fix: update label from "dependency" to "dependencies" to be consistent with dependabot

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:1": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.412"
+      "version": "8.0.413"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

.github/workflows/docker-buildx-upgrade.yml

@@ -2,8 +2,8 @@ name: "Docker/Buildx Version Upgrade"
 
 on:
   schedule:
-    - cron: '0 0 * * 1'  # Run every Monday at midnight
-  workflow_dispatch:      # Allow manual triggering
+    - cron: "0 9 * * 1" # Weekly on Monday at 9 AM UTC (independent of other dependencies)
+  workflow_dispatch: # Allow manual triggering
 
 jobs:
   check-versions:
@@ -35,7 +35,7 @@ jobs:
             echo "Failed to retrieve a valid Docker version"
             exit 1
           fi
-          
+
           should_update=0
           [ "$current_version" != "$latest_version" ] && should_update=1
 
@@ -64,17 +64,17 @@ jobs:
         run: |
           docker_should_update="${{ steps.check_docker_version.outputs.SHOULD_UPDATE }}"
           buildx_should_update="${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}"
-          
+
           # Show annotation if only Docker needs update
           if [[ "$docker_should_update" == "1" && "$buildx_should_update" == "0" ]]; then
             echo "::warning ::Docker version (${{ steps.check_docker_version.outputs.LATEST_VERSION }}) needs update but Buildx is current. Only updating when both need updates."
           fi
-          
+
           # Show annotation if only Buildx needs update
           if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "1" ]]; then
             echo "::warning ::Buildx version (${{ steps.check_buildx_version.outputs.LATEST_VERSION }}) needs update but Docker is current. Only updating when both need updates."
           fi
-          
+
           # Show annotation when both are current
           if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "0" ]]; then
             echo "::warning ::Latest Docker version is ${{ steps.check_docker_version.outputs.LATEST_VERSION }} and Buildx version is ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}. No updates needed."
@@ -90,25 +90,25 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v5
-      
+
       - name: Update Docker version
         shell: bash
         run: |
           latest_version="${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}"
           current_version="${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }}"
-          
+
           # Update version in Dockerfile
           sed -i "s/ARG DOCKER_VERSION=$current_version/ARG DOCKER_VERSION=$latest_version/g" ./images/Dockerfile
-      
+
       - name: Update Buildx version
         shell: bash
         run: |
           latest_version="${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
           current_version="${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }}"
-          
+
           # Update version in Dockerfile
           sed -i "s/ARG BUILDX_VERSION=$current_version/ARG BUILDX_VERSION=$latest_version/g" ./images/Dockerfile
-      
+
       - name: Commit changes and create Pull Request
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -117,7 +117,7 @@ jobs:
           branch_name="feature/docker-buildx-upgrade"
           commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
           pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
-          
+
           # Configure git
           git config --global user.name "github-actions[bot]"
           git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
@@ -129,16 +129,35 @@ jobs:
           else
             git checkout -b "$branch_name"
           fi
-          
+
           # Commit and push changes
           git commit -a -m "$commit_message"
           git push --force origin "$branch_name"
+
+          # Create PR body using here-doc for proper formatting
+          cat > pr_body.txt << 'EOF'
+          Automated Docker and Buildx version update:
           
+          - Docker: ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}
+          - Buildx: ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}
+          
+          This update ensures we're using the latest stable Docker and Buildx versions for security and performance improvements.
+          
+          **Release notes:** https://docs.docker.com/engine/release-notes/
+          
+          **Next steps:**
+          - Review the version changes
+          - Verify container builds work as expected
+          - Test multi-platform builds if applicable
+          - Merge when ready
+          
+          ---
+          
+          Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)
+          EOF
+
           # Create PR
-          pr_body="Upgrades Docker version from ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} to ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Docker Buildx version from ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} to ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}.\n\n"
-          pr_body+="Release notes: https://docs.docker.com/engine/release-notes/\n\n"
-          pr_body+="---\n\nAutogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)"
-          
           gh pr create -B main -H "$branch_name" \
             --title "$pr_title" \
-            --body "$pr_body"
+            --label "dependencies" \
+            --body-file pr_body.txt

.github/workflows/dotnet-upgrade.yml

@@ -2,13 +2,13 @@ name: "DotNet SDK Upgrade"
 
 on:
   schedule:
-    - cron: '0 0 * * 1'
+    - cron: "0 8 * * 1" # Weekly on Monday at 8 AM UTC (independent of Node.js/NPM)
   workflow_dispatch:
 
 jobs:
   dotnet-update:
     runs-on: ubuntu-latest
-    outputs: 
+    outputs:
       SHOULD_UPDATE: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE }}
       BRANCH_EXISTS: ${{ steps.fetch_latest_version.outputs.BRANCH_EXISTS }}
       DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION: ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
@@ -37,7 +37,7 @@ jobs:
 
           # check if git branch already exists for the upgrade
           branch_already_exists=0
-          
+
           if git ls-remote --heads --exit-code origin refs/heads/feature/dotnetsdk-upgrade/${latest_patch_version};
           then 
             branch_already_exists=1
@@ -89,17 +89,17 @@ jobs:
     if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
-      with:
-        ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
-    - name: Create Pull Request
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --body "
-          https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
-          
+      - uses: actions/checkout@v5
+        with:
+          ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
+      - name: Create Pull Request
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --label "dependencies" --body "
+            https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
             
-          ---
-            
-          Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"
+              
+            ---
+              
+            Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"

.github/workflows/node-upgrade.yml

@@ -0,0 +1,126 @@
+name: Auto Update Node Version
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Weekly, every Monday
+  workflow_dispatch:
+
+jobs:
+  update-node:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Get latest Node versions
+        id: node-versions
+        run: |
+          # Get latest Node.js releases from official GitHub releases
+          echo "Fetching latest Node.js releases..."
+
+          # Get latest v20.x release
+          LATEST_NODE20=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
+            jq -r '.[] | select(.tag_name | startswith("v20.")) | .tag_name' | \
+            head -1 | sed 's/^v//')
+
+          # Get latest v24.x release  
+          LATEST_NODE24=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
+            jq -r '.[] | select(.tag_name | startswith("v24.")) | .tag_name' | \
+            head -1 | sed 's/^v//')
+
+          echo "Found Node.js releases: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
+
+          # Verify these versions are available in alpine_nodejs releases
+          echo "Verifying availability in alpine_nodejs..."
+          ALPINE_RELEASES=$(curl -s https://api.github.com/repos/actions/alpine_nodejs/releases | jq -r '.[].tag_name')
+
+          if ! echo "$ALPINE_RELEASES" | grep -q "^node20-$LATEST_NODE20$"; then
+            echo "::warning title=Node 20 Fallback::Node 20 version $LATEST_NODE20 not found in alpine_nodejs releases, using fallback"
+            # Fall back to latest available alpine_nodejs v20 release
+            LATEST_NODE20=$(echo "$ALPINE_RELEASES" | grep "^node20-" | head -1 | sed 's/^node20-//')
+            echo "Using latest available alpine_nodejs Node 20: $LATEST_NODE20"
+          fi
+
+          if ! echo "$ALPINE_RELEASES" | grep -q "^node24-$LATEST_NODE24$"; then
+            echo "::warning title=Node 24 Fallback::Node 24 version $LATEST_NODE24 not found in alpine_nodejs releases, using fallback"
+            # Fall back to latest available alpine_nodejs v24 release
+            LATEST_NODE24=$(echo "$ALPINE_RELEASES" | grep "^node24-" | head -1 | sed 's/^node24-//')
+            echo "Using latest available alpine_nodejs Node 24: $LATEST_NODE24"
+          fi
+
+          echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT
+          echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT
+
+          # Check current versions in externals.sh
+          CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+          CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
+
+          echo "current_node20=$CURRENT_NODE20" >> $GITHUB_OUTPUT
+          echo "current_node24=$CURRENT_NODE24" >> $GITHUB_OUTPUT
+
+          # Determine if updates are needed
+          NEEDS_UPDATE20="false"
+          NEEDS_UPDATE24="false"
+
+          if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
+            NEEDS_UPDATE20="true"
+            echo "::notice title=Node 20 Update Available::Current: $CURRENT_NODE20 → Latest: $LATEST_NODE20"
+          fi
+
+          if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
+            NEEDS_UPDATE24="true"
+            echo "::notice title=Node 24 Update Available::Current: $CURRENT_NODE24 → Latest: $LATEST_NODE24"
+          fi
+
+          if [ "$NEEDS_UPDATE20" == "false" ] && [ "$NEEDS_UPDATE24" == "false" ]; then
+            echo "::notice title=No Updates Needed::All Node.js versions are up to date"
+          fi
+
+          echo "needs_update20=$NEEDS_UPDATE20" >> $GITHUB_OUTPUT
+          echo "needs_update24=$NEEDS_UPDATE24" >> $GITHUB_OUTPUT
+
+      - name: Update externals.sh and create PR
+        if: steps.node-versions.outputs.needs_update20 == 'true' || steps.node-versions.outputs.needs_update24 == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Update the files
+          if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ]; then
+            sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"/' src/Misc/externals.sh
+          fi
+
+          if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ]; then
+            sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"/' src/Misc/externals.sh
+          fi
+
+          # Configure git
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
+          # Create branch and commit changes
+          branch_name="chore/update-node"
+          git checkout -b "$branch_name"
+          git commit -a -m "chore: update Node versions (20: ${{ steps.node-versions.outputs.latest_node20 }}, 24: ${{ steps.node-versions.outputs.latest_node24 }})"
+          git push --force origin "$branch_name"
+
+          # Create PR body using here-doc for proper formatting
+          cat > pr_body.txt << 'EOF'
+          Automated Node.js version update:
+
+          - Node 20: ${{ steps.node-versions.outputs.current_node20 }} → ${{ steps.node-versions.outputs.latest_node20 }}
+          - Node 24: ${{ steps.node-versions.outputs.current_node24 }} → ${{ steps.node-versions.outputs.latest_node24 }}
+
+          This update ensures we're using the latest stable Node.js versions for security and performance improvements.
+
+          **Note**: When updating Node versions, remember to also create a new release of alpine_nodejs at the updated version following the instructions at: https://github.com/actions/alpine_nodejs
+
+          ---
+
+          Autogenerated by [Node Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/node-upgrade.yml)
+          EOF
+
+          # Create PR
+          gh pr create -B main -H "$branch_name" \
+            --title "chore: update Node versions" \
+            --label "dependencies" \
+            --body-file pr_body.txt
+
+          echo "::notice title=PR Created::Successfully created Node.js version update PR on branch $branch_name"

