port hooklib to runner

.devcontainer/devcontainer.json

@@ -1,27 +0,0 @@
-{
-  "name": "Actions Runner Devcontainer",
-  "image": "mcr.microsoft.com/devcontainers/base:focal",
-  "features": {
-    "ghcr.io/devcontainers/features/docker-in-docker:1": {},
-    "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.413"
-    },
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "20"
-    },
-    "ghcr.io/devcontainers/features/sshd:1": {
-      "version": "latest"
-    }
-  },
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "ms-azuretools.vscode-docker",
-        "ms-dotnettools.csharp",
-        "eamodio.gitlens"
-      ]
-    }
-  },
-  "postCreateCommand": "dotnet restore src/Test && dotnet restore src/Runner.PluginHost",
-  "remoteUser": "vscode"
-}

.editorconfig

@@ -0,0 +1,8 @@
+# https://editorconfig.org/
+
+[*]
+insert_final_newline = true # ensure all files end with a single newline
+trim_trailing_whitespace = true # attempt to remove trailing whitespace on save
+
+[*.md]
+trim_trailing_whitespace = false # in markdown, "two trailing spaces" is unfortunately meaningful; it means `<br>`

.github/ISSUE_TEMPLATE/config.yml

@@ -1,13 +1,10 @@
 blank_issues_enabled: false
 contact_links:
-  - name: 🛑 Request a feature in the runner application
-    url: https://github.com/orgs/community/discussions/categories/actions-and-packages
-    about: If you have feature requests for GitHub Actions, please use the Actions and Packages section on the Github Product Feedback page.
   - name: ✅ Support for GitHub Actions
     url: https://github.community/c/code-to-cloud/52
     about: If you have questions about GitHub Actions or need support writing workflows, please ask in the GitHub Community Support forum.
   - name: ✅ Feedback and suggestions for GitHub Actions
-    url: https://github.com/github/feedback/discussions/categories/actions
+    url: https://github.com/github/feedback/discussions/categories/actions-and-packages-feedback
     about: If you have feedback or suggestions about GitHub Actions, please open a discussion (or add to an existing one) in the GitHub Actions Feedback.  GitHub Actions Product Managers and Engineers monitor the feedback forum.
   - name: ‼️ GitHub Security Bug Bounty
     url: https://bounty.github.com/

.github/ISSUE_TEMPLATE/enhancement_request.md

@@ -0,0 +1,32 @@
+---
+name: 🛑 Request a feature in the runner application 
+about: If you have feature requests for GitHub Actions, please use the "feedback and suggestions for GitHub Actions" link below.
+title: ''
+labels: enhancement
+assignees: ''
+
+---
+
+<!--
+👋 You're opening a request for an enhancement in the GitHub Actions **runner application**.
+
+🛑 Please stop if you're not certain that the feature you want is in the runner application - if you have a suggestion for improving GitHub Actions, please see the [GitHub Actions Feedback](https://github.com/github/feedback/discussions/categories/actions-and-packages-feedback) discussion forum which is actively monitored.  Using the forum ensures that we route your problem to the correct team.  😃
+
+Some additional useful links:
+* If you have found a security issue [please submit it here](https://hackerone.com/github)
+* If you have questions or issues with the service, writing workflows or actions, then please [visit the GitHub Community Forum's Actions Board](https://github.community/t5/GitHub-Actions/bd-p/actions)
+* If you are having an issue or have a question about GitHub Actions then please [contact customer support](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/about-github-actions#contacting-support)
+
+If you have a feature request that is relevant to this repository, the runner, then please include the information below:
+-->
+
+**Describe the enhancement**
+A clear and concise description of what the features or enhancement you need.
+
+**Code Snippet**
+If applicable, add a code snippet.
+
+**Additional information**
+Add any other context about the feature here.
+
+NOTE: if the feature request has been agreed upon then the assignee will create an ADR.   See docs/adrs/README.md

.github/copilot-instructions.md

@@ -1,25 +0,0 @@
-## Making changes
-
-### Tests
-
-Whenever possible, changes should be accompanied by non-trivial tests that meaningfully exercise the core functionality of the new code being introduced.
-
-All tests are in the `Test/` directory at the repo root. Fast unit tests are in the `Test/L0` directory and by convention have the suffix `L0.cs`. For example: unit tests for a hypothetical `src/Runner.Worker/Foo.cs` would go in `src/Test/L0/Worker/FooL0.cs`.
-
-Run tests using this command:
-
-```sh
-cd src && ./dev.sh test
-```
-
-### Formatting
-
-After editing .cs files, always format the code using this command:
-
-```sh
-cd src && ./dev.sh format
-```
-
-### Feature Flags
-
-Wherever possible, all changes should be safeguarded by a feature flag; `Features` are declared in [Constants.cs](src/Runner.Common/Constants.cs).

