Create 2.306.0 release

* add warning

* fix tests

* aggregate to one warning

* fix linter

* fix comm

.editorconfig

@@ -1,9 +0,0 @@
-# https://editorconfig.org/
-
-[*]
-charset = utf-8 # Set default charset to utf-8
-insert_final_newline = true # ensure all files end with a single newline
-trim_trailing_whitespace = true # attempt to remove trailing whitespace on save
-
-[*.md]
-trim_trailing_whitespace = false # in markdown, "two trailing spaces" is unfortunately meaningful; it means `<br>`

.github/workflows/release.yml

@@ -131,7 +131,7 @@ jobs:
         file=$(ls)
         sha=$(sha256sum $file | awk '{ print $1 }')
         echo "Computed sha256: $sha for $file"
-        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
+        echo "${{matrix.runtime}}-sha256=$sha" >> $GITHUB_OUTPUT
       shell: bash
       id: sha
       name: Compute SHA256
@@ -140,8 +140,8 @@ jobs:
         file=$(ls)
         sha=$(sha256sum $file | awk '{ print $1 }')
         echo "Computed sha256: $sha for $file"
-        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
-        echo "::set-output name=sha256::$sha"
+        echo "${{matrix.runtime}}-sha256=$sha" >> $GITHUB_OUTPUT
+        echo "sha256=$sha" >> $GITHUB_OUTPUT
       shell: bash
       id: sha_noexternals
       name: Compute SHA256
@@ -150,8 +150,8 @@ jobs:
         file=$(ls)
         sha=$(sha256sum $file | awk '{ print $1 }')
         echo "Computed sha256: $sha for $file"
-        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
-        echo "::set-output name=sha256::$sha"
+        echo "${{matrix.runtime}}-sha256=$sha" >> $GITHUB_OUTPUT
+        echo "sha256=$sha" >> $GITHUB_OUTPUT
       shell: bash
       id: sha_noruntime
       name: Compute SHA256
@@ -160,8 +160,8 @@ jobs:
         file=$(ls)
         sha=$(sha256sum $file | awk '{ print $1 }')
         echo "Computed sha256: $sha for $file"
-        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
-        echo "::set-output name=sha256::$sha"
+        echo "${{matrix.runtime}}-sha256=$sha" >> $GITHUB_OUTPUT
+        echo "sha256=$sha" >> $GITHUB_OUTPUT
       shell: bash
       id: sha_noruntime_noexternals
       name: Compute SHA256

docs/adrs/2494-runner-image-tags.md

@@ -0,0 +1,65 @@
+# ADR 2494: Runner Image Tags
+
+**Date**: 2023-03-17
+
+**Status**: Accepted<!-- |Accepted|Rejected|Superceded|Deprecated -->
+
+## Context
+
+Following the [adoption of actions-runner-controller by GitHub](https://github.com/actions/actions-runner-controller/discussions/2072) and the introduction of the new runner scale set autoscaling mode, we needed to provide a basic runner image that could be used off the shelf without much friction.
+
+The [current runner image](https://github.com/actions/runner/pkgs/container/actions-runner) is published to GHCR. Each release of this image is tagged with the runner version and the most recent release is also tagged with `latest`.
+
+While the use of `latest` is common practice, we recommend that users pin a specific version of the runner image for a predictable runtime and improved security posture. However, we still notice that a large number of end users are relying on the `latest` tag & raising issues when they encounter problems.
+
+Add to that, the community actions-runner-controller maintainers have issued a [deprecation notice](https://github.com/actions/actions-runner-controller/issues/2056) of the `latest` tag for the existing runner images (https://github.com/orgs/actions-runner-controller/packages).
+
+## Decision
+
+Proceed with Option 2, keeping the `latest` tag and adding the `NOTES.txt` file to our helm charts with the notice.
+
+### Option 1: Remove the `latest` tag
+
+By removing the `latest` tag, we have to proceed with either of these options:
+
+1. Remove the runner image reference in the `values.yaml` provided with the `gha-runner-scale-set` helm chart and mark these fields as required so that users have to explicitly specify a runner image and a specific tag. This will obviously introduce more  friction for users who want to start using actions-runner-controller for the first time.
+
+```yaml
+  spec:
+    containers:
+    - name: runner
+      image: ""
+      tag: ""
+      command: ["/home/runner/run.sh"]
+```
+
+1. Pin a specific runner image tag in the `values.yaml` provided with the `gha-runner-scale-set` helm chart. This will reduce friction for users who want to start using actions-runner-controller for the first time but will require us to update the `values.yaml` with every new runner release.
+
+```yaml
+  spec:
+    containers:
+    - name: runner
+      image: "ghcr.io/actions/actions-runner"
+      tag: "v2.300.0"
+      command: ["/home/runner/run.sh"]
+```
+
+### Option 2: Keep the `latest` tag
+
+Keeping the `latest` tag is also a reasonable option especially if we don't expect to make any breaking changes to the runner image. We could enhance this by adding a [NOTES.txt](https://helm.sh/docs/chart_template_guide/notes_files/) to the helm chart which will be displayed to the user after a successful helm install/upgrade. This will help users understand the implications of using the `latest` tag and how to pin a specific version of the runner image.
+
+The runner image release workflow will need to be updated so that the image is pushed to GHCR and tagged only when the runner rollout has reached all scale units.
+
+## Consequences
+
+Proceeding with **option 1** means:
+
+1. We will enhance the runtime predictability and security posture of our end users
+1. We will have to update the `values.yaml` with every new runner release (that can be automated)
+1. We will introduce friction for users who want to start using actions-runner-controller for the first time
+
+Proceeding with **option 2** means:
+
+1. We will have to continue to maintain the `latest` tag
+1. We will assume that end users will be able to handle the implications of using the `latest` tag
+1. Runner image release workflow needs to be updated 

docs/contribute.md

@@ -157,7 +157,7 @@ cat (Runner/Worker)_TIMESTAMP.log # view your log file
 ## Styling
 
 We use the .NET Foundation and CoreCLR style guidelines [located here](
-https://github.com/dotnet/corefx/blob/master/Documentation/coding-guidelines/coding-style.md)
+https://github.com/dotnet/runtime/blob/main/docs/coding-guidelines/coding-style.md)
 