.github/workflows/npm-audit-typescript.yml

@@ -0,0 +1,235 @@
+name: NPM Audit Fix with TypeScript Auto-Fix
+
+on:
+  workflow_dispatch:
+
+jobs:
+  npm-audit-with-ts-fix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: NPM install and audit fix with TypeScript auto-repair
+        working-directory: src/Misc/expressionFunc/hashFiles
+        run: |
+          npm install
+
+          # Check for vulnerabilities first
+          echo "Checking for npm vulnerabilities..."
+          if npm audit --audit-level=moderate; then
+            echo "✅ No moderate or higher vulnerabilities found"
+            exit 0
+          fi
+
+          echo "⚠️ Vulnerabilities found, attempting npm audit fix..."
+
+          # Attempt audit fix and capture the result
+          if npm audit fix; then
+            echo "✅ npm audit fix completed successfully"
+            AUDIT_FIX_STATUS="success"
+          else
+            echo "⚠️ npm audit fix failed or had issues"
+            AUDIT_FIX_STATUS="failed"
+            
+            # Try audit fix with --force as a last resort for critical/high vulns only
+            echo "Checking if critical/high vulnerabilities remain..."
+            if ! npm audit --audit-level=high; then
+              echo "🚨 Critical/high vulnerabilities remain, attempting --force fix..."
+              if npm audit fix --force; then
+                echo "⚠️ npm audit fix --force completed (may have breaking changes)"
+                AUDIT_FIX_STATUS="force-fixed"
+              else
+                echo "❌ npm audit fix --force also failed"
+                AUDIT_FIX_STATUS="force-failed"
+              fi
+            else
+              echo "✅ Only moderate/low vulnerabilities remain after failed fix"
+              AUDIT_FIX_STATUS="partial-success"
+            fi
+          fi
+
+          echo "AUDIT_FIX_STATUS=$AUDIT_FIX_STATUS" >> $GITHUB_ENV
+
+          # Try to fix TypeScript issues automatically
+          echo "Attempting to fix TypeScript compatibility issues..."
+
+          # Check if build fails
+          if ! npm run build 2>/dev/null; then
+            echo "Build failed, attempting automated fixes..."
+            
+            # Common fix 1: Update @types/node to latest compatible version
+            echo "Trying to update @types/node to latest version..."
+            npm update @types/node
+            
+            # Common fix 2: If that doesn't work, try installing a specific known-good version
+            if ! npm run build 2>/dev/null; then
+              echo "Trying specific @types/node version..."
+              # Try Node 20 compatible version
+              npm install --save-dev @types/node@^20.0.0
+            fi
+            
+            # Common fix 3: Clear node_modules and reinstall if still failing
+            if ! npm run build 2>/dev/null; then
+              echo "Clearing node_modules and reinstalling..."
+              rm -rf node_modules package-lock.json
+              npm install
+              
+              # Re-run audit fix after clean install if it was successful before
+              if [[ "$AUDIT_FIX_STATUS" == "success" || "$AUDIT_FIX_STATUS" == "force-fixed" ]]; then
+                echo "Re-running npm audit fix after clean install..."
+                npm audit fix || echo "Audit fix failed on second attempt"
+              fi
+            fi
+            
+            # Common fix 4: Try updating TypeScript itself
+            if ! npm run build 2>/dev/null; then
+              echo "Trying to update TypeScript..."
+              npm update typescript
+            fi
+            
+            # Final check
+            if npm run build 2>/dev/null; then
+              echo "✅ Successfully fixed TypeScript issues automatically"
+            else
+              echo "⚠️ Could not automatically fix TypeScript issues"
+            fi
+          else
+            echo "✅ Build passes after audit fix"
+          fi
+
+      - name: Create PR if changes exist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HUSKY: 0 # Disable husky hooks for automated commits
+        run: |
+          # Check if there are any changes
+          if [ -n "$(git status --porcelain)" ]; then
+            # Configure git
+            git config --global user.name "github-actions[bot]"
+            git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
+
+            # Create branch and commit changes
+            branch_name="chore/npm-audit-fix-with-ts-repair"
+            git checkout -b "$branch_name"
+            
+            # Commit with --no-verify to skip husky hooks
+            git commit -a -m "chore: npm audit fix with automated TypeScript compatibility fixes" --no-verify
+            git push --force origin "$branch_name"
+            
+            # Check final build status and gather info about what was changed
+            build_status="✅ Build passes"
+            fixes_applied=""
+            cd src/Misc/expressionFunc/hashFiles
+            
+            # Check what packages were updated
+            if git diff HEAD~1 package.json | grep -q "@types/node"; then
+              fixes_applied+="\n- Updated @types/node version for TypeScript compatibility"
+            fi
+            if git diff HEAD~1 package.json | grep -q "typescript"; then
+              fixes_applied+="\n- Updated TypeScript version"
+            fi
+            if git diff HEAD~1 package-lock.json | grep -q "resolved"; then
+              fixes_applied+="\n- Updated package dependencies via npm audit fix"
+            fi
+            
+            if ! npm run build 2>/dev/null; then
+              build_status="⚠️ Build fails - manual review required"
+            fi
+            cd - > /dev/null
+            
+            # Create enhanced PR body using here-doc for proper formatting
+            audit_status_msg=""
+            case "$AUDIT_FIX_STATUS" in
+              "success")
+                audit_status_msg="✅ **Audit Fix**: Completed successfully"
+                ;;
+              "partial-success")
+                audit_status_msg="⚠️ **Audit Fix**: Partial success (only moderate/low vulnerabilities remain)"
+                ;;
+              "force-fixed")
+                audit_status_msg="⚠️ **Audit Fix**: Completed with --force (may have breaking changes)"
+                ;;
+              "failed"|"force-failed")
+                audit_status_msg="❌ **Audit Fix**: Failed to resolve vulnerabilities"
+                ;;
+              *)
+                audit_status_msg="❓ **Audit Fix**: Status unknown"
+                ;;
+            esac
+            
+            if [[ "$build_status" == *"fails"* ]]; then
+              cat > pr_body.txt << EOF
+          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
+
+          **Build Status**: ⚠️ Build fails - manual review required
+          $audit_status_msg
+
+          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
+
+          ⚠️ **Manual Review Required**: The build is currently failing after automated fixes were attempted.
+
+          Common issues and solutions:
+          - Check for TypeScript version compatibility with Node.js types
+          - Review breaking changes in updated dependencies
+          - Consider pinning problematic dependency versions temporarily
+          - Review tsconfig.json for compatibility settings
+
+          **Automated Fix Strategy**:
+          1. Run npm audit fix with proper error handling
+          2. Update @types/node to latest compatible version
+          3. Try Node 20 specific @types/node version if needed
+          4. Clean reinstall dependencies if conflicts persist
+          5. Update TypeScript compiler if necessary
+
+          ---
+
+          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
+          EOF
+            else
+              cat > pr_body.txt << EOF
+          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
+
+          **Build Status**: ✅ Build passes
+          $audit_status_msg
+
+          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
+
+          ✅ **Ready to Merge**: All automated fixes were successful and the build passes.
+
+          **Automated Fix Strategy**:
+          1. Run npm audit fix with proper error handling
+          2. Update @types/node to latest compatible version
+          3. Try Node 20 specific @types/node version if needed
+          4. Clean reinstall dependencies if conflicts persist
+          5. Update TypeScript compiler if necessary
+
+          ---
+
+          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
+          EOF
+            fi
+            
+            if [ -n "$fixes_applied" ]; then
+              # Add the fixes applied section to the file
+              sed -i "/This workflow attempts/a\\
+          \\
+          **Automated Fixes Applied**:$fixes_applied" pr_body.txt
+            fi
+            
+            # Create PR with appropriate labels
+            labels="dependency,typescript"
+            if [[ "$build_status" == *"fails"* ]]; then
+              labels="dependency,typescript,needs-manual-review"
+            fi
+            
+            # Create PR
+            gh pr create -B main -H "$branch_name" \
+              --title "chore: npm audit fix with TypeScript auto-repair" \
+              --label "$labels" \
+              --body-file pr_body.txt
+          else
+            echo "No changes to commit"
+          fi