.github/dependabot.yml

@@ -1,25 +0,0 @@
-version: 2
-updates:
-- package-ecosystem: "docker"
-  directory: "/images"
-  schedule:
-    interval: "daily" 
-  target-branch: "main" 
-- package-ecosystem: "github-actions"
-  directory: "/"
-  schedule:
-    interval: "daily" 
-  target-branch: "main" 
-- package-ecosystem: "nuget"
-  directory: "/src"
-  schedule:
-    interval: "daily" 
-  target-branch: "main" 
-- package-ecosystem: "npm"
-  directory: "/src/Misc/expressionFunc/hashFiles"
-  schedule:
-    interval: "daily" 
-  target-branch: "main" 
-  allow:
-  - dependency-type: direct
-  - dependency-type: production # check only dependencies, which are going to the compiled app, not supporting tools like @vue-cli

.github/workflows/build.yml

@@ -10,7 +10,7 @@ on:
     - '**.md'
   pull_request:
     branches:
-    - '**'
+    - '*'
     paths-ignore:
     - '**.md'
 
@@ -18,7 +18,7 @@ jobs:
   build:
     strategy:
       matrix:
-        runtime: [ linux-x64, linux-arm64, linux-arm, win-x64, win-arm64, osx-x64, osx-arm64 ]
+        runtime: [ linux-x64, linux-arm64, linux-arm, win-x64, osx-x64, osx-arm64 ]
         include:
         - runtime: linux-x64
           os: ubuntu-latest
@@ -41,16 +41,12 @@ jobs:
           devScript: ./dev.sh
 
         - runtime: win-x64
-          os: windows-latest
-          devScript: ./dev
-
-        - runtime: win-arm64
-          os: windows-latest
+          os: windows-2019
           devScript: ./dev
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v3
 
     # Build runner layout
     - name: Build & Layout Release
@@ -58,25 +54,51 @@ jobs:
         ${{ matrix.devScript }} layout Release ${{ matrix.runtime }}
       working-directory: src
 
+    # Check runtime/externals hash
+    - name: Compute/Compare runtime and externals Hash
+      shell: bash
+      run: |
+        echo "Current dotnet runtime hash result: $DOTNET_RUNTIME_HASH"
+        echo "Current Externals hash result: $EXTERNALS_HASH"
+
+        NeedUpdate=0
+        if [ "$EXTERNALS_HASH" != "$(cat ./src/Misc/contentHash/externals/${{ matrix.runtime }})" ] ;then
+          echo Hash mismatch, Update ./src/Misc/contentHash/externals/${{ matrix.runtime }} to $EXTERNALS_HASH
+          NeedUpdate=1
+        fi
+
+        if [ "$DOTNET_RUNTIME_HASH" != "$(cat ./src/Misc/contentHash/dotnetRuntime/${{ matrix.runtime }})" ] ;then
+          echo Hash mismatch, Update ./src/Misc/contentHash/dotnetRuntime/${{ matrix.runtime }} to $DOTNET_RUNTIME_HASH
+          NeedUpdate=1
+        fi
+
+        exit $NeedUpdate
+      env:
+        DOTNET_RUNTIME_HASH: ${{hashFiles('**/_layout_trims/runtime/**/*')}}
+        EXTERNALS_HASH: ${{hashFiles('**/_layout_trims/externals/**/*')}}
+
     # Run tests
     - name: L0
       run: |
         ${{ matrix.devScript }} test
       working-directory: src
-      if: matrix.runtime != 'linux-arm64' && matrix.runtime != 'linux-arm' && matrix.runtime != 'osx-arm64' && matrix.runtime != 'win-arm64'
+      if: matrix.runtime != 'linux-arm64' && matrix.runtime != 'linux-arm' && matrix.runtime != 'osx-arm64'
 
     # Create runner package tar.gz/zip
     - name: Package Release
       if: github.event_name != 'pull_request'
       run: |
-        ${{ matrix.devScript }} package Release ${{ matrix.runtime }}
+        ${{ matrix.devScript }} package Release
       working-directory: src
 