 ### Format C# Code
 
@@ -165,4 +165,4 @@ To format both staged and unstaged .cs files
 ```
 cd ./src
 ./dev.(cmd|sh) format
-```
+```

images/Dockerfile

@@ -1,8 +1,9 @@
-FROM mcr.microsoft.com/dotnet/runtime-deps:6.0 as build
+# Source: https://github.com/dotnet/dotnet-docker
+FROM mcr.microsoft.com/dotnet/runtime-deps:6.0-jammy as build
 
 ARG RUNNER_VERSION
 ARG RUNNER_ARCH="x64"
-ARG RUNNER_CONTAINER_HOOKS_VERSION=0.2.0
+ARG RUNNER_CONTAINER_HOOKS_VERSION=0.3.2
 ARG DOCKER_VERSION=20.10.23
 
 RUN apt update -y && apt install curl unzip -y
@@ -22,7 +23,7 @@ RUN export DOCKER_ARCH=x86_64 \
     && tar zxvf docker.tgz \
     && rm -rf docker.tgz
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:6.0
+FROM mcr.microsoft.com/dotnet/runtime-deps:6.0-jammy
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV RUNNER_MANUALLY_TRAP_SIG=1
@@ -31,6 +32,7 @@ ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
     sudo \
+    lsb-release \
     && rm -rf /var/lib/apt/lists/*
 
 RUN adduser --disabled-password --gecos "" --uid 1001 runner \
@@ -46,4 +48,4 @@ COPY --chown=runner:docker --from=build /actions-runner .
 
 RUN install -o root -g root -m 755 docker/* /usr/bin/ && rm -rf docker
 
-USER runner
+USER runner

releaseNote.md

@@ -1,15 +1,19 @@
 ## Features
-- Add support for ghe.com domain (#2420)
-- Add docker cli to the runner image. (#2425)
+- Add warning to notify about forcing actions to run on node16 instead of node12 (#2678)
 
 ## Bugs
-- Fix URL construction bug for RunService (#2396)
-- Defer evaluation of a step's DisplayName until its condition is evaluated. (#2313)
-- Replace '(' and ')' with '[' and '] from OS.Description for fixing User-Agent header validation (#2288)
+- Remove job completion from runner listener (#2659)
+- Fix double error reporting (#2656)
+- Fix a bug with incorrect parsing of image values in a container action (#1873)
+- Fix error message reported on non-local action setup (#2668)
+- Extend github context with host-workspace (#2517)
+- Fixed a bug where a misplaced = character could bypass heredoc-style processing (#2627)
 
 ## Misc
-- Bump dotnet sdk to latest version. (#2392)
-- Start calling run service for job completion (#2412, #2423)
+- Send environment url to Run Service (#2650)
+- Reduce token service and unnecessary calls - send token to redirects (#2660)
+- Add 'http://' to http(s)_proxy if there is no protocol (#2663)
+- Remove extra result step for job itself (#2620)
 
 _Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet. 
 To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository. 

releaseVersion

@@ -1 +1 @@
-<Update to ./src/runnerversion when creating release>
+2.306.0

src/.editorconfig

@@ -1,5 +1,5 @@
 [*.cs]
-charset = utf-8
+charset = utf-8-bom
 insert_final_newline = true
 
 csharp_new_line_before_else = true

src/Misc/externals.sh

@@ -55,12 +55,23 @@ function acquireExternalTool() {
             # Download from source to the partial file.
             echo "Downloading $download_source"
             mkdir -p "$(dirname "$download_target")" || checkRC 'mkdir'
+
+            CURL_VERSION=$(curl --version | awk 'NR==1{print $2}')
+            echo "Curl version: $CURL_VERSION"
+
             # curl -f Fail silently (no output at all) on HTTP errors (H)
             #      -k Allow connections to SSL sites without certs (H)
             #      -S Show error. With -s, make curl show errors when they occur
             #      -L Follow redirects (H)
             #      -o FILE    Write to FILE instead of stdout
-            curl -fkSL -o "$partial_target" "$download_source" 2>"${download_target}_download.log" || checkRC 'curl'
+            #      --retry 3   Retries transient errors 3 times (timeouts, 5xx)
+            if [[ "$(printf '%s\n' "7.71.0" "$CURL_VERSION" | sort -V | head -n1)" != "7.71.0" ]]; then
+                # Curl version is less than or equal to 7.71.0, skipping retry-all-errors flag
+                 curl -fkSL --retry 3 -o "$partial_target" "$download_source" 2>"${download_target}_download.log" || checkRC 'curl'
+            else
+                # Curl version is greater than 7.71.0, running curl with --retry-all-errors flag
+                 curl -fkSL --retry 3 --retry-all-errors -o "$partial_target" "$download_source" 2>"${download_target}_download.log" || checkRC 'curl'
+            fi
 
             # Move the partial file to the download target.
             mv "$partial_target" "$download_target" || checkRC 'mv'

src/Misc/layoutroot/run.sh

@@ -53,6 +53,33 @@ runWithManualTrap() {
     done
 }
 
+function updateCerts() {
+    local sudo_prefix=""
+    local user_id=`id -u`
+
+    if [ $user_id -ne 0 ]; then
+        if [[ ! -x "$(command -v sudo)" ]]; then
+            echo "Warning: failed to update certificate store: sudo is required but not found"
+            return 1
+        else
+            sudo_prefix="sudo"
+        fi
+    fi
+
+    if [[ -x "$(command -v update-ca-certificates)" ]]; then
+        eval $sudo_prefix "update-ca-certificates"
+    elif [[ -x "$(command -v update-ca-trust)" ]]; then
+        eval $sudo_prefix "update-ca-trust"
+    else
+        echo "Warning: failed to update certificate store: update-ca-certificates or update-ca-trust not found. This can happen if you're using a different runner base image."
+        return 1
+    fi
+}
+
+if [[ ! -z "$RUNNER_UPDATE_CA_CERTS" ]]; then
+    updateCerts
+fi
+
 if [[ -z "$RUNNER_MANUALLY_TRAP_SIG" ]]; then
     run $*
 else

src/Runner.Common/ActionCommand.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Sdk;
+using GitHub.Runner.Sdk;
 using System;
 using System.Collections.Generic;
 

src/Runner.Common/ActionResult.cs

@@ -1,4 +1,4 @@
-namespace GitHub.Runner.Common
+namespace GitHub.Runner.Common
 {
     public enum ActionResult
     {
@@ -10,4 +10,4 @@ namespace GitHub.Runner.Common
 
         Skipped = 3
     }
-}
+}

src/Runner.Common/BrokerServer.cs

@@ -0,0 +1,56 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.Actions.RunService.WebApi;
+using GitHub.DistributedTask.Pipelines;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Sdk;
+using GitHub.Services.Common;
+using Sdk.RSWebApi.Contracts;
+using Sdk.WebApi.WebApi.RawClient;
+
+namespace GitHub.Runner.Common
+{
+    [ServiceLocator(Default = typeof(BrokerServer))]
+    public interface IBrokerServer : IRunnerService
+    {
+        Task ConnectAsync(Uri serverUrl, VssCredentials credentials);
+
+        Task<TaskAgentMessage> GetRunnerMessageAsync(CancellationToken token, TaskAgentStatus status, string version);
+    }
+
+    public sealed class BrokerServer : RunnerService, IBrokerServer
+    {
+        private bool _hasConnection;
+        private Uri _brokerUri;
+        private RawConnection _connection;
+        private BrokerHttpClient _brokerHttpClient;
+
+        public async Task ConnectAsync(Uri serverUri, VssCredentials credentials)
+        {
+            _brokerUri = serverUri;
+
+            _connection = VssUtil.CreateRawConnection(serverUri, credentials);
+            _brokerHttpClient = await _connection.GetClientAsync<BrokerHttpClient>();
+            _hasConnection = true;
+        }
+
+        private void CheckConnection()
+        {
+            if (!_hasConnection)
+            {
+                throw new InvalidOperationException($"SetConnection");
+            }
+        }
+
+        public Task<TaskAgentMessage> GetRunnerMessageAsync(CancellationToken cancellationToken, TaskAgentStatus status, string version)
+        {
+            CheckConnection();
+            var jobMessage = RetryRequest<TaskAgentMessage>(
+                async () => await _brokerHttpClient.GetRunnerMessageAsync(version, status, cancellationToken), cancellationToken);
+
+            return jobMessage;
+        }
+    }
+}

src/Runner.Common/CommandLineParser.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using GitHub.DistributedTask.Logging;
 using GitHub.Runner.Sdk;

src/Runner.Common/ConfigurationStore.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Sdk;
+using GitHub.Runner.Sdk;
 using System;
 using System.IO;
 using System.Linq;
@@ -50,6 +50,12 @@ namespace GitHub.Runner.Common
         [DataMember(EmitDefaultValue = false)]
         public string MonitorSocketAddress { get; set; }
 
+        [DataMember(EmitDefaultValue = false)]
+        public bool UseV2Flow { get; set; }
+
+        [DataMember(EmitDefaultValue = false)]
+        public string ServerUrlV2 { get; set; }
+
         [IgnoreDataMember]
         public bool IsHostedServer
         {

src/Runner.Common/Constants.cs

@@ -132,6 +132,7 @@ namespace GitHub.Runner.Common
                     public static readonly string GenerateServiceConfig = "generateServiceConfig";
                     public static readonly string Help = "help";
                     public static readonly string Local = "local";
+                    public static readonly string NoDefaultLabels = "no-default-labels";
                     public static readonly string Replace = "replace";
                     public static readonly string DisableUpdate = "disableupdate";
                     public static readonly string Once = "once"; // Keep this around since customers still relies on it
@@ -154,6 +155,7 @@ namespace GitHub.Runner.Common
             {
                 public static readonly string DiskSpaceWarning = "runner.diskspace.warning";
                 public static readonly string Node12Warning = "DistributedTask.AddWarningToNode12Action";
+                public static readonly string LogTemplateErrorsAsDebugMessages = "DistributedTask.LogTemplateErrorsAsDebugMessages";
                 public static readonly string UseContainerPathForTemplate = "DistributedTask.UseContainerPathForTemplate";
                 public static readonly string AllowRunnerContainerHooks = "DistributedTask.AllowRunnerContainerHooks";
             }
@@ -170,6 +172,8 @@ namespace GitHub.Runner.Common
             public static readonly string UnsupportedSummarySize = "$GITHUB_STEP_SUMMARY upload aborted, supports content up to a size of {0}k, got {1}k. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
             public static readonly string SummaryUploadError = "$GITHUB_STEP_SUMMARY upload aborted, an error occurred when uploading the summary. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
             public static readonly string Node12DetectedAfterEndOfLife = "Node.js 12 actions are deprecated. Please update the following actions to use Node.js 16: {0}. For more information see: https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/.";
+            public static readonly string EnforcedNode12DetectedAfterEndOfLife = "The following actions uses node12 which is deprecated and will be forced to run on node16: {0}. For more info: https://github.blog/changelog/2023-06-13-github-actions-all-actions-will-run-on-node16-instead-of-node12-by-default/";
+            public static readonly string EnforcedNode12DetectedAfterEndOfLifeEnvVariable = "Node16ForceActionsWarnings";
         }
 
         public static class RunnerEvent
@@ -261,6 +265,8 @@ namespace GitHub.Runner.Common
                 public static readonly string AccessToken = "system.accessToken";
                 public static readonly string Culture = "system.culture";
                 public static readonly string PhaseDisplayName = "system.phaseDisplayName";
+                public static readonly string JobRequestType = "system.jobRequestType";
+                public static readonly string OrchestrationId = "system.orchestrationId";
             }
         }
 

src/Runner.Common/ExtensionManager.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Sdk;
+using GitHub.Runner.Sdk;
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;

src/Runner.Common/HostContext.cs

@@ -220,7 +220,7 @@ namespace GitHub.Runner.Common
             var runnerFile = GetConfigFile(WellKnownConfigFile.Runner);
             if (File.Exists(runnerFile))
             {
-                var runnerSettings = IOUtil.LoadObject<RunnerSettings>(runnerFile);
+                var runnerSettings = IOUtil.LoadObject<RunnerSettings>(runnerFile, true);
                 _userAgents.Add(new ProductInfoHeaderValue("RunnerId", runnerSettings.AgentId.ToString(CultureInfo.InvariantCulture)));
                 _userAgents.Add(new ProductInfoHeaderValue("GroupId", runnerSettings.PoolId.ToString(CultureInfo.InvariantCulture)));
             }

src/Runner.Common/HostTraceListener.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Sdk;
+using GitHub.Runner.Sdk;
 using System;
 using System.Diagnostics;
 using System.Globalization;

src/Runner.Common/HttpClientHandlerFactory.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Net.Http;
 using GitHub.Runner.Sdk;
 
@@ -24,4 +24,4 @@ namespace GitHub.Runner.Common
             return client;
         }
     }
-}
+}

src/Runner.Common/JobNotification.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Net;
 using System.Net.Sockets;
 using System.Text;
@@ -37,10 +37,10 @@ namespace GitHub.Runner.Common
         {
             ConnectMonitor(monitorSocketAddress);
         }
-        
+
         private void StartMonitor(Guid jobId, string accessToken, Uri serverUri)
         {
-            if(String.IsNullOrEmpty(accessToken)) 
+            if (String.IsNullOrEmpty(accessToken))
             {
                 Trace.Info("No access token could be retrieved to start the monitor.");
                 return;
@@ -82,7 +82,7 @@ namespace GitHub.Runner.Common
                     _monitorSocket.Send(Encoding.UTF8.GetBytes(message));
                     Trace.Info("Finished EndMonitor writing to socket");
 
-                    await Task.Delay(TimeSpan.FromSeconds(2));                    
+                    await Task.Delay(TimeSpan.FromSeconds(2));
                 }
             }
             catch (SocketException e)

src/Runner.Common/JobServer.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -11,10 +11,10 @@ using System.Threading.Tasks;
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Sdk;
 using GitHub.Services.Common;
+using GitHub.Services.OAuth;
+using GitHub.Services.Results.Client;
 using GitHub.Services.WebApi;
 using GitHub.Services.WebApi.Utilities.Internal;
-using GitHub.Services.Results.Client;
-using GitHub.Services.OAuth;
 
 namespace GitHub.Runner.Common
 {
@@ -24,15 +24,11 @@ namespace GitHub.Runner.Common
         Task ConnectAsync(VssConnection jobConnection);
 
         void InitializeWebsocketClient(ServiceEndpoint serviceEndpoint);
-        void InitializeResultsClient(Uri uri, string token);
 
         // logging and console
         Task<TaskLog> AppendLogContentAsync(Guid scopeIdentifier, string hubName, Guid planId, int logId, Stream uploadStream, CancellationToken cancellationToken);
         Task AppendTimelineRecordFeedAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, Guid stepId, IList<string> lines, long? startLine, CancellationToken cancellationToken);
         Task<TaskAttachment> CreateAttachmentAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, String type, String name, Stream uploadStream, CancellationToken cancellationToken);
-        Task CreateStepSummaryAsync(string planId, string jobId, Guid stepId, string file, CancellationToken cancellationToken);
-        Task CreateResultsStepLogAsync(string planId, string jobId, Guid stepId, string file, bool finalize, bool firstBlock, long lineCount, CancellationToken cancellationToken);
-        Task CreateResultsJobLogAsync(string planId, string jobId, string file, bool finalize, bool firstBlock, long lineCount, CancellationToken cancellationToken);
         Task<TaskLog> CreateLogAsync(Guid scopeIdentifier, string hubName, Guid planId, TaskLog log, CancellationToken cancellationToken);
         Task<Timeline> CreateTimelineAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, CancellationToken cancellationToken);
         Task<List<TimelineRecord>> UpdateTimelineRecordsAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, IEnumerable<TimelineRecord> records, CancellationToken cancellationToken);
@@ -46,7 +42,6 @@ namespace GitHub.Runner.Common
         private bool _hasConnection;
         private VssConnection _connection;
         private TaskHttpClient _taskClient;
-        private ResultsHttpClient _resultsClient;
         private ClientWebSocket _websocketClient;
 
         private ServiceEndpoint _serviceEndpoint;
@@ -150,12 +145,6 @@ namespace GitHub.Runner.Common
             InitializeWebsocketClient(TimeSpan.Zero);
         }
 
-        public void InitializeResultsClient(Uri uri, string token)
-        {
-            var httpMessageHandler = HostContext.CreateHttpClientHandler();
-            this._resultsClient = new ResultsHttpClient(uri, httpMessageHandler, token, disposeHandler: true);
-        }
-
         public ValueTask DisposeAsync()
         {
             CloseWebSocket(WebSocketCloseStatus.NormalClosure, CancellationToken.None);
@@ -210,13 +199,15 @@ namespace GitHub.Runner.Common
             {
                 Trace.Info($"Attempting to start websocket client with delay {delay}.");
                 await Task.Delay(delay);
-                await this._websocketClient.ConnectAsync(new Uri(feedStreamUrl), default(CancellationToken));
+                using var connectTimeoutTokenSource = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+                await this._websocketClient.ConnectAsync(new Uri(feedStreamUrl), connectTimeoutTokenSource.Token);
                 Trace.Info($"Successfully started websocket client.");
             }
             catch (Exception ex)
             {
                 Trace.Info("Exception caught during websocket client connect, fallback of HTTP would be used now instead of websocket.");
                 Trace.Error(ex);
+                this._websocketClient = null;
             }
         }
 
@@ -263,7 +254,7 @@ namespace GitHub.Runner.Common
                 {
                     failedAttemptsToPostBatchedLinesByWebsocket++;
                     Trace.Info($"Caught exception during append web console line to websocket, let's fallback to sending via non-websocket call (total calls: {totalBatchedLinesAttemptedByWebsocket}, failed calls: {failedAttemptsToPostBatchedLinesByWebsocket}, websocket state: {this._websocketClient?.State}).");
-                    Trace.Error(ex);
+                    Trace.Verbose(ex.ToString());
                     if (totalBatchedLinesAttemptedByWebsocket > _minWebsocketBatchedLinesCountToConsider)
                     {
                         // let's consider failure percentage
@@ -318,32 +309,6 @@ namespace GitHub.Runner.Common
             return _taskClient.CreateAttachmentAsync(scopeIdentifier, hubName, planId, timelineId, timelineRecordId, type, name, uploadStream, cancellationToken: cancellationToken);
         }
 
-        public Task CreateStepSummaryAsync(string planId, string jobId, Guid stepId, string file, CancellationToken cancellationToken)
-        {
-            if (_resultsClient != null)
-            {
-                return _resultsClient.UploadStepSummaryAsync(planId, jobId, stepId, file, cancellationToken: cancellationToken);
-            }
-            throw new InvalidOperationException("Results client is not initialized.");
-        }
-
-        public Task CreateResultsStepLogAsync(string planId, string jobId, Guid stepId, string file, bool finalize, bool firstBlock, long lineCount, CancellationToken cancellationToken)
-        {
-            if (_resultsClient != null)
-            {
-                return _resultsClient.UploadResultsStepLogAsync(planId, jobId, stepId, file, finalize, firstBlock, lineCount, cancellationToken: cancellationToken);
-            }
-            throw new InvalidOperationException("Results client is not initialized.");
-        }
-
-        public Task CreateResultsJobLogAsync(string planId, string jobId, string file, bool finalize, bool firstBlock, long lineCount, CancellationToken cancellationToken)
-        {
-            if (_resultsClient != null)
-            {
-                return _resultsClient.UploadResultsJobLogAsync(planId, jobId, file, finalize, firstBlock, lineCount, cancellationToken: cancellationToken);
-            }
-            throw new InvalidOperationException("Results client is not initialized.");
-        }
 
         public Task<TaskLog> CreateLogAsync(Guid scopeIdentifier, string hubName, Guid planId, TaskLog log, CancellationToken cancellationToken)
         {

src/Runner.Common/JobServerQueue.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
@@ -17,7 +17,7 @@ namespace GitHub.Runner.Common
         TaskCompletionSource<int> JobRecordUpdated { get; }
         event EventHandler<ThrottlingEventArgs> JobServerQueueThrottling;
         Task ShutdownAsync();
-        void Start(Pipelines.AgentJobRequestMessage jobRequest);
+        void Start(Pipelines.AgentJobRequestMessage jobRequest, bool resultServiceOnly = false);
         void QueueWebConsoleLine(Guid stepRecordId, string line, long? lineNumber = null);
         void QueueFileUpload(Guid timelineId, Guid timelineRecordId, string type, string name, string path, bool deleteSource);
         void QueueResultsUpload(Guid timelineRecordId, string name, string path, string type, bool deleteSource, bool finalize, bool firstBlock, long totalLines);
@@ -65,10 +65,12 @@ namespace GitHub.Runner.Common
 
         // common
         private IJobServer _jobServer;
+        private IResultsServer _resultsServer;
         private Task[] _allDequeueTasks;
         private readonly TaskCompletionSource<int> _jobCompletionSource = new();
         private readonly TaskCompletionSource<int> _jobRecordUpdated = new();
         private bool _queueInProcess = false;
+        private bool _resultsServiceOnly = false;
 
         public TaskCompletionSource<int> JobRecordUpdated => _jobRecordUpdated;
 
@@ -91,15 +93,20 @@ namespace GitHub.Runner.Common
         {
             base.Initialize(hostContext);
             _jobServer = hostContext.GetService<IJobServer>();
+            _resultsServer = hostContext.GetService<IResultsServer>();
         }
 
-        public void Start(Pipelines.AgentJobRequestMessage jobRequest)
+        public void Start(Pipelines.AgentJobRequestMessage jobRequest, bool resultServiceOnly = false)
         {
             Trace.Entering();
+            _resultsServiceOnly = resultServiceOnly;
 
             var serviceEndPoint = jobRequest.Resources.Endpoints.Single(x => string.Equals(x.Name, WellKnownServiceEndpointNames.SystemVssConnection, StringComparison.OrdinalIgnoreCase));
 
-            _jobServer.InitializeWebsocketClient(serviceEndPoint);
+            if (!resultServiceOnly)
+            {
+                _jobServer.InitializeWebsocketClient(serviceEndPoint);
+            }
 
             // This code is usually wrapped by an instance of IExecutionContext which isn't available here.
             jobRequest.Variables.TryGetValue("system.github.results_endpoint", out VariableValue resultsEndpointVariable);
@@ -110,8 +117,16 @@ namespace GitHub.Runner.Common
                 !string.IsNullOrEmpty(accessToken) &&
                 !string.IsNullOrEmpty(resultsReceiverEndpoint))
             {
+                string liveConsoleFeedUrl = null;
                 Trace.Info("Initializing results client");
-                _jobServer.InitializeResultsClient(new Uri(resultsReceiverEndpoint), accessToken);
+                if (resultServiceOnly