.github/workflows/npm-audit.yml

@@ -0,0 +1,132 @@
+name: NPM Audit Fix
+
+on:
+  schedule:
+    - cron: "0 7 * * 1" # Weekly on Monday at 7 AM UTC
+  workflow_dispatch:
+
+jobs:
+  npm-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          
+      - name: NPM install and audit fix
+        working-directory: src/Misc/expressionFunc/hashFiles
+        run: |
+          npm install
+          
+          # Check what vulnerabilities exist
+          echo "=== Checking current vulnerabilities ==="
+          npm audit || true
+          
+          # Apply audit fix --force to get security updates
+          echo "=== Applying npm audit fix --force ==="
+          npm audit fix --force
+          
+          # Test if build still works and set status
+          echo "=== Testing build compatibility ==="
+          if npm run all; then
+            echo "✅ Build successful after audit fix"
+            echo "AUDIT_FIX_STATUS=success" >> $GITHUB_ENV
+          else
+            echo "❌ Build failed after audit fix - will create PR with fix instructions"
+            echo "AUDIT_FIX_STATUS=build_failed" >> $GITHUB_ENV
+          fi
+          
+      - name: Create PR if changes exist
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          # Check if there are any changes
+          if [ -n "$(git status --porcelain)" ]; then
+            # Configure git
+            git config --global user.name "github-actions[bot]"
+            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+            
+            # Create branch and commit changes
+            branch_name="chore/npm-audit-fix-$(date +%Y%m%d)"
+            git checkout -b "$branch_name"
+            git add .
+            git commit -m "chore: npm audit fix for hashFiles dependencies" --no-verify
+            git push origin "$branch_name"
+            
+            # Create PR body based on what actually happened
+            if [ "$AUDIT_FIX_STATUS" = "success" ]; then
+              cat > pr_body.txt << 'EOF'
+          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
+          
+          **✅ Full Fix Applied Successfully**
+          This update addresses npm security advisories and ensures dependencies are secure and up-to-date.
+          
+          **Changes made:**
+          - Applied `npm audit fix --force` to resolve security vulnerabilities
+          - Updated package-lock.json with security patches
+          - Verified build compatibility with `npm run all`
+          
+          **Next steps:**
+          - Review the dependency changes  
+          - Verify the hashFiles functionality still works as expected
+          - Merge when ready
+          
+          ---
+          
+          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
+          EOF
+            elif [ "$AUDIT_FIX_STATUS" = "build_failed" ]; then
+              cat > pr_body.txt << 'EOF'
+          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
+          
+          **⚠️ Security Fixes Applied - Build Issues Need Manual Resolution**
+          This update applies important security patches but causes build failures that require manual fixes.
+          
+          **Changes made:**
+          - Applied `npm audit fix --force` to resolve security vulnerabilities
+          - Updated package-lock.json with security patches
+          
+          **⚠️ Build Issues Detected:**
+          The build fails after applying security fixes, likely due to TypeScript compatibility issues with updated `@types/node`.
+          
+          **Required Manual Fixes:**
+          1. Review TypeScript compilation errors in the build output
+          2. Update TypeScript configuration if needed
+          3. Consider pinning `@types/node` to a compatible version
+          4. Run `npm run all` locally to verify fixes
+          
+          **Next steps:**
+          - **DO NOT merge until build issues are resolved**
+          - Apply manual fixes for TypeScript compatibility
+          - Test the hashFiles functionality still works as expected
+          - Merge when build passes
+          
+          ---
+          
+          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
+          EOF
+            else
+              # Fallback case
+              cat > pr_body.txt << 'EOF'
+          Automated npm audit attempted for security vulnerabilities in hashFiles dependencies.
+          
+          **ℹ️ No Changes Applied**
+          No security vulnerabilities were found or no changes were needed.
+          
+          ---
+          
+          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
+          EOF
+            fi
+            
+            # Create PR
+            gh pr create -B main -H "$branch_name" \
+              --title "chore: npm audit fix for hashFiles dependencies" \
+              --label "dependencies" \
+              --body-file pr_body.txt
+          else
+            echo "✅ No changes to commit - npm audit fix did not modify any files"
+          fi

.github/workflows/release.yml

@@ -338,7 +338,7 @@ jobs:
             org.opencontainers.image.licenses=MIT
 
       - name: Generate attestation
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v3
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}

.husky/pre-commit

@@ -1,6 +1 @@
-#!/usr/bin/env sh
-. "$(dirname -- "$0")/_/husky.sh"
-
-cd src/Misc/expressionFunc/hashFiles
-
-npx lint-staged
+cd src/Misc/expressionFunc/hashFiles && npx lint-staged

README.md

@@ -8,16 +8,6 @@
 
 The runner is the application that runs a job from a GitHub Actions workflow. It is used by GitHub Actions in the [hosted virtual environments](https://github.com/actions/virtual-environments), or you can [self-host the runner](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/about-self-hosted-runners) in your own environment.
 
-## Understanding How Actions Work
-
-**New to GitHub Actions development?** The runner (this repository) is compiled C# code that executes actions. Actions themselves typically do NOT require compilation:
-
-- **JavaScript Actions** run source `.js` files directly
-- **Container Actions** use Docker images (pre-built or built from Dockerfile)  
-- **Composite Actions** are YAML step definitions
-
-📖 See [docs/action-execution-model.md](docs/action-execution-model.md) for detailed information and [examples](docs/examples/action-execution-examples.md).
-
 ## Get Started
 
