionary<string, string>(),
+                    new Dictionary<string, string>(),
+                    new Variables(hc, new Dictionary<string, VariableValue>()),
+                    "",
+                    new List<JobExtensionRunner>()
+                );
+
+                // Assert - node24 actions should not be tracked
+                Assert.Empty(deprecatedActions);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Node12Action_TrackedAsDeprecatedWhenWarnFlagEnabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var hf = new HandlerFactory();
+                hf.Initialize(hc);
+
+                var variables = new Dictionary<string, VariableValue>
+                {
+                    { Constants.Runner.NodeMigration.WarnOnNode20Flag, new VariableValue("true") }
+                };
+                Variables serverVariables = new(hc, variables);
+                var deprecatedActions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                _ec.Setup(x => x.Global).Returns(new GlobalContext()
+                {
+                    Variables = serverVariables,
+                    EnvironmentVariables = new Dictionary<string, string>(),
+                    DeprecatedNode20Actions = deprecatedActions
+                });
+
+                var actionRef = new RepositoryPathReference
+                {
+                    Name = "some-org/old-action",
+                    Ref = "v1"
+                };
+
+                // Act - node12 gets migrated to node20, then should be tracked
+                var data = new NodeJSActionExecutionData();
+                data.NodeVersion = "node12";
+                hf.Create(
+                    _ec.Object,
+                    actionRef,
+                    new Mock<IStepHost>().Object,
+                    data,
+                    new Dictionary<string, string>(),
+                    new Dictionary<string, string>(),
+                    new Variables(hc, new Dictionary<string, VariableValue>()),
+                    "",
+                    new List<JobExtensionRunner>()
+                );
+
+                // Assert - node12 gets migrated to node20 and should be tracked
+                Assert.Contains("some-org/old-action@v1", deprecatedActions);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void LocalNode20Action_TrackedWhenWarnFlagEnabled()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var hf = new HandlerFactory();
+                hf.Initialize(hc);
+
+                var variables = new Dictionary<string, VariableValue>
+                {
+                    { Constants.Runner.NodeMigration.WarnOnNode20Flag, new VariableValue("true") }
+                };
+                Variables serverVariables = new(hc, variables);
+                var deprecatedActions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+                _ec.Setup(x => x.Global).Returns(new GlobalContext()
+                {
+                    Variables = serverVariables,
+                    EnvironmentVariables = new Dictionary<string, string>(),
+                    DeprecatedNode20Actions = deprecatedActions
+                });
+
+                // Local action: Name is empty, Path is the local path
+                var actionRef = new RepositoryPathReference
+                {
+                    Name = "",
+                    Path = "./.github/actions/my-action",
+                    RepositoryType = "self"
+                };
+
+                // Act.
+                var data = new NodeJSActionExecutionData();
+                data.NodeVersion = "node20";
+                hf.Create(
+                    _ec.Object,
+                    actionRef,
+                    new Mock<IStepHost>().Object,
+                    data,
+                    new Dictionary<string, string>(),
+                    new Dictionary<string, string>(),
+                    new Variables(hc, new Dictionary<string, VariableValue>()),
+                    "",
+                    new List<JobExtensionRunner>()
+                );
+
+                // Assert - local action should be tracked with its path
+                Assert.Contains("./.github/actions/my-action", deprecatedActions);
+            }
+        }
     }
 }