+                    && serviceEndPoint.Data.TryGetValue("FeedStreamUrl", out var feedStreamUrl)
+                    && !string.IsNullOrEmpty(feedStreamUrl))
+                {
+                    liveConsoleFeedUrl = feedStreamUrl;
+                }
+
+                _resultsServer.InitializeResultsClient(new Uri(resultsReceiverEndpoint), liveConsoleFeedUrl, accessToken);
                 _resultsClientInitiated = true;
             }
 
@@ -192,6 +207,9 @@ namespace GitHub.Runner.Common
             Trace.Info($"Disposing job server ...");
             await _jobServer.DisposeAsync();
 
+            Trace.Info($"Disposing results server ...");
+            await _resultsServer.DisposeAsync();
+
             Trace.Info("All queue process tasks have been stopped, and all queues are drained.");
         }
 
@@ -370,7 +388,14 @@ namespace GitHub.Runner.Common
                                 // Give at most 60s for each request.
                                 using (var timeoutTokenSource = new CancellationTokenSource(TimeSpan.FromSeconds(60)))
                                 {
-                                    await _jobServer.AppendTimelineRecordFeedAsync(_scopeIdentifier, _hubName, _planId, _jobTimelineId, _jobTimelineRecordId, stepRecordId, batch.Select(logLine => logLine.Line).ToList(), batch[0].LineNumber, timeoutTokenSource.Token);
+                                    if (_resultsServiceOnly)
+                                    {
+                                        await _resultsServer.AppendLiveConsoleFeedAsync(_scopeIdentifier, _hubName, _planId, _jobTimelineId, _jobTimelineRecordId, stepRecordId, batch.Select(logLine => logLine.Line).ToList(), batch[0].LineNumber, timeoutTokenSource.Token);
+                                    }
+                                    else
+                                    {
+                                        await _jobServer.AppendTimelineRecordFeedAsync(_scopeIdentifier, _hubName, _planId, _jobTimelineId, _jobTimelineRecordId, stepRecordId, batch.Select(logLine => logLine.Line).ToList(), batch[0].LineNumber, timeoutTokenSource.Token);
+                                    }
                                 }
 
                                 if (_firstConsoleOutputs)
@@ -512,19 +537,14 @@ namespace GitHub.Runner.Common
                         }
                         catch (Exception ex)
                         {
-                            var issue = new Issue() { Type = IssueType.Warning, Message = $"Caught exception during file upload to results. {ex.Message}" };
-                            issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.ResultsUploadFailure;
-
-                            var telemetryRecord = new TimelineRecord()
-                            {
-                                Id = Constants.Runner.TelemetryRecordId,
-                            };
-                            telemetryRecord.Issues.Add(issue);
-                            QueueTimelineRecordUpdate(_jobTimelineId, telemetryRecord);
-
                             Trace.Info("Catch exception during file upload to results, keep going since the process is best effort.");
                             Trace.Error(ex);
                             errorCount++;
+
+                            // If we hit any exceptions uploading to Results, let's skip any additional uploads to Results
+                            _resultsClientInitiated = false;
+
+                            SendResultsTelemetry(ex);
                         }
                     }
 
@@ -542,6 +562,19 @@ namespace GitHub.Runner.Common
             }
         }
 
+        private void SendResultsTelemetry(Exception ex)
+        {
+            var issue = new Issue() { Type = IssueType.Warning, Message = $"Caught exception with results. {ex.Message}" };
+            issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.ResultsUploadFailure;
+
+            var telemetryRecord = new TimelineRecord()
+            {
+                Id = Constants.Runner.TelemetryRecordId,
+            };
+            telemetryRecord.Issues.Add(issue);
+            QueueTimelineRecordUpdate(_jobTimelineId, telemetryRecord);
+        }
+
         private async Task ProcessTimelinesUpdateQueueAsync(bool runOnce = false)
         {
             while (!_jobCompletionSource.Task.IsCompleted || runOnce)
@@ -589,7 +622,7 @@ namespace GitHub.Runner.Common
 
                         foreach (var detailTimeline in update.PendingRecords.Where(r => r.Details != null))
                         {
-                            if (!_allTimelines.Contains(detailTimeline.Details.Id))
+                            if (!_resultsServiceOnly && !_allTimelines.Contains(detailTimeline.Details.Id))
                             {
                                 try
                                 {
@@ -611,7 +644,27 @@ namespace GitHub.Runner.Common
 
                         try
                         {
-                            await _jobServer.UpdateTimelineRecordsAsync(_scopeIdentifier, _hubName, _planId, update.TimelineId, update.PendingRecords, default(CancellationToken));
+                            if (!_resultsServiceOnly)
+                            {
+                                await _jobServer.UpdateTimelineRecordsAsync(_scopeIdentifier, _hubName, _planId, update.TimelineId, update.PendingRecords, default(CancellationToken));
+                            }
+
+                            try
+                            {
+                                if (_resultsClientInitiated)
+                                {
+                                    await _resultsServer.UpdateResultsWorkflowStepsAsync(_scopeIdentifier, _hubName, _planId, update.TimelineId, update.PendingRecords, default(CancellationToken));
+                                }
+                            }
+                            catch (Exception e)
+                            {
+                                Trace.Info("Catch exception during update steps, skip update Results.");
+                                Trace.Error(e);
+                                _resultsClientInitiated = false;
+
+                                SendResultsTelemetry(e);
+                            }
+
                             if (_bufferedRetryRecords.Remove(update.TimelineId))
                             {
                                 Trace.Verbose("Cleanup buffered timeline record for timeline: {0}.", update.TimelineId);
@@ -703,17 +756,17 @@ namespace GitHub.Runner.Common
                     timelineRecord.State = rec.State ?? timelineRecord.State;
                     timelineRecord.WorkerName = rec.WorkerName ?? timelineRecord.WorkerName;
 
-                    if (rec.ErrorCount != null && rec.ErrorCount > 0)
+                    if (rec.ErrorCount > 0)
                     {
                         timelineRecord.ErrorCount = rec.ErrorCount;
                     }
 
-                    if (rec.WarningCount != null && rec.WarningCount > 0)
+                    if (rec.WarningCount > 0)
                     {
                         timelineRecord.WarningCount = rec.WarningCount;
                     }
 
-                    if (rec.NoticeCount != null && rec.NoticeCount > 0)
+                    if (rec.NoticeCount > 0)
                     {
                         timelineRecord.NoticeCount = rec.NoticeCount;
                     }
@@ -744,7 +797,7 @@ namespace GitHub.Runner.Common
             foreach (var record in mergedRecords)
             {
                 Trace.Verbose($"    Record: t={record.RecordType}, n={record.Name}, s={record.State}, st={record.StartTime}, {record.PercentComplete}%, ft={record.FinishTime}, r={record.Result}: {record.CurrentOperation}");
-                if (record.Issues != null && record.Issues.Count > 0)
+                if (record.Issues != null)
                 {
                     foreach (var issue in record.Issues)
                     {
@@ -754,7 +807,7 @@ namespace GitHub.Runner.Common
                     }
                 }
 
-                if (record.Variables != null && record.Variables.Count > 0)
+                if (record.Variables != null)
                 {
                     foreach (var variable in record.Variables)
                     {
@@ -771,27 +824,30 @@ namespace GitHub.Runner.Common
             bool uploadSucceed = false;
             try
             {
-                if (String.Equals(file.Type, CoreAttachmentType.Log, StringComparison.OrdinalIgnoreCase))
+                if (!_resultsServiceOnly)
                 {
-                    // Create the log
-                    var taskLog = await _jobServer.CreateLogAsync(_scopeIdentifier, _hubName, _planId, new TaskLog(String.Format(@"logs\{0:D}", file.TimelineRecordId)), default(CancellationToken));
-
-                    // Upload the contents
-                    using (FileStream fs = File.Open(file.Path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+                    if (String.Equals(file.Type, CoreAttachmentType.Log, StringComparison.OrdinalIgnoreCase))
                     {
-                        var logUploaded = await _jobServer.AppendLogContentAsync(_scopeIdentifier, _hubName, _planId, taskLog.Id, fs, default(CancellationToken));
+                        // Create the log
+                        var taskLog = await _jobServer.CreateLogAsync(_scopeIdentifier, _hubName, _planId, new TaskLog(String.Format(@"logs\{0:D}", file.TimelineRecordId)), default(CancellationToken));
+
+                        // Upload the contents
+                        using (FileStream fs = File.Open(file.Path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+                        {
+                            var logUploaded = await _jobServer.AppendLogContentAsync(_scopeIdentifier, _hubName, _planId, taskLog.Id, fs, default(CancellationToken));
+                        }
+
+                        // Create a new record and only set the Log field
+                        var attachmentUpdataRecord = new TimelineRecord() { Id = file.TimelineRecordId, Log = taskLog };
+                        QueueTimelineRecordUpdate(file.TimelineId, attachmentUpdataRecord);
                     }
-
-                    // Create a new record and only set the Log field
-                    var attachmentUpdataRecord = new TimelineRecord() { Id = file.TimelineRecordId, Log = taskLog };
-                    QueueTimelineRecordUpdate(file.TimelineId, attachmentUpdataRecord);
-                }
-                else
-                {
-                    // Create attachment
-                    using (FileStream fs = File.Open(file.Path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+                    else
                     {
-                        var result = await _jobServer.CreateAttachmentAsync(_scopeIdentifier, _hubName, _planId, file.TimelineId, file.TimelineRecordId, file.Type, file.Name, fs, default(CancellationToken));
+                        // Create attachment
+                        using (FileStream fs = File.Open(file.Path, FileMode.Open, FileAccess.Read, FileShare.ReadWrite))
+                        {
+                            var result = await _jobServer.CreateAttachmentAsync(_scopeIdentifier, _hubName, _planId, file.TimelineId, file.TimelineRecordId, file.Type, file.Name, fs, default(CancellationToken));
+                        }
                     }
                 }
 
@@ -819,7 +875,7 @@ namespace GitHub.Runner.Common
             Trace.Info($"Starting to upload summary file to results service {file.Name}, {file.Path}");
             ResultsFileUploadHandler summaryHandler = async (file) =>
             {
-                await _jobServer.CreateStepSummaryAsync(file.PlanId, file.JobId, file.RecordId, file.Path, CancellationToken.None);
+                await _resultsServer.CreateResultsStepSummaryAsync(file.PlanId, file.JobId, file.RecordId, file.Path, CancellationToken.None);
             };
 
             await UploadResultsFile(file, summaryHandler);
@@ -830,7 +886,7 @@ namespace GitHub.Runner.Common
             Trace.Info($"Starting upload of step log file to results service {file.Name}, {file.Path}");
             ResultsFileUploadHandler stepLogHandler = async (file) =>
             {
-                await _jobServer.CreateResultsStepLogAsync(file.PlanId, file.JobId, file.RecordId, file.Path, file.Finalize, file.FirstBlock, file.TotalLines, CancellationToken.None);
+                await _resultsServer.CreateResultsStepLogAsync(file.PlanId, file.JobId, file.RecordId, file.Path, file.Finalize, file.FirstBlock, file.TotalLines, CancellationToken.None);
             };
 
             await UploadResultsFile(file, stepLogHandler);
@@ -841,7 +897,7 @@ namespace GitHub.Runner.Common
             Trace.Info($"Starting upload of job log file to results service {file.Name}, {file.Path}");
             ResultsFileUploadHandler jobLogHandler = async (file) =>
             {
-                await _jobServer.CreateResultsJobLogAsync(file.PlanId, file.JobId, file.Path, file.Finalize, file.FirstBlock, file.TotalLines, CancellationToken.None);
+                await _resultsServer.CreateResultsJobLogAsync(file.PlanId, file.JobId, file.Path, file.Finalize, file.FirstBlock, file.TotalLines, CancellationToken.None);
             };
 
             await UploadResultsFile(file, jobLogHandler);
@@ -849,6 +905,11 @@ namespace GitHub.Runner.Common
 
         private async Task UploadResultsFile(ResultsUploadFileInfo file, ResultsFileUploadHandler uploadHandler)
         {
+            if (!_resultsClientInitiated)
+            {
+                return;
+            }
+
             bool uploadSucceed = false;
             try
             {
@@ -903,8 +964,6 @@ namespace GitHub.Runner.Common
         public long TotalLines { get; set; }
     }
 
-
-
     internal class ConsoleLineInfo
     {
         public ConsoleLineInfo(Guid recordId, string line, long? lineNumber)

src/Runner.Common/JobStatusEventArgs.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using GitHub.DistributedTask.WebApi;
 
 namespace GitHub.Runner.Common

src/Runner.Common/LaunchServer.cs

@@ -0,0 +1,42 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Services.Launch.Client;
+using GitHub.Services.WebApi;
+
+namespace GitHub.Runner.Common
+{
+    [ServiceLocator(Default = typeof(LaunchServer))]
+    public interface ILaunchServer : IRunnerService
+    {
+        void InitializeLaunchClient(Uri uri, string token);
+
+        Task<ActionDownloadInfoCollection> ResolveActionsDownloadInfoAsync(Guid planId, Guid jobId, ActionReferenceList actionReferenceList, CancellationToken cancellationToken);
+    }
+
+    public sealed class LaunchServer : RunnerService, ILaunchServer
+    {
+        private LaunchHttpClient _launchClient;
+
+        public void InitializeLaunchClient(Uri uri, string token)
+        {
+            var httpMessageHandler = HostContext.CreateHttpClientHandler();
+            this._launchClient = new LaunchHttpClient(uri, httpMessageHandler, token, disposeHandler: true);
+        }
+
+        public Task<ActionDownloadInfoCollection> ResolveActionsDownloadInfoAsync(Guid planId, Guid jobId, ActionReferenceList actionReferenceList,
+            CancellationToken cancellationToken)
+        {
+            if (_launchClient != null)
+            {
+                return _launchClient.GetResolveActionsDownloadInfoAsync(planId, jobId, actionReferenceList,
+                    cancellationToken: cancellationToken);
+            }
+
+            throw new InvalidOperationException("Launch client is not initialized.");
+        }
+    }
+}

src/Runner.Common/Logging.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.IO;
 
 namespace GitHub.Runner.Common

src/Runner.Common/ProcessInvoker.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Common.Util;
+using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
 using System;
 using System.Collections.Generic;

src/Runner.Common/ResultsServer.cs

@@ -0,0 +1,262 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Net.Http.Headers;
+using System.Net.WebSockets;
+using System.Security;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Sdk;
+using GitHub.Services.Common;
+using GitHub.Services.Results.Client;
+using GitHub.Services.WebApi.Utilities.Internal;
+
+namespace GitHub.Runner.Common
+{
+    [ServiceLocator(Default = typeof(ResultServer))]
+    public interface IResultsServer : IRunnerService, IAsyncDisposable
+    {
+        void InitializeResultsClient(Uri uri, string liveConsoleFeedUrl, string token);
+
+        Task<bool> AppendLiveConsoleFeedAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, Guid stepId, IList<string> lines, long? startLine, CancellationToken cancellationToken);
+
+        // logging and console
+        Task CreateResultsStepSummaryAsync(string planId, string jobId, Guid stepId, string file,
+            CancellationToken cancellationToken);
+
+        Task CreateResultsStepLogAsync(string planId, string jobId, Guid stepId, string file, bool finalize,
+            bool firstBlock, long lineCount, CancellationToken cancellationToken);
+
+        Task CreateResultsJobLogAsync(string planId, string jobId, string file, bool finalize, bool firstBlock,
+            long lineCount, CancellationToken cancellationToken);
+
+        Task UpdateResultsWorkflowStepsAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId,
+            IEnumerable<TimelineRecord> records, CancellationToken cancellationToken);
+    }
+
+    public sealed class ResultServer : RunnerService, IResultsServer
+    {
+        private ResultsHttpClient _resultsClient;
+
+        private ClientWebSocket _websocketClient;
+        private DateTime? _lastConnectionFailure;
+
+        private static readonly TimeSpan MinDelayForWebsocketReconnect = TimeSpan.FromMilliseconds(100);
+        private static readonly TimeSpan MaxDelayForWebsocketReconnect = TimeSpan.FromMilliseconds(500);
+
+        private Task _websocketConnectTask;
+        private String _liveConsoleFeedUrl;
+        private string _token;
+
+        public void InitializeResultsClient(Uri uri, string liveConsoleFeedUrl, string token)
+        {
+            var httpMessageHandler = HostContext.CreateHttpClientHandler();
+            this._resultsClient = new ResultsHttpClient(uri, httpMessageHandler, token, disposeHandler: true);
+            _token = token;
+            if (!string.IsNullOrEmpty(liveConsoleFeedUrl))
+            {
+                _liveConsoleFeedUrl = liveConsoleFeedUrl;
+                InitializeWebsocketClient(liveConsoleFeedUrl, token, TimeSpan.Zero, retryConnection: true);
+            }
+        }
+
+        public Task CreateResultsStepSummaryAsync(string planId, string jobId, Guid stepId, string file,
+            CancellationToken cancellationToken)
+        {
+            if (_resultsClient != null)
+            {
+                return _resultsClient.UploadStepSummaryAsync(planId, jobId, stepId, file,
+                    cancellationToken: cancellationToken);
+            }
+
+            throw new InvalidOperationException("Results client is not initialized.");
+        }
+
+        public Task CreateResultsStepLogAsync(string planId, string jobId, Guid stepId, string file, bool finalize,
+            bool firstBlock, long lineCount, CancellationToken cancellationToken)
+        {
+            if (_resultsClient != null)
+            {
+                return _resultsClient.UploadResultsStepLogAsync(planId, jobId, stepId, file, finalize, firstBlock,
+                    lineCount, cancellationToken: cancellationToken);
+            }
+
+            throw new InvalidOperationException("Results client is not initialized.");
+        }
+
+        public Task CreateResultsJobLogAsync(string planId, string jobId, string file, bool finalize, bool firstBlock,
+            long lineCount, CancellationToken cancellationToken)
+        {
+            if (_resultsClient != null)
+            {
+                return _resultsClient.UploadResultsJobLogAsync(planId, jobId, file, finalize, firstBlock, lineCount,
+                    cancellationToken: cancellationToken);
+            }
+
+            throw new InvalidOperationException("Results client is not initialized.");
+        }
+
+        public Task UpdateResultsWorkflowStepsAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId,
+            IEnumerable<TimelineRecord> records, CancellationToken cancellationToken)
+        {
+            if (_resultsClient != null)
+            {
+                try
+                {
+                    var timelineRecords = records.ToList();
+                    return _resultsClient.UpdateWorkflowStepsAsync(planId, new List<TimelineRecord>(timelineRecords),
+                        cancellationToken: cancellationToken);
+                }
+                catch (Exception ex)
+                {
+                    // Log error, but continue as this call is best-effort
+                    Trace.Info($"Failed to update steps status due to {ex.GetType().Name}");
+                    Trace.Error(ex);
+                }
+            }
+
+            throw new InvalidOperationException("Results client is not initialized.");
+        }
+
+        public ValueTask DisposeAsync()
+        {
+            CloseWebSocket(WebSocketCloseStatus.NormalClosure, CancellationToken.None);
+
+            GC.SuppressFinalize(this);
+
+            return ValueTask.CompletedTask;
+        }
+
+        private void InitializeWebsocketClient(string liveConsoleFeedUrl, string accessToken, TimeSpan delay, bool retryConnection = false)
+        {
+            if (string.IsNullOrEmpty(accessToken))
+            {
+                Trace.Info($"No access token from server");
+                return;
+            }
+
+            if (string.IsNullOrEmpty(liveConsoleFeedUrl))
+            {
+                Trace.Info($"No live console feed url from server");
+                return;
+            }
+
+            Trace.Info($"Creating websocket client ..." + liveConsoleFeedUrl);
+            this._websocketClient = new ClientWebSocket();
+            this._websocketClient.Options.SetRequestHeader("Authorization", $"Bearer {accessToken}");
+            var userAgentValues = new List<ProductInfoHeaderValue>();
+            userAgentValues.AddRange(UserAgentUtility.GetDefaultRestUserAgent());
+            userAgentValues.AddRange(HostContext.UserAgents);
+            this._websocketClient.Options.SetRequestHeader("User-Agent", string.Join(" ", userAgentValues.Select(x => x.ToString())));
+
+            // during initialization, retry upto 3 times to setup connection
+            this._websocketConnectTask = ConnectWebSocketClient(liveConsoleFeedUrl, delay, retryConnection);
+        }
+
+        private async Task ConnectWebSocketClient(string feedStreamUrl, TimeSpan delay, bool retryConnection = false)
+        {
+            bool connected = false;
+            int retries = 0;
+
+            do
+            {
+                try
+                {
+                    Trace.Info($"Attempting to start websocket client with delay {delay}.");
+                    await Task.Delay(delay);
+                    using var connectTimeoutTokenSource = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+                    await this._websocketClient.ConnectAsync(new Uri(feedStreamUrl), connectTimeoutTokenSource.Token);