 For more information about installing and using self-hosted runners, see [Adding self-hosted runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/adding-self-hosted-runners) and [Using self-hosted runners in a workflow](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/using-self-hosted-runners-in-a-workflow)

docs/action-execution-model.md

@@ -1,144 +0,0 @@
-# GitHub Actions Execution Model
-
-## Question: Do Actions Need to be Compiled?
-
-**Short Answer**: No, GitHub Actions themselves do **NOT** need to be compiled from source code. They run directly as interpreted code, container images, or step definitions.
-
-## How Different Action Types Are Executed
-
-### 1. JavaScript Actions (`using: node12/16/20/24`)
-
-JavaScript actions execute source code directly without compilation:
-
-```yaml
-# action.yml
-runs:
-  using: 'node20'
-  main: 'index.js'
-```
-
-**Execution Process**:
-1. Runner downloads the action repository
-2. Locates the `main` JavaScript file (e.g., `index.js`)
-3. Executes it directly using Node.js runtime: `node index.js`
-4. No compilation or build step required
-
-**Code Reference**: `src/Runner.Worker/Handlers/NodeScriptActionHandler.cs`
-- Resolves the target script file
-- Executes using Node.js: `StepHost.ExecuteAsync()` with node executable
-
-### 2. Container Actions (`using: docker`)
-
-Container actions run pre-built images or build from Dockerfile:
-
-```yaml
-# action.yml - Pre-built image
-runs:
-  using: 'docker'
-  image: 'docker://alpine:3.10'
-```
-
-```yaml
-# action.yml - Build from Dockerfile
-runs:
-  using: 'docker'
-  image: 'Dockerfile'
-```
-
-**Execution Process**:
-1. If using pre-built image: Pull and run the container
-2. If using Dockerfile: Build the container image, then run it
-3. No compilation of action source code - Docker handles image building
-
-**Code Reference**: `src/Runner.Worker/Handlers/ContainerActionHandler.cs`
-- Handles both pre-built images and Dockerfile builds
-- Uses Docker commands to run containers
-
-### 3. Composite Actions (`using: composite`)
-
-Composite actions are collections of steps defined in YAML:
-
-```yaml
-# action.yml
-runs:
-  using: 'composite'
-  steps:
-    - run: echo "Hello"
-      shell: bash
-    - uses: actions/checkout@v3
-```
-
-**Execution Process**:
-1. Parse the YAML step definitions
-2. Execute each step in sequence
-3. No compilation - just step orchestration
-
-**Code Reference**: `src/Runner.Worker/Handlers/CompositeActionHandler.cs`
-- Iterates through defined steps
-- Executes each step using appropriate handlers
-
-## What Does Get Compiled?
-
-### The GitHub Actions Runner (This Repository)
-
-The runner itself is compiled from C# source code:
-
-```bash
-cd src
-./dev.sh build  # Compiles the runner binaries
-```
-
-**What gets compiled**:
-- `Runner.Listener` - Registers with GitHub and receives jobs
-- `Runner.Worker` - Executes individual jobs and steps
-- `Runner.PluginHost` - Handles plugin execution
-- Supporting libraries
-
-**Build Output**: Compiled binaries in `_layout/bin/`
-
-## Key Distinctions
-
-| Component | Compilation Required | Execution Method |
-|-----------|---------------------|------------------|
-| **Runner** (this repo) | ✅ Yes - C# → binaries | Compiled executable |
-| **JavaScript Actions** | ❌ No | Direct interpretation |
-| **Container Actions** | ❌ No* | Container runtime |
-| **Composite Actions** | ❌ No | YAML interpretation |
-
-*Container actions may involve building Docker images, but not compiling action source code.
-
-## Implementation Details
-
-### Action Loading Process
-
-1. **Action Discovery** (`ActionManager.LoadAction()`)
-   - Parses `action.yml` manifest
-   - Determines action type from `using` field
-   - Creates appropriate execution data object
-
-2. **Handler Selection** (`HandlerFactory.Create()`)
-   - Routes to appropriate handler based on action type
-   - `NodeScriptActionHandler` for JavaScript
-   - `ContainerActionHandler` for Docker
-   - `CompositeActionHandler` for composite
-
-3. **Execution** (Handler-specific `RunAsync()`)
-   - Each handler implements execution logic
-   - No compilation step - direct execution
-
-### Source Code References
-
-- **Action Type Detection**: `src/Runner.Worker/ActionManifestManager.cs:428-495`
-- **Handler Factory**: `src/Runner.Worker/Handlers/HandlerFactory.cs`
-- **JavaScript Execution**: `src/Runner.Worker/Handlers/NodeScriptActionHandler.cs:143-153`
-- **Container Execution**: `src/Runner.Worker/Handlers/ContainerActionHandler.cs:247-261`
-
-## Conclusion
-
-GitHub Actions are designed for **runtime interpretation**, not compilation:
-
-- **JavaScript actions** run source `.js` files directly
-- **Container actions** use existing images or build from Dockerfile
-- **Composite actions** are YAML step definitions
-
-The only compilation involved is building the **runner infrastructure** (this repository) that interprets and executes the actions.

docs/contribute.md

@@ -4,14 +4,6 @@ We welcome contributions in the form of issues and pull requests. We view the co
 
 > IMPORTANT: Building your own runner is critical for the dev inner loop process when contributing changes.  However, only runners built and distributed by GitHub (releases) are supported in production.  Be aware that workflows and orchestrations run service side with the runner being a remote process to run steps.  For that reason, the service can pull the runner forward so customizations can be lost.
 
-## Understanding Actions vs Runner
-
-**New to GitHub Actions development?** See [Action Execution Model](action-execution-model.md) to understand the difference between:
-- **Actions** (JavaScript, containers, composite) - Run without compilation
-- **Runner** (this repository) - Compiled C# application that executes actions
-
-For examples of how different action types work, see [Action Execution Examples](examples/action-execution-examples.md).
-
 ## Issues
 
 Log issues for both bugs and enhancement requests.  Logging issues are important for the open community.

docs/examples/action-execution-examples.md

@@ -1,117 +0,0 @@
-# Action Execution Examples
-
-This directory contains examples demonstrating how different types of GitHub Actions are executed without compilation.
-
-## JavaScript Action Example
-
-A simple JavaScript action that runs source code directly:
-
-### action.yml
-```yaml
-name: 'JavaScript Example'
-description: 'Demonstrates direct JavaScript execution'
-runs:
-  using: 'node20'
-  main: 'index.js'
-```
-
-### index.js
-```javascript
-// This file runs directly - no compilation needed
-console.log('Hello from JavaScript action!');
-console.log('Process args:', process.argv);
-console.log('Environment:', process.env.INPUT_MESSAGE || 'No input provided');
-```
-
-**Execution**: The runner directly executes `node index.js` - no build step.
-
-## Container Action Example
-
-### action.yml (Pre-built image)
-```yaml
-name: 'Container Example'
-description: 'Demonstrates container execution'
-runs:
-  using: 'docker'
-  image: 'docker://alpine:latest'
-  entrypoint: '/bin/sh'
-  args:
-    - '-c'
-    - 'echo "Hello from container!" && env | grep INPUT_'
-```
-
-### action.yml (Build from source)
-```yaml
-name: 'Container Build Example'
-description: 'Demonstrates building from Dockerfile'
-runs:
-  using: 'docker'
-  image: 'Dockerfile'
-  args:
-    - 'Hello from built container!'
-```
-
-### Dockerfile
-```dockerfile
-FROM alpine:latest
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]
-```
-
-### entrypoint.sh
-```bash
-#!/bin/sh
-echo "Container built and running: $1"
-echo "Environment variables:"
-env | grep INPUT_ || echo "No INPUT_ variables found"
-```
-
-**Execution**: Docker builds the image (if needed) and runs the container - action source isn't compiled.
-
-## Composite Action Example
-
-### action.yml
-```yaml
-name: 'Composite Example'
-description: 'Demonstrates composite action execution'
-runs:
-  using: 'composite'
-  steps:
-    - name: Run shell command
-      run: echo "Step 1: Hello from composite action!"
-      shell: bash
-    
-    - name: Use another action
-      uses: actions/checkout@v4
-      with:
-        path: 'checked-out-code'
-    
-    - name: Run another shell command
-      run: |
-        echo "Step 3: Files in workspace:"
-        ls -la
-      shell: bash
-```
-
-**Execution**: The runner interprets the YAML and executes each step - no compilation.
-
-## Comparison with Runner Compilation
-
-The **runner itself** (this repository) must be compiled:
-
-```bash
-# This compiles the runner from C# source code
-cd src
-./dev.sh build
-
-# The compiled runner then executes actions WITHOUT compiling them
-./_layout/bin/Runner.Worker
-```
-
-## Key Takeaway
-
-- **Actions** = Interpreted at runtime (JavaScript, containers, YAML)
-- **Runner** = Compiled from source (C# → binaries)
-
-The runner compiles once and then executes many different actions without compiling them.

images/Dockerfile

@@ -5,8 +5,8 @@ ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=28.3.2
-ARG BUILDX_VERSION=0.26.1
+ARG DOCKER_VERSION=28.4.0
+ARG BUILDX_VERSION=0.28.0
 