src/Test/L0/Worker/Handlers/CompositeActionHandlerL0.cs

@@ -0,0 +1,335 @@
+using System;
+using System.Collections.Generic;
+using System.Runtime.CompilerServices;
+using GitHub.DistributedTask.Pipelines;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Common.Util;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker;
+using GitHub.Runner.Worker.Handlers;
+using Moq;
+using Newtonsoft.Json.Linq;
+using Xunit;
+using DTWebApi = GitHub.DistributedTask.WebApi;
+using Pipelines = GitHub.DistributedTask.Pipelines;
+
+namespace GitHub.Runner.Common.Tests.Worker.Handlers
+{
+    public sealed class CompositeActionHandlerL0
+    {
+        // Test EscapeProperty helper logic via reflection or by testing the markers output
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EscapeProperty_EscapesSpecialCharacters()
+        {
+            // Test the escaping logic that would be applied
+            var input = "value;with%special\r\n]chars";
+            var escaped = EscapeProperty(input);
+            Assert.Equal("value%3Bwith%25special%0D%0A%5Dchars", escaped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EscapeProperty_HandlesNullAndEmpty()
+        {
+            Assert.Null(EscapeProperty(null));
+            Assert.Equal("", EscapeProperty(""));
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SanitizeDisplayName_TruncatesLongNames()
+        {
+            var longName = new string('a', 1500);
+            var sanitized = SanitizeDisplayName(longName);
+            Assert.Equal(CompositeActionHandler.MaxDisplayNameLength, sanitized.Length);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SanitizeDisplayName_TakesFirstLineOnly()
+        {
+            var multiline = "First line\nSecond line\nThird line";
+            var sanitized = SanitizeDisplayName(multiline);
+            Assert.Equal("First line", sanitized);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SanitizeDisplayName_TrimsLeadingWhitespace()
+        {
+            var withLeading = "   \n  \t  Actual name\nSecond line";
+            var sanitized = SanitizeDisplayName(withLeading);
+            Assert.Equal("Actual name", sanitized);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SanitizeDisplayName_HandlesCarriageReturn()
+        {
+            var withCR = "First line\r\nSecond line";
+            var sanitized = SanitizeDisplayName(withCR);
+            Assert.Equal("First line", sanitized);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SanitizeDisplayName_HandlesNullAndEmpty()
+        {
+            Assert.Null(SanitizeDisplayName(null));
+            Assert.Equal("", SanitizeDisplayName(""));
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EmitMarkers_DisplayNameEscaping()
+        {
+            // Verify that special characters in display names get escaped properly
+            var displayName = "Step with semicolons; and more; here";
+            var escaped = EscapeProperty(SanitizeDisplayName(displayName));
+            Assert.Equal("Step with semicolons%3B and more%3B here", escaped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EmitMarkers_DisplayNameWithBrackets()
+        {
+            var displayName = "Step with [brackets] inside";
+            var escaped = EscapeProperty(SanitizeDisplayName(displayName));
+            Assert.Equal("Step with [brackets%5D inside", escaped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripUserEmittedMarkers_StartAction()
+        {
+            // Simulate what OutputManager does to strip markers
+            var userLine = "##[start-action display=Fake;id=fake]";
+            var stripped = StripMarkers(userLine);
+            Assert.Equal(@"##[\start-action display=Fake;id=fake]", stripped);
+            Assert.DoesNotContain("##[start-action", stripped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripUserEmittedMarkers_EndAction()
+        {
+            var userLine = "##[end-action id=fake;outcome=success;conclusion=success;duration_ms=100]";
+            var stripped = StripMarkers(userLine);
+            Assert.Equal(@"##[\end-action id=fake;outcome=success;conclusion=success;duration_ms=100]", stripped);
+            Assert.DoesNotContain("##[end-action", stripped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripUserEmittedMarkers_PreservesOtherCommands()
+        {
+            var userLine = "##[group]My Group";
+            var stripped = StripMarkers(userLine);
+            Assert.Equal("##[group]My Group", stripped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripUserEmittedMarkers_HandlesEmbeddedMarkers()
+        {
+            var userLine = "Some text ##[start-action display=fake;id=fake] more text";
+            var stripped = StripMarkers(userLine);
+            Assert.Equal(@"Some text ##[\start-action display=fake;id=fake] more text", stripped);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void TaskResultToActionResult_Success()
+        {
+            var result = GitHub.DistributedTask.WebApi.TaskResult.Succeeded;
+            var actionResult = result.ToActionResult();
+            Assert.Equal(ActionResult.Success, actionResult);
+            Assert.Equal("success", actionResult.ToString().ToLowerInvariant());
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void TaskResultToActionResult_Failure()
+        {
+            var result = GitHub.DistributedTask.WebApi.TaskResult.Failed;
+            var actionResult = result.ToActionResult();
+            Assert.Equal(ActionResult.Failure, actionResult);
+            Assert.Equal("failure", actionResult.ToString().ToLowerInvariant());
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void TaskResultToActionResult_Cancelled()
+        {
+            var result = GitHub.DistributedTask.WebApi.TaskResult.Canceled;
+            var actionResult = result.ToActionResult();
+            Assert.Equal(ActionResult.Cancelled, actionResult);
+            Assert.Equal("cancelled", actionResult.ToString().ToLowerInvariant());
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void TaskResultToActionResult_Skipped()
+        {
+            var result = GitHub.DistributedTask.WebApi.TaskResult.Skipped;