     # Upload runner package tar.gz/zip as artifact
     - name: Publish Artifact
       if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v2
       with:
         name: runner-package-${{ matrix.runtime }}
-        path: |
+        path: | 
           _package
+          _package_trims/trim_externals
+          _package_trims/trim_runtime
+          _package_trims/trim_runtime_externals

.github/workflows/close-bugs-bot.yml

@@ -1,17 +0,0 @@
-name: Close Bugs Bot
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *' # every day at midnight
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v10
-        with:
-          close-issue-message: "This issue does not seem to be a problem with the runner application, it concerns the GitHub actions platform more generally. Could you please post your feedback on the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which is actively monitored. Using the forum ensures that we route your problem to the correct team. 😃"
-          exempt-issue-labels: "keep"
-          stale-issue-label: "actions-bug"
-          only-labels: "actions-bug"
-          days-before-stale: 0
-          days-before-close: 1

.github/workflows/close-features-bot.yml

@@ -1,17 +0,0 @@
-name: Close Features Bot
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * *' # every day at midnight
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v10
-        with:
-          close-issue-message: "Thank you for your interest in the runner application and taking the time to provide your valuable feedback. We kindly ask you to redirect this feedback to the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions-and-packages) which our team actively monitors and would be a better place to start a discussion for new feature requests in GitHub Actions. For more information on this policy please [read our contribution guidelines](https://github.com/actions/runner#contribute). 😃"
-          exempt-issue-labels: "keep"
-          stale-issue-label: "actions-feature"
-          only-labels: "actions-feature"
-          days-before-stale: 0
-          days-before-close: 1

.github/workflows/codeql.yml

@@ -23,11 +23,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v3
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v1
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
@@ -38,4 +38,4 @@ jobs:
       working-directory: src
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v1