 RUN apt update -y && apt install curl unzip -y
 

src/Misc/expressionFunc/hashFiles/package.json

@@ -10,7 +10,7 @@
     "lint": "eslint src/**/*.ts",
     "pack": "ncc build -o ../../layoutbin/hashFiles",
     "all": "npm run format && npm run lint && npm run build && npm run pack",
-    "prepare": "cd ../../../../ && husky install"
+    "prepare": "cd ../../../../ && husky"
   },
   "repository": {
     "type": "git",
@@ -36,15 +36,15 @@
   },
   "devDependencies": {
     "@types/node": "^20.6.2",
-    "@typescript-eslint/eslint-plugin": "^6.7.2",
+    "@typescript-eslint/eslint-plugin": "^6.21.0",
     "@typescript-eslint/parser": "^6.7.2",
-    "@vercel/ncc": "^0.38.0",
+    "@vercel/ncc": "^0.38.3",
     "eslint": "^8.47.0",
-    "eslint-plugin-github": "^4.10.0",
+    "eslint-plugin-github": "^4.10.2",
     "eslint-plugin-prettier": "^5.0.0",
-    "husky": "^8.0.3",
+    "husky": "^9.1.7",
     "lint-staged": "^15.5.0",
     "prettier": "^3.0.3",
-    "typescript": "^5.2.2"
+    "typescript": "^5.9.2"
   }
 }

src/Misc/externals.sh

@@ -6,8 +6,8 @@ NODE_URL=https://nodejs.org/dist
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.4"
-NODE24_VERSION="24.5.0"
+NODE20_VERSION="20.19.5"
+NODE24_VERSION="24.7.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args

src/Misc/layoutroot/safe_sleep.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
 SECONDS=0
-while [[ $SECONDS != $1 ]]; do
+while [[ $SECONDS -lt $1 ]]; do
     :
 done

src/Runner.Common/BrokerServer.cs

@@ -23,6 +23,8 @@ namespace GitHub.Runner.Common
 
         Task<TaskAgentMessage> GetRunnerMessageAsync(Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, bool disableUpdate, CancellationToken token);
 
+        Task AcknowledgeRunnerRequestAsync(string runnerRequestId, Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, CancellationToken token);
+
         Task UpdateConnectionIfNeeded(Uri serverUri, VssCredentials credentials);
 
         Task ForceRefreshConnection(VssCredentials credentials);
@@ -67,10 +69,17 @@ namespace GitHub.Runner.Common
             var brokerSession = RetryRequest<TaskAgentMessage>(
                 async () => await _brokerHttpClient.GetRunnerMessageAsync(sessionId, version, status, os, architecture, disableUpdate, cancellationToken), cancellationToken, shouldRetry: ShouldRetryException);
 
-
             return brokerSession;
         }
 
+        public async Task AcknowledgeRunnerRequestAsync(string runnerRequestId, Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, CancellationToken cancellationToken)
+        {
+            CheckConnection();
+
+            // No retries
+            await _brokerHttpClient.AcknowledgeRunnerRequestAsync(runnerRequestId, sessionId, version, status, os, architecture, cancellationToken);
+        }
+
         public async Task DeleteSessionAsync(CancellationToken cancellationToken)
         {
             CheckConnection();

src/Runner.Common/ConfigurationStore.cs

@@ -53,6 +53,9 @@ namespace GitHub.Runner.Common
         [DataMember(EmitDefaultValue = false)]
         public bool UseV2Flow { get; set; }
 
+        [DataMember(EmitDefaultValue = false)]
+        public bool UseRunnerAdminFlow { get; set; }
+
         [DataMember(EmitDefaultValue = false)]
         public string ServerUrlV2 { get; set; }
 

src/Runner.Common/Constants.cs

@@ -169,6 +169,7 @@ namespace GitHub.Runner.Common
                 public static readonly string AllowRunnerContainerHooks = "DistributedTask.AllowRunnerContainerHooks";
                 public static readonly string AddCheckRunIdToJobContext = "actions_add_check_run_id_to_job_context";
                 public static readonly string DisplayHelpfulActionsDownloadErrors = "actions_display_helpful_actions_download_errors";
+                public static readonly string ContainerActionRunnerTemp = "actions_container_action_runner_temp";
             }
             
             // Node version migration related constants

src/Runner.Common/RunnerService.cs

@@ -70,7 +70,7 @@ namespace GitHub.Runner.Common
 
         protected async Task RetryRequest(Func<Task> func,
             CancellationToken cancellationToken,
-            int maxRetryAttemptsCount = 5,
+            int maxAttempts = 5,
             Func<Exception, bool> shouldRetry = null
         )
         {
@@ -79,31 +79,31 @@ namespace GitHub.Runner.Common
                 await func();
                 return Unit.Value;
             }
-            await RetryRequest<Unit>(wrappedFunc, cancellationToken, maxRetryAttemptsCount, shouldRetry);
+            await RetryRequest<Unit>(wrappedFunc, cancellationToken, maxAttempts, shouldRetry);
         }
 
         protected async Task<T> RetryRequest<T>(Func<Task<T>> func,
             CancellationToken cancellationToken,
-            int maxRetryAttemptsCount = 5,
+            int maxAttempts = 5,
             Func<Exception, bool> shouldRetry = null
         )
         {
-            var retryCount = 0;
+            var attempt = 0;
             while (true)
             {
-                retryCount++;
+                attempt++;
                 cancellationToken.ThrowIfCancellationRequested();
                 try
                 {
                     return await func();
                 }
                 // TODO: Add handling of non-retriable exceptions: https://github.com/github/actions-broker/issues/122
-                catch (Exception ex) when (retryCount < maxRetryAttemptsCount && (shouldRetry == null || shouldRetry(ex)))
+                catch (Exception ex) when (attempt < maxAttempts && (shouldRetry == null || shouldRetry(ex)))
                 {
                     Trace.Error("Catch exception during request");
                     Trace.Error(ex);
                     var backOff = BackoffTimerHelper.GetRandomBackoff(TimeSpan.FromSeconds(5), TimeSpan.FromSeconds(15));
-                    Trace.Warning($"Back off {backOff.TotalSeconds} seconds before next retry. {maxRetryAttemptsCount - retryCount} attempt left.");
+                    Trace.Warning($"Back off {backOff.TotalSeconds} seconds before next retry. {maxAttempts - attempt} attempt left.");
                     await Task.Delay(backOff, cancellationToken);
                 }
             }

src/Runner.Listener/BrokerMessageListener.cs

@@ -23,7 +23,7 @@ namespace GitHub.Runner.Listener
         private RunnerSettings _settings;
         private ITerminal _term;
         private TimeSpan _getNextMessageRetryInterval;
-        private TaskAgentStatus runnerStatus = TaskAgentStatus.Online;
+        private TaskAgentStatus _runnerStatus = TaskAgentStatus.Online;
         private CancellationTokenSource _getMessagesTokenSource;
         private VssCredentials _creds;
         private VssCredentials _credsV2;
@@ -258,7 +258,7 @@ namespace GitHub.Runner.Listener
         public void OnJobStatus(object sender, JobStatusEventArgs e)
         {
             Trace.Info("Received job status event. JobState: {0}", e.Status);
-            runnerStatus = e.Status;
+            _runnerStatus = e.Status;
             try
             {
                 _getMessagesTokenSource?.Cancel();
@@ -291,7 +291,7 @@ namespace GitHub.Runner.Listener
                     }
 
                     message = await _brokerServer.GetRunnerMessageAsync(_session.SessionId,
-                                                                        runnerStatus,
+                                                                        _runnerStatus,
                                                                         BuildConstants.RunnerPackage.Version,
                                                                         VarUtil.OS,
                                                                         VarUtil.OSArchitecture,
@@ -417,6 +417,21 @@ namespace GitHub.Runner.Listener
             await Task.CompletedTask;
         }
 