+                    Trace.Info($"Successfully started websocket client.");
+                    connected = true;
+                }
+                catch (Exception ex)
+                {
+                    Trace.Info("Exception caught during websocket client connect, retry connection.");
+                    Trace.Error(ex);
+                    retries++;
+                    this._websocketClient = null;
+                    _lastConnectionFailure = DateTime.Now;
+                }
+            } while (retryConnection && !connected && retries < 3);
+        }
+
+        public async Task<bool> AppendLiveConsoleFeedAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, Guid stepId, IList<string> lines, long? startLine, CancellationToken cancellationToken)
+        {
+            if (_websocketConnectTask != null)
+            {
+                await _websocketConnectTask;
+            }
+
+            bool delivered = false;
+            int retries = 0;
+
+            // "_websocketClient != null" implies either: We have a successful connection OR we have to attempt sending again and then reconnect
+            // ...in other words, if websocket client is null, we will skip sending to websocket
+            if (_websocketClient != null)
+            {
+                var linesWrapper = startLine.HasValue
+                    ? new TimelineRecordFeedLinesWrapper(stepId, lines, startLine.Value)
+                    : new TimelineRecordFeedLinesWrapper(stepId, lines);
+                var jsonData = StringUtil.ConvertToJson(linesWrapper);
+                var jsonDataBytes = Encoding.UTF8.GetBytes(jsonData);
+                // break the message into chunks of 1024 bytes
+                for (var i = 0; i < jsonDataBytes.Length; i += 1 * 1024)
+                {
+                    var lastChunk = i + (1 * 1024) >= jsonDataBytes.Length;
+                    var chunk = new ArraySegment<byte>(jsonDataBytes, i, Math.Min(1 * 1024, jsonDataBytes.Length - i));
+
+                    delivered = false;
+                    while (!delivered && retries < 3)
+                    {
+                        try
+                        {
+                            if (_websocketClient != null)
+                            {
+                                await _websocketClient.SendAsync(chunk, WebSocketMessageType.Text, endOfMessage: lastChunk, cancellationToken);
+                                delivered = true;
+                            }
+                        }
+                        catch (Exception ex)
+                        {
+                            var delay = BackoffTimerHelper.GetRandomBackoff(MinDelayForWebsocketReconnect, MaxDelayForWebsocketReconnect);
+                            Trace.Info($"Websocket is not open, let's attempt to connect back again with random backoff {delay} ms.");
+                            Trace.Verbose(ex.ToString());
+                            retries++;
+                            InitializeWebsocketClient(_liveConsoleFeedUrl, _token, delay);
+                        }
+                    }
+                }
+            }
+
+            if (!delivered)
+            {
+                // Giving up for now, so next invocation of this method won't attempt to reconnect
+                _websocketClient = null;
+
+                // however if 10 minutes have already passed, let's try reestablish connection again
+                if (_lastConnectionFailure.HasValue && DateTime.Now > _lastConnectionFailure.Value.AddMinutes(10))
+                {
+                    // Some minutes passed since we retried last time, try connection again
+                    InitializeWebsocketClient(_liveConsoleFeedUrl, _token, TimeSpan.Zero);
+                }
+            }
+
+            return delivered;
+        }
+
+        private void CloseWebSocket(WebSocketCloseStatus closeStatus, CancellationToken cancellationToken)
+        {
+            try
+            {
+                _websocketClient?.CloseOutputAsync(closeStatus, "Closing websocket", cancellationToken);
+            }
+            catch (Exception websocketEx)
+            {
+                // In some cases this might be okay since the websocket might be open yet, so just close and don't trace exceptions
+                Trace.Info($"Failed to close websocket gracefully {websocketEx.GetType().Name}");
+            }
+        }
+    }
+}

src/Runner.Common/RunServer.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
@@ -19,7 +19,15 @@ namespace GitHub.Runner.Common
 
         Task<AgentJobRequestMessage> GetJobMessageAsync(string id, CancellationToken token);
 
-        Task CompleteJobAsync(Guid planId, Guid jobId, TaskResult result, Dictionary<String, VariableValue> outputs, IList<StepResult> stepResults, CancellationToken token);
+        Task CompleteJobAsync(
+            Guid planId,
+            Guid jobId,
+            TaskResult result,
+            Dictionary<String, VariableValue> outputs,
+            IList<StepResult> stepResults,
+            IList<Annotation> jobAnnotations,
+            string environmentUrl,
+            CancellationToken token);
 
         Task<RenewJobResponse> RenewJobAsync(Guid planId, Guid jobId, CancellationToken token);
     }
@@ -51,34 +59,31 @@ namespace GitHub.Runner.Common
         public Task<AgentJobRequestMessage> GetJobMessageAsync(string id, CancellationToken cancellationToken)
         {
             CheckConnection();
-            var jobMessage = RetryRequest<AgentJobRequestMessage>(
-                async () => await _runServiceHttpClient.GetJobMessageAsync(requestUri, id, cancellationToken), cancellationToken);
-            if (jobMessage == null)
-            {
-                throw new TaskOrchestrationJobNotFoundException(id);
-            }
-
-            return jobMessage;
+            return RetryRequest<AgentJobRequestMessage>(
+                async () => await _runServiceHttpClient.GetJobMessageAsync(requestUri, id, cancellationToken), cancellationToken,
+                shouldRetry: ex => ex is not TaskOrchestrationJobAlreadyAcquiredException);
         }
 
-        public Task CompleteJobAsync(Guid planId, Guid jobId, TaskResult result, Dictionary<String, VariableValue> outputs, IList<StepResult> stepResults, CancellationToken cancellationToken)
+        public Task CompleteJobAsync(
+            Guid planId,
+            Guid jobId,
+            TaskResult result,
+            Dictionary<String, VariableValue> outputs,
+            IList<StepResult> stepResults,
+            IList<Annotation> jobAnnotations,
+            string environmentUrl,
+            CancellationToken cancellationToken)
         {
             CheckConnection();
             return RetryRequest(
-                async () => await _runServiceHttpClient.CompleteJobAsync(requestUri, planId, jobId, result, outputs, stepResults, cancellationToken), cancellationToken);
+                async () => await _runServiceHttpClient.CompleteJobAsync(requestUri, planId, jobId, result, outputs, stepResults, jobAnnotations, environmentUrl, cancellationToken), cancellationToken);
         }
 
         public Task<RenewJobResponse> RenewJobAsync(Guid planId, Guid jobId, CancellationToken cancellationToken)
         {
             CheckConnection();
-            var renewJobResponse = RetryRequest<RenewJobResponse>(
+            return RetryRequest<RenewJobResponse>(
                 async () => await _runServiceHttpClient.RenewJobAsync(requestUri, planId, jobId, cancellationToken), cancellationToken);
-            if (renewJobResponse == null)
-            {
-                throw new TaskOrchestrationJobNotFoundException(jobId.ToString());
-            }
-
-            return renewJobResponse;
         }
     }
 }

src/Runner.Common/RunnerDotcomServer.cs

@@ -0,0 +1,237 @@
+using GitHub.DistributedTask.WebApi;
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.Services.WebApi;
+using GitHub.Services.Common;
+using GitHub.Runner.Sdk;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Linq;
+
+namespace GitHub.Runner.Common
+{
+    [ServiceLocator(Default = typeof(RunnerDotcomServer))]
+    public interface IRunnerDotcomServer : IRunnerService
+    {
+        Task<List<TaskAgent>> GetRunnersAsync(int runnerGroupId, string githubUrl, string githubToken, string agentName);
+
+        Task<DistributedTask.WebApi.Runner> AddRunnerAsync(int runnerGroupId, TaskAgent agent, string githubUrl, string githubToken, string publicKey);
+        Task<List<TaskAgentPool>> GetRunnerGroupsAsync(string githubUrl, string githubToken);
+
+        string GetGitHubRequestId(HttpResponseHeaders headers);
+    }
+
+    public enum RequestType
+    {
+        Get,
+        Post,
+        Patch,
+        Delete
+    }
+
+    public class RunnerDotcomServer : RunnerService, IRunnerDotcomServer
+    {
+        private ITerminal _term;
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _term = hostContext.GetService<ITerminal>();
+        }
+
+
+        public async Task<List<TaskAgent>> GetRunnersAsync(int runnerGroupId, string githubUrl, string githubToken, string agentName = null)
+        {
+            var githubApiUrl = "";
+            var gitHubUrlBuilder = new UriBuilder(githubUrl);
+            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
+            if (path.Length == 1)
+            {
+                // org runner
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/orgs/{path[0]}/actions/runner-groups/{runnerGroupId}/runners";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/orgs/{path[0]}/actions/runner-groups/{runnerGroupId}/runners";
+                }
+            }
+            else if (path.Length == 2)
+            {
+                // repo or enterprise runner.
+                if (!string.Equals(path[0], "enterprises", StringComparison.OrdinalIgnoreCase))
+                {
+                    return null;
+                }
+
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/{path[0]}/{path[1]}/actions/runner-groups/{runnerGroupId}/runners";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/{path[0]}/{path[1]}/actions/runner-groups/{runnerGroupId}/runners";
+                }
+            }
+            else
+            {
+                throw new ArgumentException($"'{githubUrl}' should point to an org or enterprise.");
+            }
+
+            var runnersList = await RetryRequest<ListRunnersResponse>(githubApiUrl, githubToken, RequestType.Get, 3, "Failed to get agents pools");
+            var agents = runnersList.ToTaskAgents();
+
+            if (string.IsNullOrEmpty(agentName))
+            {
+                return agents;
+            }
+
+            return agents.Where(x => string.Equals(x.Name, agentName, StringComparison.OrdinalIgnoreCase)).ToList();
+        }
+
+        public async Task<List<TaskAgentPool>> GetRunnerGroupsAsync(string githubUrl, string githubToken)
+        {
+            var githubApiUrl = "";
+            var gitHubUrlBuilder = new UriBuilder(githubUrl);
+            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
+            if (path.Length == 1)
+            {
+                // org runner
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/orgs/{path[0]}/actions/runner-groups";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/orgs/{path[0]}/actions/runner-groups";
+                }
+            }
+            else if (path.Length == 2)
+            {
+                // repo or enterprise runner.
+                if (!string.Equals(path[0], "enterprises", StringComparison.OrdinalIgnoreCase))
+                {
+                    return null;
+                }
+
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/{path[0]}/{path[1]}/actions/runner-groups";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/{path[0]}/{path[1]}/actions/runner-groups";
+                }
+            }
+            else
+            {
+                throw new ArgumentException($"'{githubUrl}' should point to an org or enterprise.");
+            }
+
+            var agentPools = await RetryRequest<RunnerGroupList>(githubApiUrl, githubToken, RequestType.Get, 3, "Failed to get agents pools");
+
+            return agentPools?.ToAgentPoolList();
+        }
+
+        public async Task<DistributedTask.WebApi.Runner> AddRunnerAsync(int runnerGroupId, TaskAgent agent, string githubUrl, string githubToken, string publicKey)
+        {
+            var gitHubUrlBuilder = new UriBuilder(githubUrl);
+            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
+            string githubApiUrl;
+            if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+            {
+                githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/actions/runners/register";
+            }
+            else
+            {
+                githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/actions/runners/register";
+            }
+
+            var bodyObject = new Dictionary<string, Object>()
+                    {
+                        {"url", githubUrl},
+                        {"group_id", runnerGroupId},
+                        {"name", agent.Name},
+                        {"version", agent.Version},
+                        {"updates_disabled", agent.DisableUpdate},
+                        {"ephemeral", agent.Ephemeral},
+                        {"labels", agent.Labels},
+                        {"public_key", publicKey}
+                    };
+
+            var body = new StringContent(StringUtil.ConvertToJson(bodyObject), null, "application/json");
+
+            return await RetryRequest<DistributedTask.WebApi.Runner>(githubApiUrl, githubToken, RequestType.Post, 3, "Failed to add agent", body);
+        }
+
+        private async Task<T> RetryRequest<T>(string githubApiUrl, string githubToken, RequestType requestType, int maxRetryAttemptsCount = 5, string errorMessage = null, StringContent body = null)
+        {
+            int retry = 0;
+            while (true)
+            {
+                retry++;
+                using (var httpClientHandler = HostContext.CreateHttpClientHandler())
+                using (var httpClient = new HttpClient(httpClientHandler))
+                {
+                    httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("RemoteAuth", githubToken);
+                    httpClient.DefaultRequestHeaders.UserAgent.AddRange(HostContext.UserAgents);
+
+                    var responseStatus = System.Net.HttpStatusCode.OK;
+                    try
+                    {
+                        HttpResponseMessage response = null;
+                        if (requestType == RequestType.Get)
+                        {
+                            response = await httpClient.GetAsync(githubApiUrl);
+                        }
+                        else
+                        {
+                            response = await httpClient.PostAsync(githubApiUrl, body);
+                        }
+
+                        if (response != null)
+                        {
+                            responseStatus = response.StatusCode;
+                            var githubRequestId = GetGitHubRequestId(response.Headers);
+
+                            if (response.IsSuccessStatusCode)
+                            {
+                                Trace.Info($"Http response code: {response.StatusCode} from '{requestType.ToString()} {githubApiUrl}' ({githubRequestId})");
+                                var jsonResponse = await response.Content.ReadAsStringAsync();
+                                return StringUtil.ConvertFromJson<T>(jsonResponse);
+                            }
+                            else
+                            {
+                                _term.WriteError($"Http response code: {response.StatusCode} from '{requestType.ToString()} {githubApiUrl}' (Request Id: {githubRequestId})");
+                                var errorResponse = await response.Content.ReadAsStringAsync();
+                                _term.WriteError(errorResponse);
+                                response.EnsureSuccessStatusCode();
+                            }
+                        }
+
+                    }
+                    catch (Exception ex) when (retry < maxRetryAttemptsCount && responseStatus != System.Net.HttpStatusCode.NotFound)
+                    {
+                        Trace.Error($"{errorMessage} -- Atempt: {retry}");
+                        Trace.Error(ex);
+                    }
+                }
+                var backOff = BackoffTimerHelper.GetRandomBackoff(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(5));
+                Trace.Info($"Retrying in {backOff.Seconds} seconds");
+                await Task.Delay(backOff);
+            }
+        }
+
+        public string GetGitHubRequestId(HttpResponseHeaders headers)
+        {
+            if (headers.TryGetValues("x-github-request-id", out var headerValues))
+            {
+                return headerValues.FirstOrDefault();
+            }
+            return string.Empty;
+        }
+    }
+}

src/Runner.Common/RunnerServer.cs

@@ -1,4 +1,4 @@
-using GitHub.DistributedTask.WebApi;
+using GitHub.DistributedTask.WebApi;
 using System;
 using System.Collections.Generic;
 using System.Threading;

src/Runner.Common/RunnerService.cs

@@ -80,10 +80,11 @@ namespace GitHub.Runner.Common
             }
             await RetryRequest<Unit>(wrappedFunc, cancellationToken, maxRetryAttemptsCount);
         }
-        
+
         protected async Task<T> RetryRequest<T>(Func<Task<T>> func,
             CancellationToken cancellationToken,
-            int maxRetryAttemptsCount = 5
+            int maxRetryAttemptsCount = 5,
+            Func<Exception, bool> shouldRetry = null
         )
         {
             var retryCount = 0;
@@ -96,7 +97,7 @@ namespace GitHub.Runner.Common
                     return await func();
                 }
                 // TODO: Add handling of non-retriable exceptions: https://github.com/github/actions-broker/issues/122
-                catch (Exception ex) when (retryCount < maxRetryAttemptsCount)
+                catch (Exception ex) when (retryCount < maxRetryAttemptsCount && (shouldRetry == null || shouldRetry(ex)))
                 {
                     Trace.Error("Catch exception during request");
                     Trace.Error(ex);

src/Runner.Common/StdoutTraceListener.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Diagnostics;
 using System.Globalization;
 using System.IO;
@@ -93,4 +93,4 @@ namespace GitHub.Runner.Common
             IndentLevel--;
         }
     }
-}
+}

src/Runner.Common/ThrottlingReportHandler.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Net.Http;

src/Runner.Common/TraceManager.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Diagnostics;
 using GitHub.DistributedTask.Logging;

src/Runner.Common/Tracing.cs

@@ -1,4 +1,4 @@
-using Newtonsoft.Json;
+using Newtonsoft.Json;
 using System;
 using System.Diagnostics;
 using System.Runtime.CompilerServices;

src/Runner.Common/Unit.cs

@@ -1,8 +1,8 @@
-// Represents absence of value.
+// Represents absence of value.
 namespace GitHub.Runner.Common
 {
     public readonly struct Unit
     {
         public static readonly Unit Value = default;
     }
-}
+}

src/Runner.Common/Util/EncodingUtil.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Threading;
 using System.Threading.Tasks;
 using GitHub.Runner.Sdk;

src/Runner.Common/Util/EnumUtil.cs

@@ -4,7 +4,7 @@
 
     public static class EnumUtil
     {
-        public static T? TryParse<T>(string value) where T: struct
+        public static T? TryParse<T>(string value) where T : struct
         {
             T val;
             if (Enum.TryParse(value ?? string.Empty, ignoreCase: true, result: out val))

src/Runner.Common/Util/MessageUtil.cs

@@ -1,4 +1,4 @@
-namespace GitHub.Runner.Common.Util
+namespace GitHub.Runner.Common.Util
 {
     using System;
     using GitHub.DistributedTask.WebApi;

src/Runner.Common/Util/VarUtil.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 
 namespace GitHub.Runner.Common.Util
 {

src/Runner.Listener/BrokerMessageListener.cs

@@ -0,0 +1,209 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Cryptography;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Common;
+using GitHub.Runner.Listener.Configuration;
+using GitHub.Runner.Sdk;
+using GitHub.Services.Common;
+using GitHub.Runner.Common.Util;
+using GitHub.Services.OAuth;
+
+namespace GitHub.Runner.Listener
+{
+    public sealed class BrokerMessageListener : RunnerService, IMessageListener
+    {
+        private RunnerSettings _settings;
+        private ITerminal _term;
+        private TimeSpan _getNextMessageRetryInterval;
+        private TaskAgentStatus runnerStatus = TaskAgentStatus.Online;
+        private CancellationTokenSource _getMessagesTokenSource;
+        private IBrokerServer _brokerServer;
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+
+            _term = HostContext.GetService<ITerminal>();
+            _brokerServer = HostContext.GetService<IBrokerServer>();
+        }
+
+        public async Task<Boolean> CreateSessionAsync(CancellationToken token)
+        {
+            await RefreshBrokerConnection();
+            return await Task.FromResult(true);
+        }
+
+        public async Task DeleteSessionAsync()
+        {
+            await Task.CompletedTask;
+        }
+
+        public void OnJobStatus(object sender, JobStatusEventArgs e)
+        {
+            Trace.Info("Received job status event. JobState: {0}", e.Status);
+            runnerStatus = e.Status;
+            try
+            {
+                _getMessagesTokenSource?.Cancel();
+            }
+            catch (ObjectDisposedException)
+            {
+                Trace.Info("_getMessagesTokenSource is already disposed.");
+            }
+        }
+
+        public async Task<TaskAgentMessage> GetNextMessageAsync(CancellationToken token)
+        {
+            bool encounteringError = false;
+            int continuousError = 0;
+            Stopwatch heartbeat = new();
+            heartbeat.Restart();
+            var maxRetryCount = 10;
+
+            while (true)
+            {
+                TaskAgentMessage message = null;
+                _getMessagesTokenSource = CancellationTokenSource.CreateLinkedTokenSource(token);
+                try
+                {
+                    message = await _brokerServer.GetRunnerMessageAsync(_getMessagesTokenSource.Token, runnerStatus, BuildConstants.RunnerPackage.Version);
+
+                    if (message == null)
+                    {
+                        continue;
+                    }
+
+                    return message;
+                }
+                catch (OperationCanceledException) when (_getMessagesTokenSource.Token.IsCancellationRequested && !token.IsCancellationRequested)
+                {
+                    Trace.Info("Get messages has been cancelled using local token source. Continue to get messages with new status.");
+                    continue;
+                }
+                catch (OperationCanceledException) when (token.IsCancellationRequested)
+                {
+                    Trace.Info("Get next message has been cancelled.");
+                    throw;
+                }
+                catch (TaskAgentAccessTokenExpiredException)
+                {
+                    Trace.Info("Runner OAuth token has been revoked. Unable to pull message.");