+            var actionResult = result.ToActionResult();
+            Assert.Equal(ActionResult.Skipped, actionResult);
+            Assert.Equal("skipped", actionResult.ToString().ToLowerInvariant());
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void MarkerFormat_StartAction()
+        {
+            var display = "My Step";
+            var id = "my-step";
+            var marker = $"##[start-action display={EscapeProperty(display)};id={EscapeProperty(id)}]";
+            Assert.Equal("##[start-action display=My Step;id=my-step]", marker);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void MarkerFormat_EndAction()
+        {
+            var id = "my-step";
+            var outcome = "success";
+            var conclusion = "success";
+            var durationMs = 1234;
+            var marker = $"##[end-action id={EscapeProperty(id)};outcome={outcome};conclusion={conclusion};duration_ms={durationMs}]";
+            Assert.Equal("##[end-action id=my-step;outcome=success;conclusion=success;duration_ms=1234]", marker);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void MarkerFormat_NestedId()
+        {
+            var prefix = "outer-composite";
+            var contextName = "inner-step";
+            var stepId = $"{prefix}.{contextName}";
+            Assert.Equal("outer-composite.inner-step", stepId);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void MarkerFormat_SkippedStep()
+        {
+            var id = "skipped-step";
+            var marker = $"##[end-action id={EscapeProperty(id)};outcome=skipped;conclusion=skipped;duration_ms=0]";
+            Assert.Equal("##[end-action id=skipped-step;outcome=skipped;conclusion=skipped;duration_ms=0]", marker);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void MarkerFormat_ContinueOnError()
+        {
+            // When continue-on-error is true and step fails:
+            // outcome = failure (raw result)
+            // conclusion = success (after continue-on-error applied)
+            var id = "failing-step";
+            var marker = $"##[end-action id={EscapeProperty(id)};outcome=failure;conclusion=success;duration_ms=500]";
+            Assert.Equal("##[end-action id=failing-step;outcome=failure;conclusion=success;duration_ms=500]", marker);
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void PostStepMarker_UsesEvaluatedDisplayName()
+        {
+            // Arrange: create an ActionRunner with a RepositoryPathReference (simulating actions/cache@v4)
+            // and Stage = Post. Verify that EvaluateDisplayName produces the correct display name
+            // so the composite marker emits "Run actions/cache@v4" instead of the fallback "run".
+            var hc = new TestHostContext(this, nameof(PostStepMarker_UsesEvaluatedDisplayName));
+            var actionManifestLegacy = new ActionManifestManagerLegacy();
+            actionManifestLegacy.Initialize(hc);
+            hc.SetSingleton<IActionManifestManagerLegacy>(actionManifestLegacy);
+            var actionManifestNew = new ActionManifestManager();
+            actionManifestNew.Initialize(hc);
+            hc.SetSingleton<IActionManifestManager>(actionManifestNew);
+            var actionManifestManager = new ActionManifestManagerWrapper();
+            actionManifestManager.Initialize(hc);
+            hc.SetSingleton<IActionManifestManagerWrapper>(actionManifestManager);
+
+            var ec = new Mock<IExecutionContext>();
+            var contextData = new DictionaryContextData();
+            var githubContext = new GitHubContext();
+            githubContext.Add("event", JToken.Parse("{\"foo\":\"bar\"}").ToPipelineContextData());
+            contextData.Add("github", githubContext);
+#if OS_WINDOWS
+            contextData["env"] = new DictionaryContextData();
+#else
+            contextData["env"] = new CaseSensitiveDictionaryContextData();
+#endif
+            ec.Setup(x => x.Global).Returns(new GlobalContext());
+            ec.Setup(x => x.ExpressionValues).Returns(contextData);
+            ec.Setup(x => x.ExpressionFunctions).Returns(new List<GitHub.DistributedTask.Expressions2.IFunctionInfo>());
+            ec.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>()));
+            ec.Object.Global.Variables = new Variables(hc, new Dictionary<string, VariableValue>());
+
+            var actionRunner = new ActionRunner();
+            actionRunner.Initialize(hc);
+            actionRunner.ExecutionContext = ec.Object;
+            actionRunner.Stage = ActionRunStage.Post;
+            actionRunner.Action = new Pipelines.ActionStep()
+            {
+                Name = "cache",
+                Id = Guid.NewGuid(),
+                Reference = new Pipelines.RepositoryPathReference()
+                {
+                    Name = "actions/cache",
+                    Ref = "v4"
+                }
+            };
+
+            // Act: call EvaluateDisplayName directly, which is what CompositeActionHandler now does
+            // for embedded steps (including Post stage) instead of TryUpdateDisplayName.
+            var result = actionRunner.EvaluateDisplayName(contextData, ec.Object, out bool updated);
+
+            // Assert: display name should be "Run actions/cache@v4", not the fallback "run"
+            Assert.True(result);
+            Assert.True(updated);
+            Assert.Equal("Run actions/cache@v4", actionRunner.DisplayName);
+        }
+
+        // Helper methods that call the real production code
+        private static string EscapeProperty(string value) =>
+            CompositeActionHandler.EscapeProperty(value);
+
+        private static string SanitizeDisplayName(string displayName) =>
+            CompositeActionHandler.SanitizeDisplayName(displayName);
+
+        private static string StripMarkers(string line)
+        {
+            if (!string.IsNullOrEmpty(line) &&
+                (line.Contains("##[start-action") || line.Contains("##[end-action")))
+            {
+                line = line.Replace("##[start-action", @"##[\start-action")
+                           .Replace("##[end-action", @"##[\end-action");
+            }
+            return line;
+        }
+    }
+}