.github/workflows/dependency-check.yml

@@ -1,211 +0,0 @@
-name: Dependency Status Check
-
-on:
-  workflow_dispatch:
-    inputs:
-      check_type:
-        description: "Type of dependency check"
-        required: false
-        default: "all"
-        type: choice
-        options:
-          - all
-          - node
-          - dotnet
-          - docker
-          - npm
-  schedule:
-    - cron: "0 11 * * 1" # Weekly on Monday at 11 AM
-
-jobs:
-  dependency-status:
-    runs-on: ubuntu-latest
-    outputs:
-      node20-status: ${{ steps.check-versions.outputs.node20-status }}
-      node24-status: ${{ steps.check-versions.outputs.node24-status }}
-      dotnet-status: ${{ steps.check-versions.outputs.dotnet-status }}
-      docker-status: ${{ steps.check-versions.outputs.docker-status }}
-      buildx-status: ${{ steps.check-versions.outputs.buildx-status }}
-      npm-vulnerabilities: ${{ steps.check-versions.outputs.npm-vulnerabilities }}
-      open-dependency-prs: ${{ steps.check-prs.outputs.open-dependency-prs }}
-    steps:
-      - uses: actions/checkout@v5
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-
-      - name: Check dependency versions
-        id: check-versions
-        run: |
-          echo "## Dependency Status Report" >> $GITHUB_STEP_SUMMARY
-          echo "Generated on: $(date)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # Check Node versions
-          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "node" ]]; then
-            echo "### Node.js Versions" >> $GITHUB_STEP_SUMMARY
-            
-            VERSIONS_JSON=$(curl -s https://raw.githubusercontent.com/actions/node-versions/main/versions-manifest.json)
-            LATEST_NODE20=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("20.")) | .version' | head -1)
-            LATEST_NODE24=$(echo "$VERSIONS_JSON" | jq -r '.[] | select(.version | startswith("24.")) | .version' | head -1)
-            
-            CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
-            CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
-            
-            NODE20_STATUS="✅ up-to-date"
-            NODE24_STATUS="✅ up-to-date"
-            
-            if [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
-              NODE20_STATUS="⚠️ outdated"
-            fi
-            
-            if [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
-              NODE24_STATUS="⚠️ outdated"
-            fi
-            
-            echo "| Version | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY
-            echo "|---------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Node 20 | $CURRENT_NODE20 | $LATEST_NODE20 | $NODE20_STATUS |" >> $GITHUB_STEP_SUMMARY
-            echo "| Node 24 | $CURRENT_NODE24 | $LATEST_NODE24 | $NODE24_STATUS |" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            
-            echo "node20-status=$NODE20_STATUS" >> $GITHUB_OUTPUT
-            echo "node24-status=$NODE24_STATUS" >> $GITHUB_OUTPUT
-          fi
-
-          # Check .NET version
-          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "dotnet" ]]; then
-            echo "### .NET SDK Version" >> $GITHUB_STEP_SUMMARY
-            
-            current_dotnet_version=$(jq -r .sdk.version ./src/global.json)
-            current_major_minor=$(echo "$current_dotnet_version" | cut -d '.' -f 1,2)
-            latest_dotnet_version=$(curl -sb -H "Accept: application/json" "https://dotnetcli.blob.core.windows.net/dotnet/Sdk/$current_major_minor/latest.version")
-            
-            DOTNET_STATUS="✅ up-to-date"
-            if [ "$current_dotnet_version" != "$latest_dotnet_version" ]; then
-              DOTNET_STATUS="⚠️ outdated"
-            fi
-            
-            echo "| Component | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY
-            echo "|-----------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
-            echo "| .NET SDK | $current_dotnet_version | $latest_dotnet_version | $DOTNET_STATUS |" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            
-            echo "dotnet-status=$DOTNET_STATUS" >> $GITHUB_OUTPUT
-          fi
-
-          # Check Docker versions
-          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "docker" ]]; then
-            echo "### Docker Versions" >> $GITHUB_STEP_SUMMARY
-            
-            current_docker=$(grep "ARG DOCKER_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
-            current_buildx=$(grep "ARG BUILDX_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
-            
-            latest_docker=$(curl -s https://download.docker.com/linux/static/stable/x86_64/ | grep -o 'docker-[0-9]*\.[0-9]*\.[0-9]*\.tgz' | sort -V | tail -n 1 | sed 's/docker-\(.*\)\.tgz/\1/')
-            latest_buildx=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//')
-            
-            DOCKER_STATUS="✅ up-to-date"