+                    throw;
+                }
+                catch (AccessDeniedException e) when (e.InnerException is InvalidTaskAgentVersionException)
+                {
+                    throw;
+                }
+                catch (Exception ex)
+                {
+                    Trace.Error("Catch exception during get next message.");
+                    Trace.Error(ex);
+
+                    if (!IsGetNextMessageExceptionRetriable(ex))
+                    {
+                        throw;
+                    }
+                    else
+                    {
+                        continuousError++;
+                        //retry after a random backoff to avoid service throttling
+                        //in case of there is a service error happened and all agents get kicked off of the long poll and all agent try to reconnect back at the same time.
+                        if (continuousError <= 5)
+                        {
+                            // random backoff [15, 30]
+                            _getNextMessageRetryInterval = BackoffTimerHelper.GetRandomBackoff(TimeSpan.FromSeconds(15), TimeSpan.FromSeconds(30), _getNextMessageRetryInterval);
+                        }
+                        else if (continuousError >= maxRetryCount)
+                        {
+                            throw;
+                        }
+                        else
+                        {
+                            // more aggressive backoff [30, 60]
+                            _getNextMessageRetryInterval = BackoffTimerHelper.GetRandomBackoff(TimeSpan.FromSeconds(30), TimeSpan.FromSeconds(60), _getNextMessageRetryInterval);
+                        }
+
+                        if (!encounteringError)
+                        {
+                            //print error only on the first consecutive error
+                            _term.WriteError($"{DateTime.UtcNow:u}: Runner connect error: {ex.Message}. Retrying until reconnected.");
+                            encounteringError = true;
+                        }
+
+                        // re-create VssConnection before next retry
+                        await RefreshBrokerConnection();
+
+                        Trace.Info("Sleeping for {0} seconds before retrying.", _getNextMessageRetryInterval.TotalSeconds);
+                        await HostContext.Delay(_getNextMessageRetryInterval, token);
+                    }
+                }
+                finally
+                {
+                    _getMessagesTokenSource.Dispose();
+                }
+
+                if (message == null)
+                {
+                    if (heartbeat.Elapsed > TimeSpan.FromMinutes(30))
+                    {
+                        Trace.Info($"No message retrieved within last 30 minutes.");
+                        heartbeat.Restart();
+                    }
+                    else
+                    {
+                        Trace.Verbose($"No message retrieved.");
+                    }
+
+                    continue;
+                }
+
+                Trace.Info($"Message '{message.MessageId}' received.");
+            }
+        }
+
+        public async Task DeleteMessageAsync(TaskAgentMessage message)
+        {
+            await Task.CompletedTask;
+        }
+
+        private bool IsGetNextMessageExceptionRetriable(Exception ex)
+        {
+            if (ex is TaskAgentNotFoundException ||
+                ex is TaskAgentPoolNotFoundException ||
+                ex is TaskAgentSessionExpiredException ||
+                ex is AccessDeniedException ||
+                ex is VssUnauthorizedException)
+            {
+                Trace.Info($"Non-retriable exception: {ex.Message}");
+                return false;
+            }
+            else
+            {
+                Trace.Info($"Retriable exception: {ex.Message}");
+                return true;
+            }
+        }
+
+        private async Task RefreshBrokerConnection()
+        {
+            var configManager = HostContext.GetService<IConfigurationManager>();
+            _settings = configManager.LoadSettings();
+
+            if (_settings.ServerUrlV2 == null)
+            {
+                throw new InvalidOperationException("ServerUrlV2 is not set");
+            }
+
+            var credMgr = HostContext.GetService<ICredentialManager>();
+            VssCredentials creds = credMgr.LoadCredentials();
+            await _brokerServer.ConnectAsync(new Uri(_settings.ServerUrlV2), creds);
+        }
+    }
+}

src/Runner.Listener/Checks/ActionsCheck.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
@@ -90,4 +90,4 @@ namespace GitHub.Runner.Listener.Check
             return result;
         }
     }
-}
+}

src/Runner.Listener/Checks/CheckUtil.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Diagnostics.Tracing;
 using System.IO;
@@ -415,4 +415,4 @@ namespace GitHub.Runner.Listener.Check
             }
         }
     }
-}
+}

src/Runner.Listener/Checks/GitCheck.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;

src/Runner.Listener/Checks/ICheckExtension.cs

@@ -1,4 +1,4 @@
-using System.Collections.Generic;
+using System.Collections.Generic;
 using System.Threading.Tasks;
 using GitHub.Runner.Common;
 
@@ -27,4 +27,4 @@ namespace GitHub.Runner.Listener.Check
 
         public List<string> Logs { get; set; }
     }
-}
+}

src/Runner.Listener/Checks/InternetCheck.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Threading.Tasks;
@@ -56,4 +56,4 @@ namespace GitHub.Runner.Listener.Check
             return result;
         }
     }
-}
+}

src/Runner.Listener/Checks/NodeJsCheck.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;

src/Runner.Listener/CommandSettings.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Listener.Configuration;
+using GitHub.Runner.Listener.Configuration;
 using GitHub.Runner.Common.Util;
 using System;
 using System.Collections;
@@ -29,8 +29,8 @@ namespace GitHub.Runner.Listener
         private readonly Dictionary<string, string[]> validOptions = new()
         {
             // Valid configure flags and args
-            [Constants.Runner.CommandLine.Commands.Configure] = 
-                new string[] 
+            [Constants.Runner.CommandLine.Commands.Configure] =
+                new string[]
                 {
                     Constants.Runner.CommandLine.Flags.DisableUpdate,
                     Constants.Runner.CommandLine.Flags.Ephemeral,
@@ -38,6 +38,7 @@ namespace GitHub.Runner.Listener
                     Constants.Runner.CommandLine.Flags.Replace,
                     Constants.Runner.CommandLine.Flags.RunAsService,
                     Constants.Runner.CommandLine.Flags.Unattended,
+                    Constants.Runner.CommandLine.Flags.NoDefaultLabels,
                     Constants.Runner.CommandLine.Args.Auth,
                     Constants.Runner.CommandLine.Args.Labels,
                     Constants.Runner.CommandLine.Args.MonitorSocketAddress,
@@ -85,6 +86,7 @@ namespace GitHub.Runner.Listener
         public bool Ephemeral => TestFlag(Constants.Runner.CommandLine.Flags.Ephemeral);
         public bool GenerateServiceConfig => TestFlag(Constants.Runner.CommandLine.Flags.GenerateServiceConfig);
         public bool Help => TestFlag(Constants.Runner.CommandLine.Flags.Help);
+        public bool NoDefaultLabels => TestFlag(Constants.Runner.CommandLine.Flags.NoDefaultLabels);
         public bool Unattended => TestFlag(Constants.Runner.CommandLine.Flags.Unattended);
         public bool Version => TestFlag(Constants.Runner.CommandLine.Flags.Version);
         public bool RemoveLocalConfig => TestFlag(Constants.Runner.CommandLine.Flags.Local);
@@ -182,7 +184,7 @@ namespace GitHub.Runner.Listener
             {
                 command = Constants.Runner.CommandLine.Commands.Warmup;
             }
-            
+
             return command;
         }
 

src/Runner.Listener/Configuration/ConfigurationManager.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Net.Http;
@@ -31,12 +31,14 @@ namespace GitHub.Runner.Listener.Configuration
     {
         private IConfigurationStore _store;
         private IRunnerServer _runnerServer;
+        private IRunnerDotcomServer _dotcomServer;
         private ITerminal _term;
 
         public override void Initialize(IHostContext hostContext)
         {
             base.Initialize(hostContext);
             _runnerServer = HostContext.GetService<IRunnerServer>();
+            _dotcomServer = HostContext.GetService<IRunnerDotcomServer>();
             Trace.Verbose("Creating _store");
             _store = hostContext.GetService<IConfigurationStore>();
             Trace.Verbose("store created");
@@ -113,6 +115,7 @@ namespace GitHub.Runner.Listener.Configuration
             ICredentialProvider credProvider = null;
             VssCredentials creds = null;
             _term.WriteSection("Authentication");
+            string registerToken = string.Empty;
             while (true)
             {
                 // When testing against a dev deployment of Actions Service, set this environment variable
@@ -130,9 +133,11 @@ namespace GitHub.Runner.Listener.Configuration
                 else
                 {
                     runnerSettings.GitHubUrl = inputUrl;
-                    var registerToken = await GetRunnerTokenAsync(command, inputUrl, "registration");
+                    registerToken = await GetRunnerTokenAsync(command, inputUrl, "registration");
                     GitHubAuthResult authResult = await GetTenantCredential(inputUrl, registerToken, Constants.RunnerEvent.Register);
                     runnerSettings.ServerUrl = authResult.TenantUrl;
+                    runnerSettings.UseV2Flow = authResult.UseV2Flow;
+                    Trace.Info($"Using V2 flow: {runnerSettings.UseV2Flow}");
                     creds = authResult.ToVssCredentials();
                     Trace.Info("cred retrieved via GitHub auth");
                 }
@@ -176,9 +181,11 @@ namespace GitHub.Runner.Listener.Configuration
             // We want to use the native CSP of the platform for storage, so we use the RSACSP directly
             RSAParameters publicKey;
             var keyManager = HostContext.GetService<IRSAKeyManager>();
+            string publicKeyXML;
             using (var rsa = keyManager.CreateKey())
             {
                 publicKey = rsa.ExportParameters(false);
+                publicKeyXML = rsa.ToXmlString(includePrivateParameters: false);
             }
 
             _term.WriteSection("Runner Registration");
@@ -186,9 +193,17 @@ namespace GitHub.Runner.Listener.Configuration
             // If we have more than one runner group available, allow the user to specify which one to be added into
             string poolName = null;
             TaskAgentPool agentPool = null;
-            List<TaskAgentPool> agentPools = await _runnerServer.GetAgentPoolsAsync();
-            TaskAgentPool defaultPool = agentPools?.Where(x => x.IsInternal).FirstOrDefault();
+            List<TaskAgentPool> agentPools;
+            if (runnerSettings.UseV2Flow)
+            {
+                agentPools = await _dotcomServer.GetRunnerGroupsAsync(runnerSettings.GitHubUrl, registerToken);
+            }
+            else
+            {
+                agentPools = await _runnerServer.GetAgentPoolsAsync();
+            }
 
+            TaskAgentPool defaultPool = agentPools?.Where(x => x.IsInternal).FirstOrDefault();
             if (agentPools?.Where(x => !x.IsHosted).Count() > 0)
             {
                 poolName = command.GetRunnerGroupName(defaultPool?.Name);
@@ -226,8 +241,16 @@ namespace GitHub.Runner.Listener.Configuration
 
                 var userLabels = command.GetLabels();
                 _term.WriteLine();
+                List<TaskAgent> agents;
+                if (runnerSettings.UseV2Flow)
+                {
+                    agents = await _dotcomServer.GetRunnersAsync(runnerSettings.PoolId, runnerSettings.GitHubUrl, registerToken, runnerSettings.AgentName);
+                }
+                else
+                {
+                    agents = await _runnerServer.GetAgentsAsync(runnerSettings.PoolId, runnerSettings.AgentName);
+                }
 
-                var agents = await _runnerServer.GetAgentsAsync(runnerSettings.PoolId, runnerSettings.AgentName);
                 Trace.Verbose("Returns {0} agents", agents.Count);
                 agent = agents.FirstOrDefault();
                 if (agent != null)
@@ -236,7 +259,7 @@ namespace GitHub.Runner.Listener.Configuration
                     if (command.GetReplace())
                     {
                         // Update existing agent with new PublicKey, agent version.
-                        agent = UpdateExistingAgent(agent, publicKey, userLabels, runnerSettings.Ephemeral, command.DisableUpdate);
+                        agent = UpdateExistingAgent(agent, publicKey, userLabels, runnerSettings.Ephemeral, command.DisableUpdate, command.NoDefaultLabels);
 
                         try
                         {
@@ -270,11 +293,27 @@ namespace GitHub.Runner.Listener.Configuration
                 else
                 {
                     // Create a new agent.
-                    agent = CreateNewAgent(runnerSettings.AgentName, publicKey, userLabels, runnerSettings.Ephemeral, command.DisableUpdate);
+                    agent = CreateNewAgent(runnerSettings.AgentName, publicKey, userLabels, runnerSettings.Ephemeral, command.DisableUpdate, command.NoDefaultLabels);
 
                     try
                     {
-                        agent = await _runnerServer.AddAgentAsync(runnerSettings.PoolId, agent);
+                        if (runnerSettings.UseV2Flow)
+                        {
+                            var runner = await _dotcomServer.AddRunnerAsync(runnerSettings.PoolId, agent, runnerSettings.GitHubUrl, registerToken, publicKeyXML);
+                            runnerSettings.ServerUrlV2 = runner.RunnerAuthorization.ServerUrl;
+
+                            agent.Id = runner.Id;
+                            agent.Authorization = new TaskAgentAuthorization()
+                            {
+                                AuthorizationUrl = runner.RunnerAuthorization.AuthorizationUrl,
+                                ClientId = new Guid(runner.RunnerAuthorization.ClientId)
+                            };
+                        }
+                        else
+                        {
+                            agent = await _runnerServer.AddAgentAsync(runnerSettings.PoolId, agent);
+                        }
+
                         if (command.DisableUpdate &&
                             command.DisableUpdate != agent.DisableUpdate)
                         {
@@ -325,24 +364,28 @@ namespace GitHub.Runner.Listener.Configuration
             }
 
             // Testing agent connection, detect any potential connection issue, like local clock skew that cause OAuth token expired.
-            var credMgr = HostContext.GetService<ICredentialManager>();
-            VssCredentials credential = credMgr.LoadCredentials();
-            try
+
+            if (!runnerSettings.UseV2Flow)
             {
-                await _runnerServer.ConnectAsync(new Uri(runnerSettings.ServerUrl), credential);
-                // ConnectAsync() hits _apis/connectionData which is an anonymous endpoint
-                // Need to hit an authenticate endpoint to trigger OAuth token exchange.
-                await _runnerServer.GetAgentPoolsAsync();
-                _term.WriteSuccessMessage("Runner connection is good");
-            }
-            catch (VssOAuthTokenRequestException ex) when (ex.Message.Contains("Current server time is"))
-            {
-                // there are two exception messages server send that indicate clock skew.
-                // 1. The bearer token expired on {jwt.ValidTo}. Current server time is {DateTime.UtcNow}.
-                // 2. The bearer token is not valid until {jwt.ValidFrom}. Current server time is {DateTime.UtcNow}.
-                Trace.Error("Catch exception during test agent connection.");
-                Trace.Error(ex);
-                throw new Exception("The local machine's clock may be out of sync with the server time by more than five minutes. Please sync your clock with your domain or internet time and try again.");
+                var credMgr = HostContext.GetService<ICredentialManager>();
+                VssCredentials credential = credMgr.LoadCredentials();
+                try
+                {
+                    await _runnerServer.ConnectAsync(new Uri(runnerSettings.ServerUrl), credential);
+                    // ConnectAsync() hits _apis/connectionData which is an anonymous endpoint
+                    // Need to hit an authenticate endpoint to trigger OAuth token exchange.
+                    await _runnerServer.GetAgentPoolsAsync();
+                    _term.WriteSuccessMessage("Runner connection is good");
+                }
+                catch (VssOAuthTokenRequestException ex) when (ex.Message.Contains("Current server time is"))
+                {
+                    // there are two exception messages server send that indicate clock skew.
+                    // 1. The bearer token expired on {jwt.ValidTo}. Current server time is {DateTime.UtcNow}.
+                    // 2. The bearer token is not valid until {jwt.ValidFrom}. Current server time is {DateTime.UtcNow}.
+                    Trace.Error("Catch exception during test agent connection.");
+                    Trace.Error(ex);
+                    throw new Exception("The local machine's clock may be out of sync with the server time by more than five minutes. Please sync your clock with your domain or internet time and try again.");
+                }
             }
 
             _term.WriteSection("Runner settings");
@@ -511,7 +554,7 @@ namespace GitHub.Runner.Listener.Configuration
         }
 
 
-        private TaskAgent UpdateExistingAgent(TaskAgent agent, RSAParameters publicKey, ISet<string> userLabels, bool ephemeral, bool disableUpdate)
+        private TaskAgent UpdateExistingAgent(TaskAgent agent, RSAParameters publicKey, ISet<string> userLabels, bool ephemeral, bool disableUpdate, bool noDefaultLabels)
         {
             ArgUtil.NotNull(agent, nameof(agent));
             agent.Authorization = new TaskAgentAuthorization
@@ -528,9 +571,16 @@ namespace GitHub.Runner.Listener.Configuration
 
             agent.Labels.Clear();
 
-            agent.Labels.Add(new AgentLabel("self-hosted", LabelType.System));
-            agent.Labels.Add(new AgentLabel(VarUtil.OS, LabelType.System));
-            agent.Labels.Add(new AgentLabel(VarUtil.OSArchitecture, LabelType.System));
+            if (!noDefaultLabels)
+            {
+                agent.Labels.Add(new AgentLabel("self-hosted", LabelType.System));
+                agent.Labels.Add(new AgentLabel(VarUtil.OS, LabelType.System));
+                agent.Labels.Add(new AgentLabel(VarUtil.OSArchitecture, LabelType.System));
+            }
+            else if (userLabels.Count == 0)
+            {
+                throw new NotSupportedException("Disabling default labels via --no-default-labels without specifying --labels is not supported");
+            }
 
             foreach (var userLabel in userLabels)
             {
@@ -540,7 +590,7 @@ namespace GitHub.Runner.Listener.Configuration
             return agent;
         }
 
-        private TaskAgent CreateNewAgent(string agentName, RSAParameters publicKey, ISet<string> userLabels, bool ephemeral, bool disableUpdate)
+        private TaskAgent CreateNewAgent(string agentName, RSAParameters publicKey, ISet<string> userLabels, bool ephemeral, bool disableUpdate, bool noDefaultLabels)
         {
             TaskAgent agent = new(agentName)
             {
@@ -555,9 +605,16 @@ namespace GitHub.Runner.Listener.Configuration
                 DisableUpdate = disableUpdate
             };
 
-            agent.Labels.Add(new AgentLabel("self-hosted", LabelType.System));
-            agent.Labels.Add(new AgentLabel(VarUtil.OS, LabelType.System));
-            agent.Labels.Add(new AgentLabel(VarUtil.OSArchitecture, LabelType.System));
+            if (!noDefaultLabels)
+            {
+                agent.Labels.Add(new AgentLabel("self-hosted", LabelType.System));
+                agent.Labels.Add(new AgentLabel(VarUtil.OS, LabelType.System));
+                agent.Labels.Add(new AgentLabel(VarUtil.OSArchitecture, LabelType.System));
+            }
+            else if (userLabels.Count == 0)
+            {
+                throw new NotSupportedException("Disabling default labels via --no-default-labels without specifying --labels is not supported");
+            }
 
             foreach (var userLabel in userLabels)
             {
@@ -652,7 +709,7 @@ namespace GitHub.Runner.Listener.Configuration
                     {
                         var response = await httpClient.PostAsync(githubApiUrl, new StringContent(string.Empty));
                         responseStatus = response.StatusCode;
-                        var githubRequestId = GetGitHubRequestId(response.Headers);
+                        var githubRequestId = _dotcomServer.GetGitHubRequestId(response.Headers);
 
                         if (response.IsSuccessStatusCode)
                         {
@@ -715,7 +772,7 @@ namespace GitHub.Runner.Listener.Configuration
                     {
                         var response = await httpClient.PostAsync(githubApiUrl, new StringContent(StringUtil.ConvertToJson(bodyObject), null, "application/json"));
                         responseStatus = response.StatusCode;
-                        var githubRequestId = GetGitHubRequestId(response.Headers);
+                        var githubRequestId = _dotcomServer.GetGitHubRequestId(response.Headers);
 
                         if (response.IsSuccessStatusCode)
                         {
@@ -744,14 +801,5 @@ namespace GitHub.Runner.Listener.Configuration
             }
             return null;
         }
-
-        private string GetGitHubRequestId(HttpResponseHeaders headers)
-        {
-            if (headers.TryGetValues("x-github-request-id", out var headerValues))
-            {
-                return headerValues.FirstOrDefault();
-            }
-            return string.Empty;
-        }
     }
 }

src/Runner.Listener/Configuration/CredentialManager.cs

@@ -20,8 +20,8 @@ namespace GitHub.Runner.Listener.Configuration
     {
         public static readonly Dictionary<string, Type> CredentialTypes = new(StringComparer.OrdinalIgnoreCase)
         {
-            { Constants.Configuration.OAuth, typeof(OAuthCredential)},
-            { Constants.Configuration.OAuthAccessToken, typeof(OAuthAccessTokenCredential)},
+            { Constants.Configuration.OAuth, typeof(OAuthCredential) },
+            { Constants.Configuration.OAuthAccessToken, typeof(OAuthAccessTokenCredential) },
         };
 
         public ICredentialProvider GetCredentialProvider(string credType)
@@ -93,6 +93,9 @@ namespace GitHub.Runner.Listener.Configuration
         [DataMember(Name = "token")]
         public string Token { get; set; }
 
+        [DataMember(Name = "use_v2_flow")]
+        public bool UseV2Flow { get; set; }
+
         public VssCredentials ToVssCredentials()
         {