src/Test/L0/Worker/OutputManagerL0.cs

@@ -1006,6 +1006,66 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripCompositeMarkers_StartAction()
+        {
+            using (Setup())
+            using (_outputManager)
+            {
+                Process("##[start-action display=Fake;id=fake]");
+                Assert.Single(_messages);
+                Assert.Contains(@"##[\start-action", _messages[0]);
+                Assert.DoesNotContain("##[start-action", _messages[0]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripCompositeMarkers_EndAction()
+        {
+            using (Setup())
+            using (_outputManager)
+            {
+                Process("##[end-action id=fake;outcome=success;conclusion=success;duration_ms=100]");
+                Assert.Single(_messages);
+                Assert.Contains(@"##[\end-action", _messages[0]);
+                Assert.DoesNotContain("##[end-action", _messages[0]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripCompositeMarkers_PreservesOtherCommands()
+        {
+            using (Setup())
+            using (_outputManager)
+            {
+                Process("##[group]My Group");
+                // Should not be stripped (not a composite marker)
+                Assert.Single(_messages);
+                Assert.Equal("##[group]My Group", _messages[0]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StripCompositeMarkers_EmbeddedInLine()
+        {
+            using (Setup())
+            using (_outputManager)
+            {
+                Process("Some text ##[start-action display=fake;id=fake] more text");
+                Assert.Single(_messages);
+                Assert.Contains(@"##[\start-action", _messages[0]);
+                Assert.DoesNotContain("##[start-action", _messages[0]);
+            }
+        }
+
         private TestHostContext Setup(
             [CallerMemberName] string name = "",
             IssueMatchersConfig matchers = null,