-            BUILDX_STATUS="✅ up-to-date"
-            
-            if [ "$current_docker" != "$latest_docker" ]; then
-              DOCKER_STATUS="⚠️ outdated"
-            fi
-            
-            if [ "$current_buildx" != "$latest_buildx" ]; then
-              BUILDX_STATUS="⚠️ outdated"
-            fi
-            
-            echo "| Component | Current | Latest | Status |" >> $GITHUB_STEP_SUMMARY
-            echo "|-----------|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Docker | $current_docker | $latest_docker | $DOCKER_STATUS |" >> $GITHUB_STEP_SUMMARY
-            echo "| Docker Buildx | $current_buildx | $latest_buildx | $BUILDX_STATUS |" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            
-            echo "docker-status=$DOCKER_STATUS" >> $GITHUB_OUTPUT
-            echo "buildx-status=$BUILDX_STATUS" >> $GITHUB_OUTPUT
-          fi
-
-          # Check npm vulnerabilities
-          if [[ "${{ github.event.inputs.check_type }}" == "all" || "${{ github.event.inputs.check_type }}" == "npm" ]]; then
-            echo "### NPM Security Audit" >> $GITHUB_STEP_SUMMARY
-            
-            cd src/Misc/expressionFunc/hashFiles
-            npm install --silent
-            
-            AUDIT_OUTPUT=""
-            AUDIT_EXIT_CODE=0
-            # Run npm audit and capture output and exit code
-            if ! AUDIT_OUTPUT=$(npm audit --json 2>&1); then
-              AUDIT_EXIT_CODE=$?
-            fi
-            
-            # Check if output is valid JSON
-            if echo "$AUDIT_OUTPUT" | jq . >/dev/null 2>&1; then
-              VULN_COUNT=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.total // 0')
-              # Ensure VULN_COUNT is a number
-              VULN_COUNT=$(echo "$VULN_COUNT" | grep -o '[0-9]*' | head -1)
-              VULN_COUNT=${VULN_COUNT:-0}
-              
-              NPM_STATUS="✅ no vulnerabilities"
-              if [ "$VULN_COUNT" -gt 0 ] 2>/dev/null; then
-                NPM_STATUS="⚠️ $VULN_COUNT vulnerabilities found"
-                
-                # Get vulnerability details
-                HIGH_VULNS=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.high // 0')
-                CRITICAL_VULNS=$(echo "$AUDIT_OUTPUT" | jq '.metadata.vulnerabilities.critical // 0')
-                
-                echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
-                echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
-                echo "| Critical | $CRITICAL_VULNS |" >> $GITHUB_STEP_SUMMARY
-                echo "| High | $HIGH_VULNS |" >> $GITHUB_STEP_SUMMARY
-                echo "" >> $GITHUB_STEP_SUMMARY
-              else
-                echo "No npm vulnerabilities found ✅" >> $GITHUB_STEP_SUMMARY
-                echo "" >> $GITHUB_STEP_SUMMARY
-              fi
-            else
-              NPM_STATUS="❌ npm audit failed"
-              echo "npm audit failed to run or returned invalid JSON ❌" >> $GITHUB_STEP_SUMMARY
-              echo "Exit code: $AUDIT_EXIT_CODE" >> $GITHUB_STEP_SUMMARY
-              echo "Output: $AUDIT_OUTPUT" >> $GITHUB_STEP_SUMMARY
-              echo "" >> $GITHUB_STEP_SUMMARY
-            fi
-            
-            echo "npm-vulnerabilities=$NPM_STATUS" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Check for open dependency PRs
-        id: check-prs
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          echo "### Open Dependency PRs" >> $GITHUB_STEP_SUMMARY
-
-          # Get open PRs with dependency label
-          OPEN_PRS=$(gh pr list --label "dependencies" --state open --json number,title,url)
-          PR_COUNT=$(echo "$OPEN_PRS" | jq '. | length')
-
-          if [ "$PR_COUNT" -gt 0 ]; then
-            echo "Found $PR_COUNT open dependency PR(s):" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "$OPEN_PRS" | jq -r '.[] | "- [#\(.number)](\(.url)) \(.title)"' >> $GITHUB_STEP_SUMMARY
-          else
-            echo "No open dependency PRs found ✅" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "open-dependency-prs=$PR_COUNT" >> $GITHUB_OUTPUT
-
-      - name: Summary
-        run: |
-          echo "### Summary" >> $GITHUB_STEP_SUMMARY
-          echo "- Check for open PRs with the \`dependency\` label before releases" >> $GITHUB_STEP_SUMMARY
-          echo "- Review and merge dependency updates regularly" >> $GITHUB_STEP_SUMMARY
-          echo "- Critical vulnerabilities should be addressed immediately" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Automated workflows run weekly to check for updates:**" >> $GITHUB_STEP_SUMMARY
-          echo "- Node.js versions (Mondays at 6 AM)" >> $GITHUB_STEP_SUMMARY
-          echo "- NPM audit fix (Mondays at 7 AM)" >> $GITHUB_STEP_SUMMARY
-          echo "- .NET SDK updates (Mondays at midnight)" >> $GITHUB_STEP_SUMMARY
-          echo "- Docker/Buildx updates (Mondays at midnight)" >> $GITHUB_STEP_SUMMARY