             ArgUtil.NotNullOrEmpty(TokenSchema, nameof(TokenSchema));

src/Runner.Listener/Configuration/NativeWindowsServiceHelper.cs

@@ -1,4 +1,4 @@
-#if OS_WINDOWS
+#if OS_WINDOWS
 #pragma warning disable CA1416
 using System;
 using System.Collections;

src/Runner.Listener/Configuration/PromptManager.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Common;
+using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;
 using System;
 

src/Runner.Listener/Configuration/RSAEncryptedFileKeyManager.cs

@@ -1,4 +1,4 @@
-#if OS_WINDOWS
+#if OS_WINDOWS
 using System.IO;
 using System.Security.Cryptography;
 using System.Text;

src/Runner.Listener/Configuration/RSAFileKeyManager.cs

@@ -1,4 +1,4 @@
-#if OS_LINUX || OS_OSX
+#if OS_LINUX || OS_OSX
 using System;
 using System.IO;
 using System.Security.Cryptography;

src/Runner.Listener/Configuration/ServiceControlManager.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Linq;
 using System.Text.RegularExpressions;
 using GitHub.Runner.Common;
@@ -68,7 +68,7 @@ namespace GitHub.Runner.Listener.Configuration
                 // Lets add a suffix with a random number to reduce the chance of collisions between runner names once we truncate
                 var random = new Random();
                 var num = random.Next(1000, 9999).ToString();
-                runnerNameSubstring +=$"-{num}";
+                runnerNameSubstring += $"-{num}";
                 serviceName = StringUtil.Format(serviceNamePattern, repoOrOrgNameSubstring, runnerNameSubstring);
             }
 
@@ -76,12 +76,12 @@ namespace GitHub.Runner.Listener.Configuration
 
             Trace.Info($"Service name '{serviceName}' display name '{serviceDisplayName}' will be used for service configuration.");
         }
-        #if (OS_LINUX || OS_OSX)
-            const int MaxServiceNameLength = 150;
-            const int MaxRepoOrgCharacters = 70;
-        #elif OS_WINDOWS
+#if (OS_LINUX || OS_OSX)
+        const int MaxServiceNameLength = 150;
+        const int MaxRepoOrgCharacters = 70;
+#elif OS_WINDOWS
             const int MaxServiceNameLength = 80;
             const int MaxRepoOrgCharacters = 45;
-        #endif
+#endif
     }
 }

src/Runner.Listener/Configuration/SystemdControlManager.cs

@@ -1,4 +1,4 @@
-#if OS_LINUX
+#if OS_LINUX
 using System;
 using System.Collections.Generic;
 using System.IO;

src/Runner.Listener/Configuration/Validators.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Common.Util;
+using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
 using System;
 using System.Linq;

src/Runner.Listener/Configuration/WindowsServiceControlManager.cs

@@ -1,4 +1,4 @@
-#if OS_WINDOWS
+#if OS_WINDOWS
 #pragma warning disable CA1416
 using System;
 using System.IO;

src/Runner.Listener/InternalsVisibleTo.cs

@@ -1,3 +1,3 @@
-using System.Runtime.CompilerServices;
+using System.Runtime.CompilerServices;
 
 [assembly: InternalsVisibleTo("Test")]

src/Runner.Listener/JobDispatcher.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
@@ -15,6 +15,7 @@ using GitHub.Runner.Sdk;
 using GitHub.Services.Common;
 using GitHub.Services.WebApi;
 using GitHub.Services.WebApi.Jwt;
+using Sdk.RSWebApi.Contracts;
 using Pipelines = GitHub.DistributedTask.Pipelines;
 
 namespace GitHub.Runner.Listener
@@ -372,6 +373,8 @@ namespace GitHub.Runner.Listener
                 TaskCompletionSource<int> firstJobRequestRenewed = new();
                 var notification = HostContext.GetService<IJobNotification>();
 
+                var systemConnection = message.Resources.Endpoints.SingleOrDefault(x => string.Equals(x.Name, WellKnownServiceEndpointNames.SystemVssConnection, StringComparison.OrdinalIgnoreCase));
+
                 // lock renew cancellation token.
                 using (var lockRenewalTokenSource = new CancellationTokenSource())
                 using (var workerProcessCancelTokenSource = new CancellationTokenSource())
@@ -379,8 +382,6 @@ namespace GitHub.Runner.Listener
                     long requestId = message.RequestId;
                     Guid lockToken = Guid.Empty; // lockToken has never been used, keep this here of compat
 
-                    var systemConnection = message.Resources.Endpoints.SingleOrDefault(x => string.Equals(x.Name, WellKnownServiceEndpointNames.SystemVssConnection, StringComparison.OrdinalIgnoreCase));
-
                     // start renew job request
                     Trace.Info($"Start renew job request {requestId} for job {message.JobId}.");
                     Task renewJobRequest = RenewJobRequestAsync(message, systemConnection, _poolId, requestId, lockToken, orchestrationId, firstJobRequestRenewed, lockRenewalTokenSource.Token);
@@ -405,7 +406,7 @@ namespace GitHub.Runner.Listener
                         await renewJobRequest;
 
                         // complete job request with result Cancelled
-                        await CompleteJobRequestAsync(_poolId, message, lockToken, TaskResult.Canceled);
+                        await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, TaskResult.Canceled);
                         return;
                     }
 
@@ -544,7 +545,6 @@ namespace GitHub.Runner.Listener
                                     detailInfo = string.Join(Environment.NewLine, workerOutput);
                                     Trace.Info($"Return code {returnCode} indicate worker encounter an unhandled exception or app crash, attach worker stdout/stderr to JobRequest result.");
 
-
                                     var jobServer = await InitializeJobServerAsync(systemConnection);
                                     await LogWorkerProcessUnhandledException(jobServer, message, detailInfo);
 
@@ -552,7 +552,7 @@ namespace GitHub.Runner.Listener
                                     if (detailInfo.Contains(typeof(System.IO.IOException).ToString(), StringComparison.OrdinalIgnoreCase))
                                     {
                                         Trace.Info($"Finish job with result 'Failed' due to IOException.");
-                                        await ForceFailJob(jobServer, message);
+                                        await ForceFailJob(jobServer, message, detailInfo);
                                     }
                                 }
 
@@ -567,7 +567,7 @@ namespace GitHub.Runner.Listener
                                 await renewJobRequest;
 
                                 // complete job request
-                                await CompleteJobRequestAsync(_poolId, message, lockToken, result, detailInfo);
+                                await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, result, detailInfo);
 
                                 // print out unhandled exception happened in worker after we complete job request.
                                 // when we run out of disk space, report back to server has higher priority.
@@ -664,7 +664,7 @@ namespace GitHub.Runner.Listener
                             await renewJobRequest;
 
                             // complete job request
-                            await CompleteJobRequestAsync(_poolId, message, lockToken, resultOnAbandonOrCancel);
+                            await CompleteJobRequestAsync(_poolId, message, systemConnection, lockToken, resultOnAbandonOrCancel);
                         }
                         finally
                         {
@@ -1065,7 +1065,7 @@ namespace GitHub.Runner.Listener
             }
         }
 
-        private async Task CompleteJobRequestAsync(int poolId, Pipelines.AgentJobRequestMessage message, Guid lockToken, TaskResult result, string detailInfo = null)
+        private async Task CompleteJobRequestAsync(int poolId, Pipelines.AgentJobRequestMessage message, ServiceEndpoint systemConnection, Guid lockToken, TaskResult result, string detailInfo = null)
         {
             Trace.Entering();
 
@@ -1077,7 +1077,7 @@ namespace GitHub.Runner.Listener
 
             if (this._isRunServiceJob)
             {
-                Trace.Verbose($"Skip FinishAgentRequest call from Listener because MessageType is {message.MessageType}");
+                Trace.Verbose($"Skip CompleteJobRequestAsync call from Listener because it's RunService job");
                 return;
             }
 
@@ -1117,7 +1117,7 @@ namespace GitHub.Runner.Listener
         }
 
         // log an error issue to job level timeline record
-        private async Task LogWorkerProcessUnhandledException(IRunnerService server, Pipelines.AgentJobRequestMessage message, string errorMessage)
+        private async Task LogWorkerProcessUnhandledException(IRunnerService server, Pipelines.AgentJobRequestMessage message, string detailInfo)
         {
             if (server is IJobServer jobServer)
             {
@@ -1129,34 +1129,11 @@ namespace GitHub.Runner.Listener
                     TimelineRecord jobRecord = timeline.Records.FirstOrDefault(x => x.Id == message.JobId && x.RecordType == "Job");
                     ArgUtil.NotNull(jobRecord, nameof(jobRecord));
 
-                    try
-                    {
-                        if (!string.IsNullOrEmpty(errorMessage) &&
-                            message.Variables.TryGetValue("DistributedTask.EnableRunnerIPCDebug", out var enableRunnerIPCDebug) &&
-                            StringUtil.ConvertToBoolean(enableRunnerIPCDebug.Value))
-                        {
-                            // the trace should be best effort and not affect any job result
-                            var match = _invalidJsonRegex.Match(errorMessage);
-                            if (match.Success &&
-                                match.Groups.Count == 2)
-                            {
-                                var jsonPosition = int.Parse(match.Groups[1].Value);
-                                var serializedJobMessage = JsonUtility.ToString(message);
-                                var originalJson = serializedJobMessage.Substring(jsonPosition - 10, 20);
-                                errorMessage = $"Runner sent Json at position '{jsonPosition}': {originalJson} ({Convert.ToBase64String(Encoding.UTF8.GetBytes(originalJson))})\n{errorMessage}";
-                            }
-                        }
-                    }
-                    catch (Exception ex)
-                    {
-                        Trace.Error(ex);
-                        errorMessage = $"Fail to check json IPC error: {ex.Message}\n{errorMessage}";
-                    }
-
-                    var unhandledExceptionIssue = new Issue() { Type = IssueType.Error, Message = errorMessage };
+                    var unhandledExceptionIssue = new Issue() { Type = IssueType.Error, Message = detailInfo };
                     unhandledExceptionIssue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.WorkerCrash;
                     jobRecord.ErrorCount++;
                     jobRecord.Issues.Add(unhandledExceptionIssue);
+
                     await jobServer.UpdateTimelineRecordsAsync(message.Plan.ScopeIdentifier, message.Plan.PlanType, message.Plan.PlanId, message.Timeline.Id, new TimelineRecord[] { jobRecord }, CancellationToken.None);
                 }
                 catch (Exception ex)
@@ -1167,13 +1144,13 @@ namespace GitHub.Runner.Listener
             }
             else
             {
-                Trace.Info("Job server does not support handling unhandled exception yet, error message: {0}", errorMessage);
+                Trace.Info("Job server does not support handling unhandled exception yet, error message: {0}", detailInfo);
                 return;
             }
         }
 
         // raise job completed event to fail the job.
-        private async Task ForceFailJob(IRunnerService server, Pipelines.AgentJobRequestMessage message)
+        private async Task ForceFailJob(IRunnerService server, Pipelines.AgentJobRequestMessage message, string detailInfo)
         {
             if (server is IJobServer jobServer)
             {
@@ -1192,7 +1169,15 @@ namespace GitHub.Runner.Listener
             {
                 try
                 {
-                    await runServer.CompleteJobAsync(message.Plan.PlanId, message.JobId, TaskResult.Failed, outputs: null, stepResults: null, CancellationToken.None);
+                    var unhandledExceptionIssue = new Issue() { Type = IssueType.Error, Message = detailInfo };
+                    var unhandledAnnotation = unhandledExceptionIssue.ToAnnotation();
+                    var jobAnnotations = new List<Annotation>();
+                    if (unhandledAnnotation.HasValue)
+                    {
+                        jobAnnotations.Add(unhandledAnnotation.Value);
+                    }
+
+                    await runServer.CompleteJobAsync(message.Plan.PlanId, message.JobId, TaskResult.Failed, outputs: null, stepResults: null, jobAnnotations: jobAnnotations, environmentUrl: null, CancellationToken.None);
                 }
                 catch (Exception ex)
                 {

src/Runner.Listener/MessageListener.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.IO;
@@ -182,7 +182,7 @@ namespace GitHub.Runner.Listener
                 try
                 {
                     _getMessagesTokenSource?.Cancel();
-                } 
+                }
                 catch (ObjectDisposedException)
                 {
                     Trace.Info("_getMessagesTokenSource is already disposed.");
@@ -245,6 +245,10 @@ namespace GitHub.Runner.Listener
                     _accessTokenRevoked = true;
                     throw;
                 }
+                catch (AccessDeniedException e) when (e.InnerException is InvalidTaskAgentVersionException)
+                {
+                    throw;
+                }
                 catch (Exception ex)
                 {
                     Trace.Error("Catch exception during get next message.");
@@ -289,7 +293,7 @@ namespace GitHub.Runner.Listener
                         await HostContext.Delay(_getNextMessageRetryInterval, token);
                     }
                 }
-                finally 
+                finally
                 {
                     _getMessagesTokenSource.Dispose();
                 }

src/Runner.Listener/Program.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Common;
+using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;
 using System;
 using System.Globalization;
@@ -6,6 +6,7 @@ using System.IO;
 using System.Reflection;
 using System.Runtime.InteropServices;
 using System.Threading.Tasks;
+using GitHub.DistributedTask.WebApi;
 
 namespace GitHub.Runner.Listener
 {
@@ -58,7 +59,7 @@ namespace GitHub.Runner.Listener
                         terminal.WriteLine("This runner version is built for Windows. Please install a correct build for your OS.");
                         return Constants.Runner.ReturnCode.TerminatedError;
                     }
-                    #if ARM64
+#if ARM64
                         // A little hacky, but windows gives no way to differentiate between windows 10 and 11.
                         // By default only 11 supports native x64 app emulation on arm, so we only want to support windows 11
                         // https://docs.microsoft.com/en-us/windows/arm/overview#build-windows-apps-that-run-on-arm
@@ -69,7 +70,7 @@ namespace GitHub.Runner.Listener
                             terminal.WriteLine("Win-arm64 runners require windows 11 or later. Please upgrade your operating system.");
                             return Constants.Runner.ReturnCode.TerminatedError;
                         }
-                    #endif
+#endif
                     break;
                 default:
                     terminal.WriteLine($"Running the runner on this platform is not supported. The current platform is {RuntimeInformation.OSDescription} and it was built for {Constants.Runner.Platform.ToString()}.");
@@ -137,6 +138,12 @@ namespace GitHub.Runner.Listener
                 }
 
             }
+            catch (AccessDeniedException e) when (e.InnerException is InvalidTaskAgentVersionException)
+            {
+                terminal.WriteError($"An error occured: {e.Message}");
+                trace.Error(e);
+                return Constants.Runner.ReturnCode.TerminatedError;
+            }
             catch (Exception e)
             {
                 terminal.WriteError($"An error occurred: {e.Message}");

src/Runner.Listener/Runner.cs

@@ -1,9 +1,10 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
 using System.Reflection;
 using System.Runtime.CompilerServices;
+using System.Security.Cryptography;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -210,10 +211,16 @@ namespace GitHub.Runner.Listener
                         foreach (var config in jitConfig)
                         {
                             var configFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Root), config.Key);
-                            var configContent = Encoding.UTF8.GetString(Convert.FromBase64String(config.Value));
-                            File.WriteAllText(configFile, configContent, Encoding.UTF8);
+                            var configContent = Convert.FromBase64String(config.Value);
+#if OS_WINDOWS
+                            if (configFile == HostContext.GetConfigFile(WellKnownConfigFile.RSACredentials))
+                            {
+                                configContent = ProtectedData.Protect(configContent, null, DataProtectionScope.LocalMachine);
+                            }
+#endif
+                            File.WriteAllBytes(configFile, configContent);
                             File.SetAttributes(configFile, File.GetAttributes(configFile) | FileAttributes.Hidden);
-                            Trace.Info($"Save {configContent.Length} chars to '{configFile}'.");
+                            Trace.Info($"Saved {configContent.Length} bytes to '{configFile}'.");
                         }
                     }
                     catch (Exception ex)
@@ -332,13 +339,26 @@ namespace GitHub.Runner.Listener
             }
         }
 
+        private IMessageListener GetMesageListener(RunnerSettings settings)
+        {
+            if (settings.UseV2Flow)
+            {
+                Trace.Info($"Using BrokerMessageListener");
+                var brokerListener = new BrokerMessageListener();
+                brokerListener.Initialize(HostContext);
+                return brokerListener;
+            }
+
+            return HostContext.GetService<IMessageListener>();
+        }
+
         //create worker manager, create message listener and start listening to the queue
         private async Task<int> RunAsync(RunnerSettings settings, bool runOnce = false)
         {
             try
             {
                 Trace.Info(nameof(RunAsync));
-                _listener = HostContext.GetService<IMessageListener>();
+                _listener = GetMesageListener(settings);
                 if (!await _listener.CreateSessionAsync(HostContext.RunnerShutdownToken))
                 {
                     return Constants.Runner.ReturnCode.TerminatedError;
@@ -529,7 +549,17 @@ namespace GitHub.Runner.Listener
                                     {
                                         var runServer = HostContext.CreateService<IRunServer>();
                                         await runServer.ConnectAsync(new Uri(messageRef.RunServiceUrl), creds);
-                                        jobRequestMessage = await runServer.GetJobMessageAsync(messageRef.RunnerRequestId, messageQueueLoopTokenSource.Token);
+                                        try
+                                        {
+                                            jobRequestMessage =
+                                            await runServer.GetJobMessageAsync(messageRef.RunnerRequestId,
+                                            messageQueueLoopTokenSource.Token);
+                                        }
+                                        catch (TaskOrchestrationJobAlreadyAcquiredException)
+                                        {
+                                            Trace.Info("Job is already acquired, skip this message.");
+                                            continue;
+                                        }
                                     }
 
                                     jobDispatcher.Run(jobRequestMessage, runOnce);
@@ -653,7 +683,8 @@ Config Options:
  --token string         Registration token. Required if unattended
  --name string          Name of the runner to configure (default {Environment.MachineName ?? "myrunner"})
  --runnergroup string   Name of the runner group to add this runner to (defaults to the default runner group)
- --labels string        Extra labels in addition to the default: 'self-hosted,{Constants.Runner.Platform},{Constants.Runner.PlatformArchitecture}'
+ --labels string        Custom labels that will be added to the runner. This option is mandatory if --no-default-labels is used.
+ --no-default-labels    Disables adding the default labels: 'self-hosted,{Constants.Runner.Platform},{Constants.Runner.PlatformArchitecture}'
  --local                Removes the runner config files from your local machine. Used as an option to the remove command
  --work string          Relative runner work directory (default {Constants.Path.WorkDirectory})
  --replace              Replace any existing runner with the same name (default false)

src/Runner.Listener/RunnerJobRequestRef.cs

@@ -1,4 +1,4 @@
-using System.Runtime.Serialization;
+using System.Runtime.Serialization;
 
 namespace GitHub.Runner.Listener
 {

src/Runner.Listener/SelfUpdater.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Diagnostics;

src/Runner.PluginHost/Program.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Globalization;
 using System.IO;
 using System.Reflection;

src/Runner.Plugins/Artifact/FileContainerServer.cs

@@ -682,4 +682,4 @@ namespace GitHub.Runner.Plugins.Artifact
             : base(message, inner)
         { }
     }
-}
+}

src/Runner.Plugins/Artifact/PipelinesServer.cs

@@ -1,4 +1,4 @@
-using System.Threading;
+using System.Threading;
 using System.Threading.Tasks;
 using GitHub.Actions.Pipelines.WebApi;
 using GitHub.Services.WebApi;
@@ -36,7 +36,7 @@ namespace GitHub.Runner.Plugins.Artifact
 
             return await _pipelinesHttpClient.CreateArtifactAsync(
                 parameters,
-                pipelineId, 
+                pipelineId,
                 runId,
                 cancellationToken: cancellationToken) as Pipelines.ActionsStorageArtifact;
         }

src/Runner.Plugins/Artifact/PublishArtifact.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -97,8 +97,8 @@ namespace GitHub.Runner.Plugins.Artifact
                     size,
                     token);
 
-                context.Output($"Associated artifact {artifactName} ({artifact.ContainerId}) with run #{buildId}"); 
+                context.Output($"Associated artifact {artifactName} ({artifact.ContainerId}) with run #{buildId}");
             }
         }
     }
-}
+}

src/Runner.Plugins/Repository/GitCliManager.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;

src/Runner.Plugins/Repository/v1.0/GitSourceProvider.cs

@@ -1,4 +1,4 @@
-using Pipelines = GitHub.DistributedTask.Pipelines;
+using Pipelines = GitHub.DistributedTask.Pipelines;
 using System;
 using System.Collections.Generic;
 using System.Threading;