src/Test/L0/Worker/PipelineTemplateEvaluatorWrapperL0.cs

@@ -0,0 +1,891 @@
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
+using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.Pipelines.ObjectTemplating;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker;
+using LegacyContextData = GitHub.DistributedTask.Pipelines.ContextData;
+using LegacyExpressions = GitHub.DistributedTask.Expressions2;
+using Moq;
+using System;
+using System.Collections.Generic;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Worker
+{
+    public sealed class PipelineTemplateEvaluatorWrapperL0
+    {
+        private CancellationTokenSource _ecTokenSource;
+        private Mock<IExecutionContext> _ec;
+        private TestHostContext _hc;
+
+        // -------------------------------------------------------------------
+        // EvaluateAndCompare core behavior
+        // -------------------------------------------------------------------
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_DoesNotRecordMismatch_WhenResultsMatch()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+
+                var token = new StringToken(null, null, null, "test-value");
+                var contextData = new DictionaryContextData();
+                var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepDisplayName(token, contextData, expressionFunctions);
+
+                Assert.Equal("test-value", result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_SkipsMismatchRecording_WhenCancellationOccursDuringEvaluation()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+
+                // Call EvaluateAndCompare directly: the new evaluator cancels the token
+                // and returns a different value, forcing hasMismatch = true.
+                // Because cancellation flipped during the evaluation window, the
+                // mismatch should be skipped.
+                var result = wrapper.EvaluateAndCompare<string, string>(
+                    "TestCancellationSkip",
+                    () => "legacy-value",
+                    () =>
+                    {
+                        _ecTokenSource.Cancel();
+                        return "different-value";
+                    },
+                    (legacy, @new) => string.Equals(legacy, @new, StringComparison.Ordinal));
+
+                Assert.Equal("legacy-value", result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_RecordsMismatch_WhenResultsDifferWithoutCancellation()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+
+                // Different results without cancellation — mismatch SHOULD be recorded.
+                var result = wrapper.EvaluateAndCompare<string, string>(
+                    "TestMismatchRecorded",
+                    () => "legacy-value",
+                    () => "different-value",
+                    (legacy, @new) => string.Equals(legacy, @new, StringComparison.Ordinal));
+
+                Assert.Equal("legacy-value", result);
+                Assert.True(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        // -------------------------------------------------------------------
+        // Smoke tests — both parsers agree, no mismatch recorded
+        // -------------------------------------------------------------------
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepContinueOnError_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new BooleanToken(null, null, null, true);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepContinueOnError(token, contextData, functions);
+
+                Assert.True(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepEnvironment_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "FOO"), new StringToken(null, null, null, "bar"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepEnvironment(token, contextData, functions, StringComparer.OrdinalIgnoreCase);
+
+                Assert.NotNull(result);
+                Assert.Equal("bar", result["FOO"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepIf_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new BasicExpressionToken(null, null, null, "true");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+                var expressionState = new List<KeyValuePair<string, object>>();
+
+                var result = wrapper.EvaluateStepIf(token, contextData, functions, expressionState);
+
+                Assert.True(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepInputs_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "input1"), new StringToken(null, null, null, "val1"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepInputs(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("val1", result["input1"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateStepTimeout_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new NumberToken(null, null, null, 10);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateStepTimeout(token, contextData, functions);
+
+                Assert.Equal(10, result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_EmptyImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new StringToken(null, null, null, "");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_DockerPrefixOnly_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new StringToken(null, null, null, "docker://");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_DockerPrefixOnlyMapping_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, "docker://"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_EmptyImageMapping_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, ""));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_ValidImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new StringToken(null, null, null, "ubuntu:latest");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("ubuntu:latest", result.Image);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobContainer_DockerPrefixWithImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new StringToken(null, null, null, "docker://ubuntu:latest");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobContainer(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("ubuntu:latest", result.Image);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobOutput_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "out1"), new StringToken(null, null, null, "val1"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobOutput(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("val1", result["out1"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateEnvironmentUrl_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new StringToken(null, null, null, "https://example.com");
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateEnvironmentUrl(token, contextData, functions);
+
+                Assert.NotNull(result);
+                var stringResult = result as StringToken;
+                Assert.NotNull(stringResult);
+                Assert.Equal("https://example.com", stringResult.Value);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobDefaultsRun_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var token = new MappingToken(null, null, null);
+                token.Add(new StringToken(null, null, null, "shell"), new StringToken(null, null, null, "bash"));
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobDefaultsRun(token, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Equal("bash", result["shell"]);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_Null_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(null, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_EmptyImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                // Build a services mapping token with one service whose image is empty string
+                // Similar to: services: { db: { image: '' } }
+                var servicesMapping = new MappingToken(null, null, null);
+                var serviceMapping = new MappingToken(null, null, null);
+                serviceMapping.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, ""));
+                servicesMapping.Add(new StringToken(null, null, null, "db"), serviceMapping);
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(servicesMapping, contextData, functions);
+
+                // Should get a list with one entry where the container is null (empty image = no container)
+                Assert.NotNull(result);
+                Assert.Single(result);
+                Assert.Equal("db", result[0].Key);
+                Assert.Null(result[0].Value);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_DockerPrefixOnlyImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var servicesMapping = new MappingToken(null, null, null);
+                var serviceMapping = new MappingToken(null, null, null);
+                serviceMapping.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, "docker://"));
+                servicesMapping.Add(new StringToken(null, null, null, "db"), serviceMapping);
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(servicesMapping, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Single(result);
+                Assert.Equal("db", result[0].Key);