+        public async Task AcknowledgeMessageAsync(string runnerRequestId, CancellationToken cancellationToken)
+        {
+            using var timeoutCts = new CancellationTokenSource(TimeSpan.FromSeconds(5)); // Short timeout
+            using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, timeoutCts.Token);
+            Trace.Info($"Acknowledging runner request '{runnerRequestId}'.");
+            await _brokerServer.AcknowledgeRunnerRequestAsync(
+                runnerRequestId,
+                _session.SessionId,
+                _runnerStatus,
+                BuildConstants.RunnerPackage.Version,
+                VarUtil.OS,
+                VarUtil.OSArchitecture,
+                linkedCts.Token);
+        }
+
         private bool IsGetNextMessageExceptionRetriable(Exception ex)
         {
             if (ex is TaskAgentNotFoundException ||

src/Runner.Listener/Configuration/ConfigurationManager.cs

@@ -153,8 +153,8 @@ namespace GitHub.Runner.Listener.Configuration
                     registerToken = await GetRunnerTokenAsync(command, inputUrl, "registration");
                     GitHubAuthResult authResult = await GetTenantCredential(inputUrl, registerToken, Constants.RunnerEvent.Register);
                     runnerSettings.ServerUrl = authResult.TenantUrl;
-                    runnerSettings.UseV2Flow = authResult.UseV2Flow;
-                    Trace.Info($"Using V2 flow: {runnerSettings.UseV2Flow}");
+                    runnerSettings.UseRunnerAdminFlow = authResult.UseRunnerAdminFlow;
+                    Trace.Info($"Using runner-admin flow: {runnerSettings.UseRunnerAdminFlow}");
                     creds = authResult.ToVssCredentials();
                     Trace.Info("cred retrieved via GitHub auth");
                 }
@@ -211,7 +211,7 @@ namespace GitHub.Runner.Listener.Configuration
             string poolName = null;
             TaskAgentPool agentPool = null;
             List<TaskAgentPool> agentPools;
-            if (runnerSettings.UseV2Flow)
+            if (runnerSettings.UseRunnerAdminFlow)
             {
                 agentPools = await _dotcomServer.GetRunnerGroupsAsync(runnerSettings.GitHubUrl, registerToken);
             }
@@ -259,7 +259,7 @@ namespace GitHub.Runner.Listener.Configuration
                 var userLabels = command.GetLabels();
                 _term.WriteLine();
                 List<TaskAgent> agents;
-                if (runnerSettings.UseV2Flow)
+                if (runnerSettings.UseRunnerAdminFlow)
                 {
                     agents = await _dotcomServer.GetRunnerByNameAsync(runnerSettings.GitHubUrl, registerToken, runnerSettings.AgentName);
                 }
@@ -280,7 +280,7 @@ namespace GitHub.Runner.Listener.Configuration
 
                         try
                         {
-                            if (runnerSettings.UseV2Flow)
+                            if (runnerSettings.UseRunnerAdminFlow)
                             {
                                 var runner = await _dotcomServer.ReplaceRunnerAsync(runnerSettings.PoolId, agent, runnerSettings.GitHubUrl, registerToken, publicKeyXML);
                                 runnerSettings.ServerUrlV2 = runner.RunnerAuthorization.ServerUrl;
@@ -330,7 +330,7 @@ namespace GitHub.Runner.Listener.Configuration
 
                     try
                     {
-                        if (runnerSettings.UseV2Flow)
+                        if (runnerSettings.UseRunnerAdminFlow)
                         {
                             var runner = await _dotcomServer.AddRunnerAsync(runnerSettings.PoolId, agent, runnerSettings.GitHubUrl, registerToken, publicKeyXML);
                             runnerSettings.ServerUrlV2 = runner.RunnerAuthorization.ServerUrl;
@@ -400,13 +400,26 @@ namespace GitHub.Runner.Listener.Configuration
             }
             else
             {
-
                 throw new NotSupportedException("Message queue listen OAuth token.");
             }
 
+            // allow the server to override the serverUrlV2 and useV2Flow
+            if (agent.Properties.TryGetValue("ServerUrlV2", out string serverUrlV2) &&
+                !string.IsNullOrEmpty(serverUrlV2))
+            {
+                Trace.Info($"Service enforced serverUrlV2: {serverUrlV2}");
+                runnerSettings.ServerUrlV2 = serverUrlV2;
+            }
+
+            if (agent.Properties.TryGetValue("UseV2Flow", out bool useV2Flow) && useV2Flow)
+            {
+                Trace.Info($"Service enforced useV2Flow: {useV2Flow}");
+                runnerSettings.UseV2Flow = useV2Flow;
+            }
+
             // Testing agent connection, detect any potential connection issue, like local clock skew that cause OAuth token expired.
 
-            if (!runnerSettings.UseV2Flow)
+            if (!runnerSettings.UseV2Flow && !runnerSettings.UseRunnerAdminFlow)
             {
                 var credMgr = HostContext.GetService<ICredentialManager>();
                 VssCredentials credential = credMgr.LoadCredentials(allowAuthUrlV2: false);
@@ -429,20 +442,6 @@ namespace GitHub.Runner.Listener.Configuration
                 }
             }
 
-            // allow the server to override the serverUrlV2 and useV2Flow
-            if (agent.Properties.TryGetValue("ServerUrlV2", out string serverUrlV2) &&
-                !string.IsNullOrEmpty(serverUrlV2))
-            {
-                Trace.Info($"Service enforced serverUrlV2: {serverUrlV2}");
-                runnerSettings.ServerUrlV2 = serverUrlV2;
-            }
-
-            if (agent.Properties.TryGetValue("UseV2Flow", out bool useV2Flow) && useV2Flow)
-            {
-                Trace.Info($"Service enforced useV2Flow: {useV2Flow}");
-                runnerSettings.UseV2Flow = useV2Flow;
-            }
-
             _term.WriteSection("Runner settings");
 
             // We will Combine() what's stored with root.  Defaults to string a relative path
@@ -538,7 +537,7 @@ namespace GitHub.Runner.Listener.Configuration
                 {
                     RunnerSettings settings = _store.GetSettings();
 
-                    if (settings.UseV2Flow)
+                    if (settings.UseRunnerAdminFlow)
                     {
                         var deletionToken = await GetRunnerTokenAsync(command, settings.GitHubUrl, "remove");
                         await _dotcomServer.DeleteRunnerAsync(settings.GitHubUrl, deletionToken, settings.AgentId);

src/Runner.Listener/Configuration/CredentialManager.cs

@@ -89,7 +89,7 @@ namespace GitHub.Runner.Listener.Configuration
         public string Token { get; set; }
 
         [DataMember(Name = "use_v2_flow")]
-        public bool UseV2Flow { get; set; }
+        public bool UseRunnerAdminFlow { get; set; }
 
         public VssCredentials ToVssCredentials()
         {

src/Runner.Listener/MessageListener.cs

@@ -32,6 +32,7 @@ namespace GitHub.Runner.Listener
         Task DeleteSessionAsync();
         Task<TaskAgentMessage> GetNextMessageAsync(CancellationToken token);
         Task DeleteMessageAsync(TaskAgentMessage message);
+        Task AcknowledgeMessageAsync(string runnerRequestId, CancellationToken cancellationToken);
 
         Task RefreshListenerTokenAsync();
         void OnJobStatus(object sender, JobStatusEventArgs e);
@@ -52,7 +53,7 @@ namespace GitHub.Runner.Listener
         private readonly TimeSpan _sessionConflictRetryLimit = TimeSpan.FromMinutes(4);
         private readonly TimeSpan _clockSkewRetryLimit = TimeSpan.FromMinutes(30);
         private readonly Dictionary<string, int> _sessionCreationExceptionTracker = new();
-        private TaskAgentStatus runnerStatus = TaskAgentStatus.Online;
+        private TaskAgentStatus _runnerStatus = TaskAgentStatus.Online;
         private CancellationTokenSource _getMessagesTokenSource;
         private VssCredentials _creds;
         private VssCredentials _credsV2;
@@ -217,7 +218,7 @@ namespace GitHub.Runner.Listener
         public void OnJobStatus(object sender, JobStatusEventArgs e)
         {
             Trace.Info("Received job status event. JobState: {0}", e.Status);
-            runnerStatus = e.Status;
+            _runnerStatus = e.Status;
             try
             {
                 _getMessagesTokenSource?.Cancel();
@@ -250,7 +251,7 @@ namespace GitHub.Runner.Listener
                     message = await _runnerServer.GetAgentMessageAsync(_settings.PoolId,
                                                                 _session.SessionId,
                                                                 _lastMessageId,
-                                                                runnerStatus,
+                                                                _runnerStatus,
                                                                 BuildConstants.RunnerPackage.Version,
                                                                 VarUtil.OS,
                                                                 VarUtil.OSArchitecture,
@@ -274,7 +275,7 @@ namespace GitHub.Runner.Listener
                         }
 
                         message = await _brokerServer.GetRunnerMessageAsync(_session.SessionId,
-                                                                        runnerStatus,
+                                                                        _runnerStatus,
                                                                         BuildConstants.RunnerPackage.Version,
                                                                         VarUtil.OS,
                                                                         VarUtil.OSArchitecture,
@@ -437,6 +438,21 @@ namespace GitHub.Runner.Listener
             await _brokerServer.ForceRefreshConnection(_credsV2);
         }
 