src/Runner.Plugins/Repository/v1.0/RepositoryPlugin.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Threading;
 using System.Threading.Tasks;
 using GitHub.Runner.Sdk;

src/Runner.Plugins/Repository/v1.1/GitSourceProvider.cs

@@ -1,4 +1,4 @@
-using Pipelines = GitHub.DistributedTask.Pipelines;
+using Pipelines = GitHub.DistributedTask.Pipelines;
 using System;
 using System.Collections.Generic;
 using System.Threading;

src/Runner.Plugins/Repository/v1.1/RepositoryPlugin.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Threading;
 using System.Threading.Tasks;
 using GitHub.Runner.Sdk;

src/Runner.Sdk/ActionPlugin.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Net.Http.Headers;
@@ -220,20 +220,12 @@ namespace GitHub.Runner.Sdk
             return input;
         }
 
-        private Dictionary<string, string> _commandEscapeMappings = new(StringComparer.OrdinalIgnoreCase)
+        private Dictionary<string, string> _commandEscapeMappings = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
         {
-            {
-                ";", "%3B"
-            },
-            {
-                "\r", "%0D"
-            },
-            {
-                "\n", "%0A"
-            },
-            {
-                "]", "%5D"
-            },
+            { ";", "%3B" },
+            { "\r", "%0D" },
+            { "\n", "%0A" },
+            { "]", "%5D" },
         };
     }
 }

src/Runner.Sdk/BuildConstants.cs

@@ -1,4 +1,4 @@
-namespace GitHub.Runner.Sdk
+namespace GitHub.Runner.Sdk
 {
     /***
      * WARNING: This file is automatically regenerated on layout so the runner can provide version/commit info (do not manually edit it).

src/Runner.Sdk/ProcessInvoker.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.ComponentModel;

src/Runner.Sdk/RunnerWebProxy.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Net;
 using System.Text.RegularExpressions;
@@ -69,6 +69,10 @@ namespace GitHub.Runner.Sdk
                 return;
             }
 
+            if (!string.IsNullOrEmpty(httpProxyAddress) && !Uri.TryCreate(httpProxyAddress, UriKind.Absolute, out var _))
+            {
+                httpProxyAddress = PrependHttpIfMissing(httpProxyAddress);
+            }
             if (!string.IsNullOrEmpty(httpProxyAddress) && Uri.TryCreate(httpProxyAddress, UriKind.Absolute, out var proxyHttpUri))
             {
                 _httpProxyAddress = proxyHttpUri.OriginalString;
@@ -99,6 +103,10 @@ namespace GitHub.Runner.Sdk
                 }
             }
 
+            if (!string.IsNullOrEmpty(httpsProxyAddress) && !Uri.TryCreate(httpsProxyAddress, UriKind.Absolute, out var _))
+            {
+                httpsProxyAddress = PrependHttpIfMissing(httpsProxyAddress);
+            }
             if (!string.IsNullOrEmpty(httpsProxyAddress) && Uri.TryCreate(httpsProxyAddress, UriKind.Absolute, out var proxyHttpsUri))
             {
                 _httpsProxyAddress = proxyHttpsUri.OriginalString;
@@ -240,5 +248,20 @@ namespace GitHub.Runner.Sdk
 
             return false;
         }
+
+        private string PrependHttpIfMissing(string proxyAddress)
+        {
+            // much like in golang, see https://github.com/golang/net/blob/f5464ddb689c015d1abf4df78a806a54af977e6c/http/httpproxy/proxy.go#LL156C31-L156C31
+            if (!proxyAddress.StartsWith("http://", StringComparison.Ordinal) && !proxyAddress.StartsWith("https://", StringComparison.Ordinal))
+            {
+                var prependedProxyAddress = "http://" + proxyAddress;
+                if (Uri.TryCreate(prependedProxyAddress, UriKind.Absolute, out var _))
+                {
+                    // if prepending http:// turns the proxyAddress into a valid Uri, then use that
+                    return prependedProxyAddress;
+                }
+            }
+            return proxyAddress;
+        }
     }
 }

src/Runner.Sdk/Util/ArgUtil.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.IO;
 
 namespace GitHub.Runner.Sdk

src/Runner.Sdk/Util/IOUtil.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.IO;
@@ -40,10 +40,19 @@ namespace GitHub.Runner.Sdk
             File.WriteAllText(path, StringUtil.ConvertToJson(obj), Encoding.UTF8);
         }
 
-        public static T LoadObject<T>(string path)
+        public static T LoadObject<T>(string path, bool required = false)
         {
             string json = File.ReadAllText(path, Encoding.UTF8);
-            return StringUtil.ConvertFromJson<T>(json);
+            if (required && string.IsNullOrEmpty(json))
+            {
+                throw new ArgumentNullException($"File {path} is empty");
+            }
+            T result = StringUtil.ConvertFromJson<T>(json);
+            if (required && result == null)
+            {
+                throw new ArgumentException("Converting json to object resulted in a null value");
+            }
+            return result;
         }
 
         public static string GetSha256Hash(string path)

src/Runner.Sdk/Util/PathUtil.cs

@@ -1,4 +1,4 @@
-using System.IO;
+using System.IO;
 
 namespace GitHub.Runner.Sdk
 {

src/Runner.Sdk/Util/StringUtil.cs

@@ -1,4 +1,4 @@
-using GitHub.Services.WebApi;
+using GitHub.Services.WebApi;
 using Newtonsoft.Json;
 using System;
 using System.Globalization;

src/Runner.Sdk/Util/UrlUtil.cs

@@ -11,10 +11,11 @@ namespace GitHub.Runner.Sdk
                 return false;
             }
 
-            return 
+            return
                 string.Equals(gitHubUrl.Host, "github.com", StringComparison.OrdinalIgnoreCase) ||
                 string.Equals(gitHubUrl.Host, "www.github.com", StringComparison.OrdinalIgnoreCase) ||
                 string.Equals(gitHubUrl.Host, "github.localhost", StringComparison.OrdinalIgnoreCase) ||
+                gitHubUrl.Host.EndsWith(".ghe.localhost", StringComparison.OrdinalIgnoreCase) ||
                 gitHubUrl.Host.EndsWith(".ghe.com", StringComparison.OrdinalIgnoreCase);
         }
 

src/Runner.Sdk/Util/VssUtil.cs

@@ -64,7 +64,7 @@ namespace GitHub.Runner.Sdk
 
             if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("USE_BROKER_FLOW")))
             {
-                settings.AllowAutoRedirect = true;
+                settings.AllowAutoRedirectForBroker = true;
             }
 
             // Remove Invariant from the list of accepted languages.

src/Runner.Sdk/Util/WhichUtil.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.IO;
 using System.Linq;
 
@@ -60,7 +60,7 @@ namespace GitHub.Runner.Sdk
                             trace?.Verbose(ex.ToString());
                         }
 
-                        if (matches != null && matches.Length > 0)
+                        if (matches != null && matches.Length > 0 && IsPathValid(matches.First(), trace))
                         {
                             trace?.Info($"Location: '{matches.First()}'");
                             return matches.First();
@@ -86,7 +86,7 @@ namespace GitHub.Runner.Sdk
                             for (int i = 0; i < pathExtSegments.Length; i++)
                             {
                                 string fullPath = Path.Combine(pathSegment, $"{command}{pathExtSegments[i]}");
-                                if (matches.Any(p => p.Equals(fullPath, StringComparison.OrdinalIgnoreCase)))
+                                if (matches.Any(p => p.Equals(fullPath, StringComparison.OrdinalIgnoreCase)) && IsPathValid(fullPath, trace))
                                 {
                                     trace?.Info($"Location: '{fullPath}'");
                                     return fullPath;
@@ -105,7 +105,7 @@ namespace GitHub.Runner.Sdk
                         trace?.Verbose(ex.ToString());
                     }
 
-                    if (matches != null && matches.Length > 0)
+                    if (matches != null && matches.Length > 0 && IsPathValid(matches.First(), trace))
                     {
                         trace?.Info($"Location: '{matches.First()}'");
                         return matches.First();
@@ -128,5 +128,15 @@ namespace GitHub.Runner.Sdk
 
             return null;
         }
+
+        // checks if the file is a symlink and if the symlink`s target exists.
+        private static bool IsPathValid(string path, ITraceWriter trace = null)
+        {
+            var fileInfo = new FileInfo(path);
+            var linkTargetFullPath = fileInfo.Directory?.FullName + Path.DirectorySeparatorChar + fileInfo.LinkTarget;
+            if (fileInfo.LinkTarget == null || File.Exists(linkTargetFullPath) || File.Exists(fileInfo.LinkTarget)) return true;
+            trace?.Info($"the target '{fileInfo.LinkTarget}' of the symbolic link '{path}', does not exist");
+            return false;
+        }
     }
 }

src/Runner.Service/Windows/Program.cs

@@ -36,7 +36,7 @@ namespace RunnerService
                 catch (Win32Exception ex)
                 {
                     Console.WriteLine("[ERROR] Unable to create '{0}' event source under 'Application' event log.", RunnerService.EventSourceName);
-                    Console.WriteLine("[ERROR] {0}",ex.Message);
+                    Console.WriteLine("[ERROR] {0}", ex.Message);
                     Console.WriteLine("[ERROR] Error Code: {0}", ex.ErrorCode);
                     return 1;
                 }

src/Runner.Worker/ActionCommandManager.cs

@@ -276,7 +276,7 @@ namespace GitHub.Runner.Worker
                         Message = $"Can't update {blocked} environment variable using ::set-env:: command."
                     };
                     issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = $"{Constants.Runner.UnsupportedCommand}_{envName}";
-                    context.AddIssue(issue);
+                    context.AddIssue(issue, ExecutionContextLogOptions.Default);
 
                     return;
                 }
@@ -315,7 +315,7 @@ namespace GitHub.Runner.Worker
                     Message = String.Format(Constants.Runner.UnsupportedCommandMessage, this.Command)
                 };
                 issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.UnsupportedCommand;
-                context.AddIssue(issue);
+                context.AddIssue(issue, ExecutionContextLogOptions.Default);
             }
 
             if (!command.Properties.TryGetValue(SetOutputCommandProperties.Name, out string outputName) || string.IsNullOrEmpty(outputName))
@@ -350,7 +350,7 @@ namespace GitHub.Runner.Worker
                     Message = String.Format(Constants.Runner.UnsupportedCommandMessage, this.Command)
                 };
                 issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.UnsupportedCommand;
-                context.AddIssue(issue);
+                context.AddIssue(issue, ExecutionContextLogOptions.Default);
             }
 
             if (!command.Properties.TryGetValue(SaveStateCommandProperties.Name, out string stateName) || string.IsNullOrEmpty(stateName))
@@ -666,7 +666,7 @@ namespace GitHub.Runner.Worker
                 }
             }
 
-            context.AddIssue(issue);
+            context.AddIssue(issue, ExecutionContextLogOptions.Default);
         }
 
         public static void ValidateLinesAndColumns(ActionCommand command, IExecutionContext context)

src/Runner.Worker/ActionManager.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.IO.Compression;
@@ -11,12 +11,14 @@ using System.Threading;
 using System.Threading.Tasks;
 using GitHub.DistributedTask.ObjectTemplating.Tokens;
 using GitHub.Runner.Common;
+using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
 using GitHub.Runner.Worker.Container;
 using GitHub.Services.Common;
 using WebApi = GitHub.DistributedTask.WebApi;
 using Pipelines = GitHub.DistributedTask.Pipelines;
 using PipelineTemplateConstants = GitHub.DistributedTask.Pipelines.ObjectTemplating.PipelineTemplateConstants;
+using GitHub.DistributedTask.WebApi;
 
 namespace GitHub.Runner.Worker
 {
@@ -100,7 +102,19 @@ namespace GitHub.Runner.Worker
             }
             IEnumerable<Pipelines.ActionStep> actions = steps.OfType<Pipelines.ActionStep>();
             executionContext.Output("Prepare all required actions");
-            var result = await PrepareActionsRecursiveAsync(executionContext, state, actions, depth, rootStepId);
+            PrepareActionsState result = new PrepareActionsState();
+            try
+            {
+                result = await PrepareActionsRecursiveAsync(executionContext, state, actions, depth, rootStepId);
+            }
+            catch (FailedToResolveActionDownloadInfoException ex)
+            {
+                // Log the error and fail the PrepareActionsAsync Initialization.
+                Trace.Error($"Caught exception from PrepareActionsAsync Initialization: {ex}");
+                executionContext.InfrastructureError(ex.Message);
+                executionContext.Result = TaskResult.Failed;
+                throw;
+            }
             if (!FeatureManager.IsContainerHooksEnabled(executionContext.Global.Variables))
             {
                 if (state.ImagesToPull.Count > 0)
@@ -303,15 +317,28 @@ namespace GitHub.Runner.Worker
 
             if (action.Reference.Type == Pipelines.ActionSourceType.ContainerRegistry)
             {
-                Trace.Info("Load action that reference container from registry.");
-                CachedActionContainers.TryGetValue(action.Id, out var container);
-                ArgUtil.NotNull(container, nameof(container));
-                definition.Data.Execution = new ContainerActionExecutionData()
+                if (FeatureManager.IsContainerHooksEnabled(executionContext.Global.Variables))
                 {
-                    Image = container.ContainerImage
-                };
+                    Trace.Info("Load action that will run container through container hooks.");
+                    var containerAction = action.Reference as Pipelines.ContainerRegistryReference;
+                    definition.Data.Execution = new ContainerActionExecutionData()
+                    {
+                        Image = containerAction.Image,
+                    };
+                    Trace.Info($"Using action container image: {containerAction.Image}.");
+                }
+                else
+                {
+                    Trace.Info("Load action that reference container from registry.");
+                    CachedActionContainers.TryGetValue(action.Id, out var container);
+                    ArgUtil.NotNull(container, nameof(container));
+                    definition.Data.Execution = new ContainerActionExecutionData()
+                    {
+                        Image = container.ContainerImage
+                    };
 
-                Trace.Info($"Using action container image: {container.ContainerImage}.");
+                    Trace.Info($"Using action container image: {container.ContainerImage}.");
+                }
             }
             else if (action.Reference.Type == Pipelines.ActionSourceType.Repository)
             {
@@ -648,13 +675,21 @@ namespace GitHub.Runner.Worker
             }
 
             // Resolve download info
+            var launchServer = HostContext.GetService<ILaunchServer>();
             var jobServer = HostContext.GetService<IJobServer>();
             var actionDownloadInfos = default(WebApi.ActionDownloadInfoCollection);
             for (var attempt = 1; attempt <= 3; attempt++)
             {
                 try
                 {
-                    actionDownloadInfos = await jobServer.ResolveActionDownloadInfoAsync(executionContext.Global.Plan.ScopeIdentifier, executionContext.Global.Plan.PlanType, executionContext.Global.Plan.PlanId, executionContext.Root.Id, new WebApi.ActionReferenceList { Actions = actionReferences }, executionContext.CancellationToken);
+                    if (MessageUtil.IsRunServiceJob(executionContext.Global.Variables.Get(Constants.Variables.System.JobRequestType)))
+                    {
+                        actionDownloadInfos = await launchServer.ResolveActionsDownloadInfoAsync(executionContext.Global.Plan.PlanId, executionContext.Root.Id, new WebApi.ActionReferenceList { Actions = actionReferences }, executionContext.CancellationToken);
+                    }
+                    else
+                    {
+                        actionDownloadInfos = await jobServer.ResolveActionDownloadInfoAsync(executionContext.Global.Plan.ScopeIdentifier, executionContext.Global.Plan.PlanType, executionContext.Global.Plan.PlanId, executionContext.Root.Id, new WebApi.ActionReferenceList { Actions = actionReferences }, executionContext.CancellationToken);
+                    }
                     break;
                 }
                 catch (Exception ex) when (!executionContext.CancellationToken.IsCancellationRequested) // Do not retry if the run is cancelled.
@@ -1007,7 +1042,7 @@ namespace GitHub.Runner.Worker
                 if (actionDefinitionData.Execution.ExecutionType == ActionExecutionType.Container)
                 {
                     var containerAction = actionDefinitionData.Execution as ContainerActionExecutionData;
-                    if (containerAction.Image.EndsWith("Dockerfile") || containerAction.Image.EndsWith("dockerfile"))
+                    if (DockerUtil.IsDockerfile(containerAction.Image))
                     {
                         var dockerFileFullPath = Path.Combine(actionEntryDirectory, containerAction.Image);
                         executionContext.Debug($"Dockerfile for action: '{dockerFileFullPath}'.");
@@ -1092,8 +1127,16 @@ namespace GitHub.Runner.Worker
             }
             else
             {
-                var fullPath = IOUtil.ResolvePath(actionEntryDirectory, "."); // resolve full path without access filesystem.
-                throw new InvalidOperationException($"Can't find 'action.yml', 'action.yaml' or 'Dockerfile' under '{fullPath}'. Did you forget to run actions/checkout before running your local action?");
+                var reference = repositoryReference.Name;
+                if (!string.IsNullOrEmpty(repositoryReference.Path))
+                {
+                    reference = $"{reference}/{repositoryReference.Path}";
+                }
+                if (!string.IsNullOrEmpty(repositoryReference.Ref))
+                {
+                    reference = $"{reference}@{repositoryReference.Ref}";
+                }
+                throw new InvalidOperationException($"Can't find 'action.yml', 'action.yaml' or 'Dockerfile' for action '{reference}'.");
             }
         }
 

src/Runner.Worker/ActionManifestManager.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Threading;
@@ -448,7 +448,7 @@ namespace GitHub.Runner.Worker
                         };
                     }
                 }
-                else if (string.Equals(usingToken.Value, "node12", StringComparison.OrdinalIgnoreCase)||
+                else if (string.Equals(usingToken.Value, "node12", StringComparison.OrdinalIgnoreCase) ||
                          string.Equals(usingToken.Value, "node16", StringComparison.OrdinalIgnoreCase))
                 {
                     if (string.IsNullOrEmpty(mainToken?.Value))

src/Runner.Worker/ActionNotFoundException.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Runtime.Serialization;
 
 namespace GitHub.Runner.Worker
@@ -30,4 +30,4 @@ namespace GitHub.Runner.Worker
             return $"An action could not be found at the URI '{actionUri}'";
         }
     }
-}
+}

src/Runner.Worker/ActionRunner.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Threading.Tasks;
 using GitHub.DistributedTask.ObjectTemplating;

src/Runner.Worker/ConditionTraceWriter.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Text;
 using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;

src/Runner.Worker/Container/ContainerHooks/HookInput.cs

@@ -1,4 +1,4 @@
-using System.Collections.Generic;
+using System.Collections.Generic;
 using System.Runtime.Serialization;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Converters;
@@ -83,7 +83,7 @@ namespace GitHub.Runner.Worker.Container.ContainerHooks
         public HookContainer(ContainerInfo container)
         {
             Image = container.ContainerImage;
-            EntryPointArgs = container.ContainerEntryPointArgs?.Split(' ').Select(arg => arg.Trim()) ?? new List<string>();
+            EntryPointArgs = container.ContainerEntryPointArgs?.Split(' ').Select(arg => arg.Trim()).Where(arg => !string.IsNullOrEmpty(arg)) ?? new List<string>();
             EntryPoint = container.ContainerEntryPoint;
             WorkingDirectory = container.ContainerWorkDirectory;
             CreateOptions = container.ContainerCreateOptions;

src/Runner.Worker/Container/ContainerHooks/HookResponse.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using Newtonsoft.Json.Linq;
 

src/Runner.Worker/Container/DockerUtil.cs

@@ -1,5 +1,6 @@
-using System;
+using System;
 using System.Collections.Generic;
+using System.Linq;
 using System.Text.RegularExpressions;
 
 namespace GitHub.Runner.Worker.Container
@@ -65,6 +66,16 @@ namespace GitHub.Runner.Worker.Container
             return "";
         }
 
+        public static bool IsDockerfile(string image)
+        {
+            if (image.StartsWith("docker://", StringComparison.OrdinalIgnoreCase))
+            {
+                return false;
+            }
+            var imageWithoutPath = image.Split('/').Last();
+            return imageWithoutPath.StartsWith("Dockerfile.", StringComparison.OrdinalIgnoreCase) || imageWithoutPath.EndsWith("Dockerfile", StringComparison.OrdinalIgnoreCase);
+        }
+
         public static string CreateEscapedOption(string flag, string key)
         {
             if (String.IsNullOrEmpty(key))
@@ -96,7 +107,7 @@ namespace GitHub.Runner.Worker.Container
             // https://docs.microsoft.com/en-us/dotnet/api/system.environment.getcommandlineargs?redirectedfrom=MSDN&view=net-6.0#remarks
 
             // First, find any \ followed by a " and double the number of \ + 1.
-             value = QuoteEscape.Replace(value, @"$1$1\" + "\"");
+            value = QuoteEscape.Replace(value, @"$1$1\" + "\"");
             // Next, what if it ends in `\`, it would escape the end quote. So, we need to detect that at the end of the string and perform the same escape
             // Luckily, we can just use the $ character with detects the end of string in regex
             value = EndOfStringEscape.Replace(value, @"$1$1");

src/Runner.Worker/DiagnosticLogManager.cs

@@ -32,7 +32,7 @@ namespace GitHub.Runner.Worker
     {
         private static string DateTimeFormat = "yyyyMMdd-HHmmss";
         public void UploadDiagnosticLogs(IExecutionContext executionContext,
-                                         IExecutionContext parentContext, 
+                                         IExecutionContext parentContext,
                                          Pipelines.AgentJobRequestMessage message,
                                          DateTime jobStartTimeUtc)
         {

src/Runner.Worker/ExecutionContext.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Globalization;
 using System.IO;
@@ -18,15 +18,22 @@ using GitHub.Runner.Sdk;
 using GitHub.Runner.Worker.Container;
 using GitHub.Runner.Worker.Handlers;
 using Newtonsoft.Json;
+using Sdk.RSWebApi.Contracts;
 using ObjectTemplating = GitHub.DistributedTask.ObjectTemplating;
 using Pipelines = GitHub.DistributedTask.Pipelines;
 
 namespace GitHub.Runner.Worker
 {
-    public class ExecutionContextType