+                Assert.Null(result[0].Value);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_ExpressionEvalsToEmpty_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                // Simulates: services: { db: { image: ${{ condition && 'img' || '' }} } }
+                // where the expression evaluates to '' at runtime
+                var servicesMapping = new MappingToken(null, null, null);
+                var serviceMapping = new MappingToken(null, null, null);
+                serviceMapping.Add(new StringToken(null, null, null, "image"), new BasicExpressionToken(null, null, null, "''"));
+                servicesMapping.Add(new StringToken(null, null, null, "db"), serviceMapping);
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(servicesMapping, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Single(result);
+                Assert.Equal("db", result[0].Key);
+                Assert.Null(result[0].Value);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_ValidImage_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var servicesMapping = new MappingToken(null, null, null);
+                var serviceMapping = new MappingToken(null, null, null);
+                serviceMapping.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, "postgres:latest"));
+                servicesMapping.Add(new StringToken(null, null, null, "db"), serviceMapping);
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(servicesMapping, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Single(result);
+                Assert.Equal("db", result[0].Key);
+                Assert.NotNull(result[0].Value);
+                Assert.Equal("postgres:latest", result[0].Value.Image);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_EntrypointAndCommand_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var servicesMapping = new MappingToken(null, null, null);
+                var serviceMapping = new MappingToken(null, null, null);
+                serviceMapping.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, "postgres:latest"));
+                serviceMapping.Add(new StringToken(null, null, null, "entrypoint"), new StringToken(null, null, null, "/bin/bash"));
+                serviceMapping.Add(new StringToken(null, null, null, "command"), new StringToken(null, null, null, "-lc echo hi"));
+                servicesMapping.Add(new StringToken(null, null, null, "db"), serviceMapping);
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: true);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobServiceContainers(servicesMapping, contextData, functions);
+
+                Assert.NotNull(result);
+                Assert.Single(result);
+                Assert.Equal("db", result[0].Key);
+                Assert.NotNull(result[0].Value);
+                Assert.Equal("postgres:latest", result[0].Value.Image);
+                Assert.Equal("/bin/bash", result[0].Value.Entrypoint);
+                Assert.Equal("-lc echo hi", result[0].Value.Command);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobServiceContainers_EntrypointAndCommand_FlagOff_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var servicesMapping = new MappingToken(null, null, null);
+                var serviceMapping = new MappingToken(null, null, null);
+                serviceMapping.Add(new StringToken(null, null, null, "image"), new StringToken(null, null, null, "postgres:latest"));
+                serviceMapping.Add(new StringToken(null, null, null, "entrypoint"), new StringToken(null, null, null, "/bin/bash"));
+                serviceMapping.Add(new StringToken(null, null, null, "command"), new StringToken(null, null, null, "-lc echo hi"));
+                servicesMapping.Add(new StringToken(null, null, null, "db"), serviceMapping);
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                Assert.Throws<GitHub.DistributedTask.ObjectTemplating.TemplateValidationException>(() =>
+                    wrapper.EvaluateJobServiceContainers(servicesMapping, contextData, functions));
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateJobSnapshotRequest_Null_BothParsersAgree()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+                var contextData = new DictionaryContextData();
+                var functions = new List<LegacyExpressions.IFunctionInfo>();
+
+                var result = wrapper.EvaluateJobSnapshotRequest(null, contextData, functions);
+
+                Assert.Null(result);
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        // -------------------------------------------------------------------
+        // JSON parse error equivalence via EvaluateAndCompare
+        // -------------------------------------------------------------------
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_JsonReaderExceptions_TreatedAsEquivalent()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+
+                // Both throw JsonReaderException with different messages — should be treated as equivalent
+                var legacyEx = new Newtonsoft.Json.JsonReaderException("Error reading JToken from JsonReader. Path '', line 0, position 0.");
+                var newEx = new Newtonsoft.Json.JsonReaderException("Error parsing fromJson", new Newtonsoft.Json.JsonReaderException("Unexpected end"));
+
+                Assert.Throws<Newtonsoft.Json.JsonReaderException>(() =>
+                    wrapper.EvaluateAndCompare<string, string>(
+                        "TestJsonEquivalence",
+                        () => throw legacyEx,
+                        () => throw newEx,
+                        (a, b) => string.Equals(a, b, StringComparison.Ordinal)));
+
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_MixedJsonExceptionTypes_TreatedAsEquivalent()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+
+                // Legacy throws Newtonsoft JsonReaderException, new throws System.Text.Json.JsonException
+                var legacyEx = new Newtonsoft.Json.JsonReaderException("Error reading JToken");
+                var newEx = new System.Text.Json.JsonException("Error parsing fromJson");
+
+                Assert.Throws<Newtonsoft.Json.JsonReaderException>(() =>
+                    wrapper.EvaluateAndCompare<string, string>(
+                        "TestMixedJsonTypes",
+                        () => throw legacyEx,
+                        () => throw newEx,
+                        (a, b) => string.Equals(a, b, StringComparison.Ordinal)));
+
+                Assert.False(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EvaluateAndCompare_NonJsonExceptions_RecordsMismatch()
+        {
+            try
+            {
+                Setup();
+                _ec.Object.Global.Variables.Set(Constants.Runner.Features.CompareWorkflowParser, "true");
+
+                var wrapper = new PipelineTemplateEvaluatorWrapper(_hc, _ec.Object, allowServiceContainerCommand: false);
+
+                // Both throw non-JSON exceptions with different messages — should record mismatch
+                var legacyEx = new InvalidOperationException("some error");
+                var newEx = new InvalidOperationException("different error");
+
+                Assert.Throws<InvalidOperationException>(() =>
+                    wrapper.EvaluateAndCompare<string, string>(
+                        "TestNonJsonMismatch",
+                        () => throw legacyEx,
+                        () => throw newEx,
+                        (a, b) => string.Equals(a, b, StringComparison.Ordinal)));
+
+                Assert.True(_ec.Object.Global.HasTemplateEvaluatorMismatch);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
+        // -------------------------------------------------------------------
+        // Helpers
+        // -------------------------------------------------------------------
+
+        private void Setup([CallerMemberName] string name = "")
+        {
+            _ecTokenSource?.Dispose();
+            _ecTokenSource = new CancellationTokenSource();
+
+            _hc = new TestHostContext(this, name);
+
+            var expressionValues = new LegacyContextData.DictionaryContextData();
+            var expressionFunctions = new List<LegacyExpressions.IFunctionInfo>();
+
+            _ec = new Mock<IExecutionContext>();
+            _ec.Setup(x => x.Global)
+                .Returns(new GlobalContext
+                {
+                    FileTable = new List<String>(),
+                    Variables = new Variables(_hc, new Dictionary<string, VariableValue>()),
+                    WriteDebug = true,
+                });
+            _ec.Setup(x => x.CancellationToken).Returns(_ecTokenSource.Token);
+            _ec.Setup(x => x.ExpressionValues).Returns(expressionValues);
+            _ec.Setup(x => x.ExpressionFunctions).Returns(expressionFunctions);
+            _ec.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>())).Callback((string tag, string message) => { _hc.GetTrace().Info($"{tag}{message}"); });
+            _ec.Setup(x => x.AddIssue(It.IsAny<Issue>(), It.IsAny<ExecutionContextLogOptions>())).Callback((Issue issue, ExecutionContextLogOptions logOptions) => { _hc.GetTrace().Info($"[{issue.Type}]{logOptions.LogMessageOverride ?? issue.Message}"); });
+        }
+
+        private void Teardown()
+        {
+            _hc?.Dispose();
+        }
+    }
+}