+        public async Task AcknowledgeMessageAsync(string runnerRequestId, CancellationToken cancellationToken)
+        {
+            using var timeoutCts = new CancellationTokenSource(TimeSpan.FromSeconds(5)); // Short timeout
+            using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken, timeoutCts.Token);
+            Trace.Info($"Acknowledging runner request '{runnerRequestId}'.");
+            await _brokerServer.AcknowledgeRunnerRequestAsync(
+                runnerRequestId,
+                _session.SessionId,
+                _runnerStatus,
+                BuildConstants.RunnerPackage.Version,
+                VarUtil.OS,
+                VarUtil.OSArchitecture,
+                linkedCts.Token);
+        }
+
         private TaskAgentMessage DecryptMessage(TaskAgentMessage message)
         {
             if (_session.EncryptionKey == null ||

src/Runner.Listener/Runner.cs

@@ -654,22 +654,42 @@ namespace GitHub.Runner.Listener
                                 else
                                 {
                                     var messageRef = StringUtil.ConvertFromJson<RunnerJobRequestRef>(message.Body);
-                                    Pipelines.AgentJobRequestMessage jobRequestMessage = null;
 
-                                    // Create connection
-                                    var credMgr = HostContext.GetService<ICredentialManager>();
+                                    // Acknowledge (best-effort)
+                                    if (messageRef.ShouldAcknowledge) // Temporary feature flag
+                                    {
+                                        try
+                                        {
+                                            await _listener.AcknowledgeMessageAsync(messageRef.RunnerRequestId, messageQueueLoopTokenSource.Token);
+                                        }
+                                        catch (Exception ex)
+                                        {
+                                            Trace.Error($"Best-effort acknowledge failed for request '{messageRef.RunnerRequestId}'");
+                                            Trace.Error(ex);
+                                        }
+                                    }
+
+                                    Pipelines.AgentJobRequestMessage jobRequestMessage = null;
                                     if (string.IsNullOrEmpty(messageRef.RunServiceUrl))
                                     {
+                                        // Connect
+                                        var credMgr = HostContext.GetService<ICredentialManager>();
                                         var creds = credMgr.LoadCredentials(allowAuthUrlV2: false);
                                         var actionsRunServer = HostContext.CreateService<IActionsRunServer>();
                                         await actionsRunServer.ConnectAsync(new Uri(settings.ServerUrl), creds);
+
+                                        // Get job message
                                         jobRequestMessage = await actionsRunServer.GetJobMessageAsync(messageRef.RunnerRequestId, messageQueueLoopTokenSource.Token);
                                     }
                                     else
                                     {
+                                        // Connect
+                                        var credMgr = HostContext.GetService<ICredentialManager>();
                                         var credsV2 = credMgr.LoadCredentials(allowAuthUrlV2: true);
                                         var runServer = HostContext.CreateService<IRunServer>();
                                         await runServer.ConnectAsync(new Uri(messageRef.RunServiceUrl), credsV2);
+
+                                        // Get job message
                                         try
                                         {
                                             jobRequestMessage = await runServer.GetJobMessageAsync(messageRef.RunnerRequestId, messageRef.BillingOwnerId, messageQueueLoopTokenSource.Token);
@@ -698,7 +718,10 @@ namespace GitHub.Runner.Listener
                                         }
                                     }
 
+                                    // Dispatch
                                     jobDispatcher.Run(jobRequestMessage, runOnce);
+
+                                    // Run once?
                                     if (runOnce)
                                     {
                                         Trace.Info("One time used runner received job message.");

src/Runner.Listener/RunnerJobRequestRef.cs

@@ -10,6 +10,9 @@ namespace GitHub.Runner.Listener
         
         [DataMember(Name = "runner_request_id")]
         public string RunnerRequestId { get; set; }
+
+        [DataMember(Name = "should_acknowledge")]
+        public bool ShouldAcknowledge { get; set; }
         
         [DataMember(Name = "run_service_url")]
         public string RunServiceUrl { get; set; }

src/Runner.Worker/FeatureManager.cs

@@ -11,5 +11,10 @@ namespace GitHub.Runner.Worker
             var isContainerHooksPathSet = !string.IsNullOrEmpty(Environment.GetEnvironmentVariable(Constants.Hooks.ContainerHooksPath));
             return isContainerHookFeatureFlagSet && isContainerHooksPathSet;
         }
+
+        public static bool IsContainerActionRunnerTempEnabled(Variables variables)
+        {
+            return variables?.GetBoolean(Constants.Runner.Features.ContainerActionRunnerTemp) ?? false;
+        }
     }
 }

src/Runner.Worker/Handlers/ContainerActionHandler.cs

@@ -191,11 +191,19 @@ namespace GitHub.Runner.Worker.Handlers
             ArgUtil.Directory(tempWorkflowDirectory, nameof(tempWorkflowDirectory));
 
             container.MountVolumes.Add(new MountVolume("/var/run/docker.sock", "/var/run/docker.sock"));
+            if (FeatureManager.IsContainerActionRunnerTempEnabled(ExecutionContext.Global.Variables))
+            {
+                container.MountVolumes.Add(new MountVolume(tempDirectory, "/github/runner_temp"));
+            }
             container.MountVolumes.Add(new MountVolume(tempHomeDirectory, "/github/home"));
             container.MountVolumes.Add(new MountVolume(tempWorkflowDirectory, "/github/workflow"));
             container.MountVolumes.Add(new MountVolume(tempFileCommandDirectory, "/github/file_commands"));
             container.MountVolumes.Add(new MountVolume(defaultWorkingDirectory, "/github/workspace"));
 
+            if (FeatureManager.IsContainerActionRunnerTempEnabled(ExecutionContext.Global.Variables))
+            {
+                container.AddPathTranslateMapping(tempDirectory, "/github/runner_temp");
+            }
             container.AddPathTranslateMapping(tempHomeDirectory, "/github/home");
             container.AddPathTranslateMapping(tempWorkflowDirectory, "/github/workflow");
             container.AddPathTranslateMapping(tempFileCommandDirectory, "/github/file_commands");

src/Sdk/WebApi/WebApi/BrokerHttpClient.cs

@@ -79,6 +79,7 @@ namespace GitHub.Actions.RunService.WebApi
             {
                 queryParams.Add("status", status.Value.ToString());
             }
+
             if (runnerVersion != null)
             {
                 queryParams.Add("runnerVersion", runnerVersion);
@@ -142,7 +143,6 @@ namespace GitHub.Actions.RunService.WebApi
         }
 
         public async Task<TaskAgentSession> CreateSessionAsync(
-
            TaskAgentSession session,
            CancellationToken cancellationToken = default)
         {
@@ -191,6 +191,76 @@ namespace GitHub.Actions.RunService.WebApi
             throw new Exception($"Failed to delete broker session: {result.Error}");
         }
 
+        public async Task AcknowledgeRunnerRequestAsync(
+            string runnerRequestId,
+            Guid? sessionId,
+            string runnerVersion,
+            TaskAgentStatus? status,
+            string os = null,
+            string architecture = null,
+            CancellationToken cancellationToken = default)
+        {
+            // URL
+            var requestUri = new Uri(Client.BaseAddress, "acknowledge");
+
+            // Query parameters
+            List<KeyValuePair<string, string>> queryParams = new List<KeyValuePair<string, string>>();
+            if (sessionId != null)
+            {
+                queryParams.Add("sessionId", sessionId.Value.ToString());
+            }
+            if (status != null)
+            {
+                queryParams.Add("status", status.Value.ToString());
+            }
+            if (runnerVersion != null)
+            {
+                queryParams.Add("runnerVersion", runnerVersion);
+            }
+            if (os != null)
+            {
+                queryParams.Add("os", os);
+            }
+            if (architecture != null)
+            {
+                queryParams.Add("architecture", architecture);
+            }
+
+            // Body
+            var payload = new Dictionary<string, string>
+            {
+                ["runnerRequestId"] = runnerRequestId,
+            };
+            var requestContent = new ObjectContent<Dictionary<string, string>>(payload, new VssJsonMediaTypeFormatter(true));
+
+            // POST
+            var result = await SendAsync<object>(
+                new HttpMethod("POST"),
+                requestUri: requestUri,
+                queryParameters: queryParams,
+                content: requestContent,
+                readErrorBody: true,
+                cancellationToken: cancellationToken);
+
+            if (result.IsSuccess)
+            {
+                return;
+            }
+
+            if (TryParseErrorBody(result.ErrorBody, out BrokerError brokerError))
+            {
+                switch (brokerError.ErrorKind)
+                {
+                    case BrokerErrorKind.RunnerNotFound:
+                        throw new RunnerNotFoundException(brokerError.Message);
+                    default:
+                        break;
+                }
+            }
+
+            throw new Exception($"Failed to acknowledge runner request. Request to {requestUri} failed with status: {result.StatusCode}. Error message {result.Error}");
+        }
+
         private static bool TryParseErrorBody(string errorBody, out BrokerError error)
         {
             if (!string.IsNullOrEmpty(errorBody))