+    public static class ExecutionContextType
     {
-        public static string Job = "Job";
-        public static string Task = "Task";
+        public const string Job = "Job";
+        public const string Task = "Task";
+    }
+
+    public record ExecutionContextLogOptions(bool WriteToLog, string LogMessageOverride)
+    {
+        public static readonly ExecutionContextLogOptions None = new(false, null);
+        public static readonly ExecutionContextLogOptions Default = new(true, null);
     }
 
     [ServiceLocator(Default = typeof(ExecutionContext))]
@@ -92,7 +99,7 @@ namespace GitHub.Runner.Worker
         void SetGitHubContext(string name, string value);
         void SetOutput(string name, string value, out string reference);
         void SetTimeout(TimeSpan? timeout);
-        void AddIssue(Issue issue, string message = null);
+        void AddIssue(Issue issue, ExecutionContextLogOptions logOptions);
         void Progress(int percentage, string currentOperation = null);
         void UpdateDetailTimelineRecord(TimelineRecord record);
 
@@ -118,7 +125,7 @@ namespace GitHub.Runner.Worker
 
     public sealed class ExecutionContext : RunnerService, IExecutionContext
     {
-        private const int _maxIssueCount = 10;
+        private const int _maxCountPerIssueType = 10;
         private const int _throttlingDelayReportThreshold = 10 * 1000; // Don't report throttling with less than 10 seconds delay
         private const int _maxIssueMessageLength = 4096; // Don't send issue with huge message since we can't forward them from actions to check annotation.
         private const int _maxIssueCountInTelemetry = 3; // Only send the first 3 issues to telemetry
@@ -126,8 +133,10 @@ namespace GitHub.Runner.Worker
 
         private readonly TimelineRecord _record = new();
         private readonly Dictionary<Guid, TimelineRecord> _detailRecords = new();
+        private readonly List<Issue> _embeddedIssueCollector;
         private readonly object _loggerLock = new();
         private readonly object _matchersLock = new();
+        private readonly ExecutionContext _parentExecutionContext;
 
         private event OnMatcherChanged _onMatcherChanged;
 
@@ -135,7 +144,6 @@ namespace GitHub.Runner.Worker
 
         private IPagingLogger _logger;
         private IJobServerQueue _jobServerQueue;
-        private ExecutionContext _parentExecutionContext;
 
         private Guid _mainTimelineId;
         private Guid _detailTimelineId;
@@ -149,6 +157,29 @@ namespace GitHub.Runner.Worker
         private long _totalThrottlingDelayInMilliseconds = 0;
         private bool _stepTelemetryPublished = false;
 
+        public ExecutionContext()
+            : this(parent: null, embedded: false)
+        {
+        }
+
+        private ExecutionContext(ExecutionContext parent, bool embedded)
+        {
+            if (embedded)
+            {
+                ArgUtil.NotNull(parent, nameof(parent));
+            }
+
+            _parentExecutionContext = parent;
+            this.IsEmbedded = embedded;
+            this.StepTelemetry = new ActionsStepTelemetry
+            {
+                IsEmbedded = embedded
+            };
+
+            //Embedded Execution Contexts pseudo-inherit their parent's embeddedIssueCollector.
+            _embeddedIssueCollector = embedded ? parent._embeddedIssueCollector : new();
+        }
+
         public Guid Id => _record.Id;
         public Guid EmbeddedId { get; private set; }
         public string ScopeName { get; private set; }
@@ -161,7 +192,7 @@ namespace GitHub.Runner.Worker
         public Dictionary<string, VariableValue> JobOutputs { get; private set; }
 
         public ActionsEnvironmentReference ActionsEnvironment { get; private set; }
-        public ActionsStepTelemetry StepTelemetry { get; } = new ActionsStepTelemetry();
+        public ActionsStepTelemetry StepTelemetry { get; private init; }
         public DictionaryContextData ExpressionValues { get; } = new DictionaryContextData();
         public IList<IFunctionInfo> ExpressionFunctions { get; } = new List<IFunctionInfo>();
 
@@ -186,7 +217,7 @@ namespace GitHub.Runner.Worker
 
         // An embedded execution context shares the same record ID, record name, and logger
         // as its enclosing execution context.
-        public bool IsEmbedded { get; private set; }
+        public bool IsEmbedded { get; private init; }
 
         public TaskResult? Result
         {
@@ -321,7 +352,7 @@ namespace GitHub.Runner.Worker
         {
             Trace.Entering();
 
-            var child = new ExecutionContext();
+            var child = new ExecutionContext(this, isEmbedded);
             child.Initialize(HostContext);
             child.Global = Global;
             child.ScopeName = scopeName;
@@ -346,7 +377,6 @@ namespace GitHub.Runner.Worker
                 child.ExpressionFunctions.Add(item);
             }
             child._cancellationTokenSource = cancellationTokenSource ?? new CancellationTokenSource();
-            child._parentExecutionContext = this;
             child.EchoOnActionCommand = EchoOnActionCommand;
 
             if (recordOrder != null)
@@ -367,11 +397,9 @@ namespace GitHub.Runner.Worker
                 child._logger.Setup(_mainTimelineId, recordId);
             }
 
-            child.IsEmbedded = isEmbedded;
             child.StepTelemetry.StepId = recordId;
             child.StepTelemetry.Stage = stage.ToString();
-            child.StepTelemetry.IsEmbedded = isEmbedded;
-            child.StepTelemetry.StepContextName = child.GetFullyQualifiedContextName(); ;
+            child.StepTelemetry.StepContextName = child.GetFullyQualifiedContextName();
 
             return child;
         }
@@ -413,13 +441,24 @@ namespace GitHub.Runner.Worker
                 this.Warning($"The job has experienced {TimeSpan.FromMilliseconds(_totalThrottlingDelayInMilliseconds).TotalSeconds} seconds total delay caused by server throttling.");
             }
 
+            DateTime now = DateTime.UtcNow;
             _record.CurrentOperation = currentOperation ?? _record.CurrentOperation;
             _record.ResultCode = resultCode ?? _record.ResultCode;
-            _record.FinishTime = DateTime.UtcNow;
+            _record.FinishTime = now;
             _record.PercentComplete = 100;
             _record.Result = _record.Result ?? TaskResult.Succeeded;
             _record.State = TimelineRecordState.Completed;
 
+            // Before our main timeline's final QueueTimelineRecordUpdate,
+            //    inject any issues collected by embedded ExecutionContexts.
+            if (!this.IsEmbedded)
+            {
+                foreach (var issue in _embeddedIssueCollector)
+                {
+                    AddIssue(issue, ExecutionContextLogOptions.None);
+                }
+            }
+
             _jobServerQueue.QueueTimelineRecordUpdate(_mainTimelineId, _record);
 
             // complete all detail timeline records.
@@ -427,7 +466,7 @@ namespace GitHub.Runner.Worker
             {
                 foreach (var record in _detailRecords)
                 {
-                    record.Value.FinishTime = record.Value.FinishTime ?? DateTime.UtcNow;
+                    record.Value.FinishTime = record.Value.FinishTime ?? now;
                     record.Value.PercentComplete = record.Value.PercentComplete ?? 100;
                     record.Value.Result = record.Value.Result ?? TaskResult.Succeeded;
                     record.Value.State = TimelineRecordState.Completed;
@@ -438,16 +477,32 @@ namespace GitHub.Runner.Worker
 
             PublishStepTelemetry();
 
-            var stepResult = new StepResult();
-            stepResult.ExternalID = _record.Id;
-            stepResult.Conclusion = _record.Result ?? TaskResult.Succeeded;
-            stepResult.Status = _record.State;
-            stepResult.Number = _record.Order;
-            stepResult.Name = _record.Name;
-            stepResult.StartedAt = _record.StartTime;
-            stepResult.CompletedAt = _record.FinishTime;
+            if (_record.RecordType == "Task")
+            {
+                var stepResult = new StepResult
+                {
+                    ExternalID = _record.Id,
+                    Conclusion = _record.Result ?? TaskResult.Succeeded,
+                    Status = _record.State,
+                    Number = _record.Order,
+                    Name = _record.Name,
+                    StartedAt = _record.StartTime,
+                    CompletedAt = _record.FinishTime,
+                    Annotations = new List<Annotation>()
+                };
+
+                _record.Issues?.ForEach(issue =>
+                {
+                    var annotation = issue.ToAnnotation();
+                    if (annotation != null)
+                    {
+                        stepResult.Annotations.Add(annotation.Value);
+                    }
+                });
+
+                Global.StepsResult.Add(stepResult);
+            }
 
-            Global.StepsResult.Add(stepResult);
 
             if (Root != this)
             {
@@ -559,14 +614,10 @@ namespace GitHub.Runner.Worker
         }
 
         // This is not thread safe, the caller need to take lock before calling issue()
-        public void AddIssue(Issue issue, string logMessage = null)
+        public void AddIssue(Issue issue, ExecutionContextLogOptions logOptions)
         {
             ArgUtil.NotNull(issue, nameof(issue));
-
-            if (string.IsNullOrEmpty(logMessage))
-            {
-                logMessage = issue.Message;
-            }
+            ArgUtil.NotNull(logOptions, nameof(logOptions));
 
             issue.Message = HostContext.SecretMasker.MaskSecrets(issue.Message);
             if (issue.Message.Length > _maxIssueMessageLength)
@@ -581,53 +632,64 @@ namespace GitHub.Runner.Worker
                 issue.Data["stepNumber"] = _record.Order.ToString();
             }
 
-            if (issue.Type == IssueType.Error)
+            string wellKnownTag = null;
+            Int32 previousCountForIssueType = 0;
+            Action incrementIssueTypeCount = NoOp;
+            switch (issue.Type)
             {
-                if (!string.IsNullOrEmpty(logMessage))
-                {
-                    long logLineNumber = Write(WellKnownTags.Error, logMessage);
-                    issue.Data["logFileLineNumber"] = logLineNumber.ToString();
-                }
+                case IssueType.Error:
+                    wellKnownTag = WellKnownTags.Error;
+                    previousCountForIssueType = _record.ErrorCount;
+                    incrementIssueTypeCount = () => { _record.ErrorCount++; };
+                    break;
+                case IssueType.Warning:
+                    wellKnownTag = WellKnownTags.Warning;
+                    previousCountForIssueType = _record.WarningCount;
+                    incrementIssueTypeCount = () => { _record.WarningCount++; };
+                    break;
+                case IssueType.Notice:
+                    wellKnownTag = WellKnownTags.Notice;
+                    previousCountForIssueType = _record.NoticeCount;
+                    incrementIssueTypeCount = () => { _record.NoticeCount++; };
+                    break;
+            }
 
-                if (_record.ErrorCount < _maxIssueCount)
+            if (!string.IsNullOrEmpty(wellKnownTag))
+            {
+                if (!this.IsEmbedded && previousCountForIssueType < _maxCountPerIssueType)
                 {
+                    incrementIssueTypeCount();
                     _record.Issues.Add(issue);
                 }
 
-                _record.ErrorCount++;
+                if (logOptions.WriteToLog)
+                {
+                    string logMessage = issue.Message;
+                    if (!string.IsNullOrEmpty(logOptions.LogMessageOverride))
+                    {
+                        logMessage = logOptions.LogMessageOverride;
+                    }
+
+                    if (!string.IsNullOrEmpty(logMessage))
+                    {
+                        // Note that ::Write() has its own secret-masking logic.
+                        long logLineNumber = Write(wellKnownTag, logMessage);
+                        issue.Data["logFileLineNumber"] = logLineNumber.ToString();
+                    }
+                }
             }
-            else if (issue.Type == IssueType.Warning)
+
+            // Embedded ExecutionContexts (a.k.a. Composite actions) should never upload a timeline record to the server.
+            //    Instead, we store processed issues on a shared (psuedo-inherited) list (belonging to the closest
+            //    non-embedded ancestor ExecutionContext) so that they can be processed when that ancestor completes.
+            if (this.IsEmbedded)
             {
-                if (!string.IsNullOrEmpty(logMessage))
-                {
-                    long logLineNumber = Write(WellKnownTags.Warning, logMessage);
-                    issue.Data["logFileLineNumber"] = logLineNumber.ToString();
-                }
-
-                if (_record.WarningCount < _maxIssueCount)
-                {
-                    _record.Issues.Add(issue);
-                }
-
-                _record.WarningCount++;
+                _embeddedIssueCollector.Add(issue);
             }
-            else if (issue.Type == IssueType.Notice)
+            else
             {
-                if (!string.IsNullOrEmpty(logMessage))
-                {
-                    long logLineNumber = Write(WellKnownTags.Notice, logMessage);
-                    issue.Data["logFileLineNumber"] = logLineNumber.ToString();
-                }
-
-                if (_record.NoticeCount < _maxIssueCount)
-                {
-                    _record.Issues.Add(issue);
-                }
-
-                _record.NoticeCount++;
+                _jobServerQueue.QueueTimelineRecordUpdate(_mainTimelineId, _record);
             }
-
-            _jobServerQueue.QueueTimelineRecordUpdate(_mainTimelineId, _record);
         }
 
         public void UpdateDetailTimelineRecord(TimelineRecord record)
@@ -725,6 +787,9 @@ namespace GitHub.Runner.Worker
             // Steps results for entire job
             Global.StepsResult = new List<StepResult>();
 
+            // Job level annotations
+            Global.JobAnnotations = new List<Annotation>();
+
             // Job Outputs
             JobOutputs = new Dictionary<string, VariableValue>(StringComparer.OrdinalIgnoreCase);
 
@@ -741,6 +806,9 @@ namespace GitHub.Runner.Worker
             // File table
             Global.FileTable = new List<String>(message.FileTable ?? new string[0]);
 
+            // What type of job request is running (i.e. Run Service vs. pipelines)
+            Global.Variables.Set(Constants.Variables.System.JobRequestType, message.MessageType);
+
             // Expression values
             if (message.ContextData?.Count > 0)
             {
@@ -995,8 +1063,7 @@ namespace GitHub.Runner.Worker
                         StepTelemetry.FinishTime = _record.FinishTime;
                     }
 
-                    if (!IsEmbedded &&
-                        _record.Issues.Count > 0)
+                    if (!IsEmbedded)
                     {
                         foreach (var issue in _record.Issues)
                         {
@@ -1162,6 +1229,11 @@ namespace GitHub.Runner.Worker
 
             UpdateGlobalStepsContext();
         }
+
+        private static void NoOp()
+        {
+        }
+
     }
 
     // The Error/Warning/etc methods are created as extension methods to simplify unit testing.
@@ -1186,19 +1258,22 @@ namespace GitHub.Runner.Worker
         // Do not add a format string overload. See comment on ExecutionContext.Write().
         public static void Error(this IExecutionContext context, string message)
         {
-            context.AddIssue(new Issue() { Type = IssueType.Error, Message = message });
+            var issue = new Issue() { Type = IssueType.Error, Message = message };
+            context.AddIssue(issue, ExecutionContextLogOptions.Default);
         }
 
         // Do not add a format string overload. See comment on ExecutionContext.Write().
         public static void InfrastructureError(this IExecutionContext context, string message)
         {
-            context.AddIssue(new Issue() { Type = IssueType.Error, Message = message, IsInfrastructureIssue = true });
+            var issue = new Issue() { Type = IssueType.Error, Message = message, IsInfrastructureIssue = true };
+            context.AddIssue(issue, ExecutionContextLogOptions.Default);
         }
 
         // Do not add a format string overload. See comment on ExecutionContext.Write().
         public static void Warning(this IExecutionContext context, string message)
         {
-            context.AddIssue(new Issue() { Type = IssueType.Warning, Message = message });
+            var issue = new Issue() { Type = IssueType.Warning, Message = message };
+            context.AddIssue(issue, ExecutionContextLogOptions.Default);
         }
 
         // Do not add a format string overload. See comment on ExecutionContext.Write().
@@ -1284,6 +1359,12 @@ namespace GitHub.Runner.Worker
         {
             foreach (var key in dict.Keys.ToList())
             {
+                if (key == PipelineTemplateConstants.HostWorkspace)
+                {
+                    // The HostWorkspace context var is excluded so that there is a var that always points to the host path. 
+                    // This var can be used to translate back from container paths, e.g. in HashFilesFunction, which always runs on the host machine
+                    continue;
+                }
                 if (dict[key] is StringContextData)
                 {
                     var value = dict[key].ToString();
@@ -1330,7 +1411,15 @@ namespace GitHub.Runner.Worker
 
         public void Error(string format, params Object[] args)
         {
-            _executionContext.Error(string.Format(CultureInfo.CurrentCulture, format, args));
+            /* TraceWriter should be used for logging and not creating erros. */
+            if (logTemplateErrorsAsDebugMessages())
+            {
+                _executionContext.Debug(string.Format(CultureInfo.CurrentCulture, format, args));
+            }
+            else
+            {
+                _executionContext.Error(string.Format(CultureInfo.CurrentCulture, format, args));
+            }
         }
 
         public void Info(string format, params Object[] args)
@@ -1343,8 +1432,18 @@ namespace GitHub.Runner.Worker
             // todo: switch to verbose?
             _executionContext.Debug(string.Format(CultureInfo.CurrentCulture, $"{format}", args));
         }
+
+        private bool logTemplateErrorsAsDebugMessages()
+        {
+            if (_executionContext.Global.EnvironmentVariables.TryGetValue(Constants.Runner.Features.LogTemplateErrorsAsDebugMessages, out var logErrorsAsDebug))
+            {
+                return StringUtil.ConvertToBoolean(logErrorsAsDebug, defaultValue: false);
+            }
+            return false;
+        }
     }
 
+
     public static class WellKnownTags
     {
         public static readonly string Section = "##[section]";

src/Runner.Worker/Expressions/HashFilesFunction.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.IO;
 using GitHub.DistributedTask.Expressions2.Sdk;
 using GitHub.DistributedTask.Pipelines.ContextData;
@@ -26,11 +26,18 @@ namespace GitHub.Runner.Worker.Expressions
             ArgUtil.NotNull(githubContextData, nameof(githubContextData));
             var githubContext = githubContextData as DictionaryContextData;
             ArgUtil.NotNull(githubContext, nameof(githubContext));
-            githubContext.TryGetValue(PipelineTemplateConstants.Workspace, out var workspace);
+
+            if (!githubContext.TryGetValue(PipelineTemplateConstants.HostWorkspace, out var workspace))
+            {
+                githubContext.TryGetValue(PipelineTemplateConstants.Workspace, out workspace);
+            }
+            ArgUtil.NotNull(workspace, nameof(workspace));
+
             var workspaceData = workspace as StringContextData;
             ArgUtil.NotNull(workspaceData, nameof(workspaceData));
 
             string githubWorkspace = workspaceData.Value;
+
             bool followSymlink = false;
             List<string> patterns = new();
             var firstParameter = true;
@@ -136,4 +143,4 @@ namespace GitHub.Runner.Worker.Expressions
             }
         }
     }
-}
+}

src/Runner.Worker/FileCommandManager.cs

@@ -1,4 +1,4 @@
-using GitHub.DistributedTask.WebApi;
+using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Worker.Container;
 using GitHub.Runner.Common;
 using System;
@@ -281,7 +281,7 @@ namespace GitHub.Runner.Worker
         }
     }
 
-    public sealed class EnvFileKeyValuePairs: IEnumerable<KeyValuePair<string, string>>
+    public sealed class EnvFileKeyValuePairs : IEnumerable<KeyValuePair<string, string>>
     {
         private IExecutionContext _context;
         private string _filePath;
@@ -322,21 +322,9 @@ namespace GitHub.Runner.Worker
                     var equalsIndex = line.IndexOf("=", StringComparison.Ordinal);
                     var heredocIndex = line.IndexOf("<<", StringComparison.Ordinal);
 
-                    // Normal style NAME=VALUE
-                    if (equalsIndex >= 0 && (heredocIndex < 0 || equalsIndex < heredocIndex))
-                    {
-                        var split = line.Split(new[] { '=' }, 2, StringSplitOptions.None);
-                        if (string.IsNullOrEmpty(line))
-                        {
-                            throw new Exception($"Invalid format '{line}'. Name must not be empty");
-                        }
-
-                        key = split[0];
-                        output = split[1];
-                    }
-
-                    // Heredoc style NAME<<EOF
-                    else if (heredocIndex >= 0 && (equalsIndex < 0 || heredocIndex < equalsIndex))
+                    // Heredoc style NAME<<EOF (where EOF is typically randomly-generated Base64 and may include an '=' character)
+                    // see https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
+                    if (heredocIndex >= 0 && (equalsIndex < 0 || heredocIndex < equalsIndex))
                     {
                         var split = line.Split(new[] { "<<" }, 2, StringSplitOptions.None);
                         if (string.IsNullOrEmpty(split[0]) || string.IsNullOrEmpty(split[1]))
@@ -364,6 +352,18 @@ namespace GitHub.Runner.Worker
 
                         output = endIndex > startIndex ? text.Substring(startIndex, endIndex - startIndex) : string.Empty;
                     }
+                    // Normal style NAME=VALUE
+                    else if (equalsIndex >= 0 && heredocIndex < 0)
+                    {
+                        var split = line.Split(new[] { '=' }, 2, StringSplitOptions.None);
+                        if (string.IsNullOrEmpty(line))
+                        {
+                            throw new Exception($"Invalid format '{line}'. Name must not be empty");
+                        }
+
+                        key = split[0];
+                        output = split[1];
+                    }
                     else
                     {
                         throw new Exception($"Invalid format '{line}'");