.github/workflows/docker-buildx-upgrade.yml

@@ -1,166 +0,0 @@
-name: "Docker/Buildx Version Upgrade"
-
-on:
-  schedule:
-    - cron: "0 0 * * 1" # Run every Monday at midnight
-  workflow_dispatch: # Allow manual triggering
-
-jobs:
-  check-versions:
-    runs-on: ubuntu-latest
-    outputs:
-      DOCKER_SHOULD_UPDATE: ${{ steps.check_docker_version.outputs.SHOULD_UPDATE }}
-      DOCKER_LATEST_VERSION: ${{ steps.check_docker_version.outputs.LATEST_VERSION }}
-      DOCKER_CURRENT_VERSION: ${{ steps.check_docker_version.outputs.CURRENT_VERSION }}
-      BUILDX_SHOULD_UPDATE: ${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}
-      BUILDX_LATEST_VERSION: ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}
-      BUILDX_CURRENT_VERSION: ${{ steps.check_buildx_version.outputs.CURRENT_VERSION }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Check Docker version
-        id: check_docker_version
-        shell: bash
-        run: |
-          # Extract current Docker version from Dockerfile
-          current_version=$(grep "ARG DOCKER_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
-
-          # Fetch latest Docker Engine version from Docker's download site
-          # This gets the latest Linux static binary version which matches what's used in the Dockerfile
-          latest_version=$(curl -s https://download.docker.com/linux/static/stable/x86_64/ | grep -o 'docker-[0-9]*\.[0-9]*\.[0-9]*\.tgz' | sort -V | tail -n 1 | sed 's/docker-\(.*\)\.tgz/\1/')
-
-          # Extra check to ensure we got a valid version
-          if [[ ! $latest_version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Failed to retrieve a valid Docker version"
-            exit 1
-          fi
-
-          should_update=0
-          [ "$current_version" != "$latest_version" ] && should_update=1
-
-          echo "CURRENT_VERSION=${current_version}" >> $GITHUB_OUTPUT
-          echo "LATEST_VERSION=${latest_version}" >> $GITHUB_OUTPUT
-          echo "SHOULD_UPDATE=${should_update}" >> $GITHUB_OUTPUT
-
-      - name: Check Buildx version
-        id: check_buildx_version
-        shell: bash
-        run: |
-          # Extract current Buildx version from Dockerfile
-          current_version=$(grep "ARG BUILDX_VERSION=" ./images/Dockerfile | cut -d'=' -f2)
-
-          # Fetch latest Buildx version
-          latest_version=$(curl -s https://api.github.com/repos/docker/buildx/releases/latest | jq -r '.tag_name' | sed 's/^v//')
-
-          should_update=0
-          [ "$current_version" != "$latest_version" ] && should_update=1
-
-          echo "CURRENT_VERSION=${current_version}" >> $GITHUB_OUTPUT
-          echo "LATEST_VERSION=${latest_version}" >> $GITHUB_OUTPUT
-          echo "SHOULD_UPDATE=${should_update}" >> $GITHUB_OUTPUT
-
-      - name: Create annotations for versions
-        run: |
-          docker_should_update="${{ steps.check_docker_version.outputs.SHOULD_UPDATE }}"
-          buildx_should_update="${{ steps.check_buildx_version.outputs.SHOULD_UPDATE }}"
-
-          # Show annotation if only Docker needs update
-          if [[ "$docker_should_update" == "1" && "$buildx_should_update" == "0" ]]; then
-            echo "::warning ::Docker version (${{ steps.check_docker_version.outputs.LATEST_VERSION }}) needs update but Buildx is current. Only updating when both need updates."
-          fi
-
-          # Show annotation if only Buildx needs update
-          if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "1" ]]; then
-            echo "::warning ::Buildx version (${{ steps.check_buildx_version.outputs.LATEST_VERSION }}) needs update but Docker is current. Only updating when both need updates."
-          fi
-
-          # Show annotation when both are current
-          if [[ "$docker_should_update" == "0" && "$buildx_should_update" == "0" ]]; then
-            echo "::warning ::Latest Docker version is ${{ steps.check_docker_version.outputs.LATEST_VERSION }} and Buildx version is ${{ steps.check_buildx_version.outputs.LATEST_VERSION }}. No updates needed."
-          fi
-
-  update-versions:
-    permissions:
-      pull-requests: write
-      contents: write
-    needs: [check-versions]
-    if: ${{ needs.check-versions.outputs.DOCKER_SHOULD_UPDATE == 1 && needs.check-versions.outputs.BUILDX_SHOULD_UPDATE == 1 }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Update Docker version
-        shell: bash
-        run: |
-          latest_version="${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}"
-          current_version="${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }}"
-
-          # Update version in Dockerfile
-          sed -i "s/ARG DOCKER_VERSION=$current_version/ARG DOCKER_VERSION=$latest_version/g" ./images/Dockerfile
-
-      - name: Update Buildx version
-        shell: bash
-        run: |
-          latest_version="${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
-          current_version="${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }}"
-
-          # Update version in Dockerfile
-          sed -i "s/ARG BUILDX_VERSION=$current_version/ARG BUILDX_VERSION=$latest_version/g" ./images/Dockerfile
-
-      - name: Commit changes and create Pull Request
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Setup branch and commit information
-          branch_name="feature/docker-buildx-upgrade"
-          commit_message="Upgrade Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
-          pr_title="Update Docker to v${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }} and Buildx to v${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}"
-
-          # Configure git
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
-
-          # Create branch or switch to it if it exists
-          if git show-ref --quiet refs/remotes/origin/$branch_name; then
-            git fetch origin
-            git checkout -B "$branch_name" origin/$branch_name
-          else
-            git checkout -b "$branch_name"
-          fi
-
-          # Commit and push changes
-          git commit -a -m "$commit_message"
-          git push --force origin "$branch_name"
-
-          # Create PR body using here-doc for proper formatting
-          cat > pr_body.txt << 'EOF'
-          Automated Docker and Buildx version update:
-          
-          - Docker: ${{ needs.check-versions.outputs.DOCKER_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.DOCKER_LATEST_VERSION }}
-          - Buildx: ${{ needs.check-versions.outputs.BUILDX_CURRENT_VERSION }} → ${{ needs.check-versions.outputs.BUILDX_LATEST_VERSION }}
-          
-          This update ensures we're using the latest stable Docker and Buildx versions for security and performance improvements.
-          
-          **Release notes:** https://docs.docker.com/engine/release-notes/
-          
-          **Next steps:**
-          - Review the version changes
-          - Verify container builds work as expected
-          - Test multi-platform builds if applicable
-          - Merge when ready
-          
-          ---
-          
-          Autogenerated by [Docker/Buildx Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/docker-buildx-upgrade.yml)
-          EOF
-
-          # Create PR
-          gh pr create -B main -H "$branch_name" \
-            --title "$pr_title" \
-            --label "dependencies" \
-            --label "dependencies-weekly-check" \
-            --label "dependencies-not-dependabot" \
-            --label "docker" \
-            --body-file pr_body.txt