src/Test/TestData/dockerfileaction_env_invalid_context.yml

@@ -0,0 +1,13 @@
+name: 'Action With Invalid Context'
+description: 'Docker action that uses github context in env (only inputs is allowed)'
+inputs:
+  my-input:
+    description: 'A test input'
+    required: false
+    default: 'hello'
+runs:
+  using: 'docker'
+  image: 'Dockerfile'
+  env:
+    VALID: '${{ inputs.my-input }}'
+    INVALID: '${{ github.event.repository.private }}'

src/dev.sh

@@ -17,7 +17,7 @@ LAYOUT_DIR="$SCRIPT_DIR/../_layout"
 DOWNLOAD_DIR="$SCRIPT_DIR/../_downloads/netcore2x"
 PACKAGE_DIR="$SCRIPT_DIR/../_package"
 DOTNETSDK_ROOT="$SCRIPT_DIR/../_dotnetsdk"
-DOTNETSDK_VERSION="8.0.415"
+DOTNETSDK_VERSION="8.0.418"
 DOTNETSDK_INSTALLDIR="$DOTNETSDK_ROOT/$DOTNETSDK_VERSION"
 RUNNER_VERSION=$(cat runnerversion)
 

src/global.json

@@ -1,5 +1,5 @@
 {
   "sdk": {
-    "version": "8.0.415"
+    "version": "8.0.418"
   }
 }

src/runnerversion

@@ -1 +1 @@
-2.329.0
+2.332.0