src/Test/L0/Worker/ActionExecutionModelL0.cs

@@ -1,226 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Runtime.CompilerServices;
-using System.Threading;
-using GitHub.DistributedTask.WebApi;
-using GitHub.Runner.Worker;
-using Moq;
-using Xunit;
-
-namespace GitHub.Runner.Common.Tests.Worker
-{
-    /// <summary>
-    /// Tests to verify that actions are executed without compilation
-    /// </summary>
-    public sealed class ActionExecutionModelL0
-    {
-        private CancellationTokenSource _ecTokenSource;
-        private Mock<IExecutionContext> _ec;
-        private TestHostContext _hc;
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void JavaScriptActions_UseSourceFiles_NoCompilation()
-        {
-            try
-            {
-                // Arrange
-                Setup();
-                var actionManifest = new ActionManifestManager();
-                actionManifest.Initialize(_hc);
-
-                // Create a temporary action.yml for a JavaScript action
-                string actionYml = @"
-name: 'Test JS Action'
-description: 'Test JavaScript action execution'
-runs:
-  using: 'node20'
-  main: 'index.js'
-";
-                string tempFile = Path.GetTempFileName();
-                File.WriteAllText(tempFile, actionYml);
-
-                // Act
-                var result = actionManifest.Load(_ec.Object, tempFile);
-
-                // Assert - JavaScript actions should use direct script execution
-                Assert.Equal(ActionExecutionType.NodeJS, result.Execution.ExecutionType);
-                
-                var nodeAction = result.Execution as NodeJSActionExecutionData;
-                Assert.NotNull(nodeAction);
-                Assert.Equal("node20", nodeAction.NodeVersion);
-                Assert.Equal("index.js", nodeAction.Script); // Points to source file, not compiled binary
-                
-                // Cleanup
-                File.Delete(tempFile);
-            }
-            finally
-            {
-                Teardown();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void ContainerActions_UseImages_NoSourceCompilation()
-        {
-            try
-            {
-                // Arrange
-                Setup();
-                var actionManifest = new ActionManifestManager();
-                actionManifest.Initialize(_hc);
-
-                // Create a temporary action.yml for a container action
-                string actionYml = @"
-name: 'Test Container Action'
-description: 'Test container action execution'
-runs:
-  using: 'docker'
-  image: 'alpine:latest'
-  entrypoint: '/bin/sh'
-  args:
-    - '-c'
-    - 'echo Hello World'
-";
-                string tempFile = Path.GetTempFileName();
-                File.WriteAllText(tempFile, actionYml);
-
-                // Act
-                var result = actionManifest.Load(_ec.Object, tempFile);
-
-                // Assert - Container actions should use images, not compiled source
-                Assert.Equal(ActionExecutionType.Container, result.Execution.ExecutionType);
-                
-                var containerAction = result.Execution as ContainerActionExecutionData;
-                Assert.NotNull(containerAction);
-                Assert.Equal("alpine:latest", containerAction.Image); // Uses pre-built image
-                Assert.Equal("/bin/sh", containerAction.EntryPoint);
-                
-                // Cleanup
-                File.Delete(tempFile);
-            }
-            finally
-            {
-                Teardown();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void CompositeActions_UseStepDefinitions_NoCompilation()
-        {
-            try
-            {
-                // Arrange
-                Setup();
-                var actionManifest = new ActionManifestManager();
-                actionManifest.Initialize(_hc);
-
-                // Create a temporary action.yml for a composite action
-                string actionYml = @"
-name: 'Test Composite Action'
-description: 'Test composite action execution'
-runs:
-  using: 'composite'
-  steps:
-    - run: echo 'Hello from step 1'
-      shell: bash
-    - run: echo 'Hello from step 2'
-      shell: bash
-";
-                string tempFile = Path.GetTempFileName();
-                File.WriteAllText(tempFile, actionYml);
-
-                // Act
-                var result = actionManifest.Load(_ec.Object, tempFile);
-
-                // Assert - Composite actions should use step definitions, not compiled code
-                Assert.Equal(ActionExecutionType.Composite, result.Execution.ExecutionType);
-                
-                var compositeAction = result.Execution as CompositeActionExecutionData;
-                Assert.NotNull(compositeAction);
-                Assert.Equal(2, compositeAction.Steps.Count); // Contains step definitions, not binaries
-                
-                // Cleanup
-                File.Delete(tempFile);
-            }
-            finally
-            {
-                Teardown();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void ActionTypes_DoNotRequireCompilation_OnlyInterpretation()
-        {
-            // This test documents that actions are interpreted, not compiled
-            
-            // JavaScript actions: Node.js interprets .js files directly
-            // Container actions: Docker runs images or builds from Dockerfile  
-            // Composite actions: Runner interprets YAML step definitions
-            
-            // The runner itself (this C# code) is compiled, but actions are not
-            Assert.True(true, "Actions use interpretation model, not compilation model");
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public void ActionExecutionTypes_ShowNoCompilationRequired()
-        {
-            // Test that all action execution types are designed for interpretation
-            
-            // NodeJS actions execute source JavaScript files directly
-            var nodeAction = new NodeJSActionExecutionData
-            {
-                NodeVersion = "node20",
-                Script = "index.js" // Points to source file, not compiled binary
-            };
-            Assert.Equal(ActionExecutionType.NodeJS, nodeAction.ExecutionType);
-            Assert.Equal("index.js", nodeAction.Script);
-            
-            // Container actions use images, not compiled source
-            var containerAction = new ContainerActionExecutionData
-            {
-                Image = "alpine:latest" // Pre-built image, not compiled from this action's source
-            };
-            Assert.Equal(ActionExecutionType.Container, containerAction.ExecutionType);
-            Assert.Equal("alpine:latest", containerAction.Image);
-            
-            // Composite actions contain step definitions
-            var compositeAction = new CompositeActionExecutionData
-            {
-                Steps = new List<GitHub.DistributedTask.Pipelines.ActionStep>()
-            };
-            Assert.Equal(ActionExecutionType.Composite, compositeAction.ExecutionType);
-            Assert.NotNull(compositeAction.Steps); // Contains YAML-defined steps, not compiled code
-        }
-
-        private void Setup([CallerMemberName] string name = "")
-        {
-            _ecTokenSource = new CancellationTokenSource();
-            _hc = new TestHostContext(this, name);
-
-            _ec = new Mock<IExecutionContext>();
-            _ec.Setup(x => x.CancellationToken).Returns(_ecTokenSource.Token);
-            _ec.Setup(x => x.Global).Returns(new GlobalContext
-            {
-                Variables = new Variables(_hc, new Dictionary<string, VariableValue>()),
-                FileTable = new List<string>()
-            });
-        }
-
-        private void Teardown()
-        {
-            _hc?.Dispose();
-            _ecTokenSource?.Dispose();
-        }
-    }
-}

src/dev.sh

@@ -17,7 +17,7 @@ LAYOUT_DIR="$SCRIPT_DIR/../_layout"
 DOWNLOAD_DIR="$SCRIPT_DIR/../_downloads/netcore2x"
 PACKAGE_DIR="$SCRIPT_DIR/../_package"
 DOTNETSDK_ROOT="$SCRIPT_DIR/../_dotnetsdk"
-DOTNETSDK_VERSION="8.0.412"
+DOTNETSDK_VERSION="8.0.413"
 DOTNETSDK_INSTALLDIR="$DOTNETSDK_ROOT/$DOTNETSDK_VERSION"
 RUNNER_VERSION=$(cat runnerversion)
 

src/global.json

@@ -1,5 +1,5 @@
 {
   "sdk": {
-    "version": "8.0.412"
+    "version": "8.0.413"
   }
 }