.github/workflows/dotnet-upgrade.yml

@@ -1,105 +0,0 @@
-name: "DotNet SDK Upgrade"
-
-on:
-  schedule:
-    - cron: "0 8 * * 1" # Weekly on Monday at 8 AM UTC (independent of Node.js/NPM)
-  workflow_dispatch:
-
-jobs:
-  dotnet-update:
-    runs-on: ubuntu-latest
-    outputs:
-      SHOULD_UPDATE: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE }}
-      BRANCH_EXISTS: ${{ steps.fetch_latest_version.outputs.BRANCH_EXISTS }}
-      DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION: ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
-      DOTNET_CURRENT_MAJOR_MINOR_VERSION: ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-      - name: Get current major minor version
-        id: fetch_current_version
-        shell: bash
-        run: |
-          current_major_minor_patch_version=$(jq .sdk.version ./src/global.json | xargs)
-          current_major_minor_version=$(cut -d '.' -f 1,2 <<< "$current_major_minor_patch_version")
-
-          echo "DOTNET_CURRENT_MAJOR_MINOR_PATCH_VERSION=${current_major_minor_patch_version}" >> $GITHUB_OUTPUT
-          echo "DOTNET_CURRENT_MAJOR_MINOR_VERSION=${current_major_minor_version}" >> $GITHUB_OUTPUT
-      - name: Check patch version
-        id: fetch_latest_version
-        shell: bash
-        run: |
-          latest_patch_version=$(curl -sb -H "Accept: application/json" "https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version")
-          current_patch_version=${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_PATCH_VERSION }}
-
-          should_update=0
-          [ "$current_patch_version" != "$latest_patch_version" ] && should_update=1
-
-          # check if git branch already exists for the upgrade
-          branch_already_exists=0
-
-          if git ls-remote --heads --exit-code origin refs/heads/feature/dotnetsdk-upgrade/${latest_patch_version};
-          then 
-            branch_already_exists=1
-            should_update=0
-          fi
-          echo "DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION=${latest_patch_version}" >> $GITHUB_OUTPUT
-          echo "SHOULD_UPDATE=${should_update}" >> $GITHUB_OUTPUT
-          echo "BRANCH_EXISTS=${branch_already_exists}" >> $GITHUB_OUTPUT
-      - name: Create an error annotation if branch exists
-        if: ${{ steps.fetch_latest_version.outputs.BRANCH_EXISTS == 1 }}
-        run: echo "::error links::feature/dotnet-sdk-upgrade${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} https://github.com/actions/runner/tree/feature/dotnet-sdk-upgrade${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}::Branch feature/dotnetsdk-upgrade/${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} already exists. Please take a look and delete that branch if you wish to recreate"
-      - name: Create a warning annotation if no need to update
-        if: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE == 0 && steps.fetch_latest_version.outputs.BRANCH_EXISTS == 0 }}
-        run: echo "::warning ::Latest DotNet SDK patch is ${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}, and we are on ${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_PATCH_VERSION }}. No need to update"
-      - name: Update patch version
-        if: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE == 1 && steps.fetch_latest_version.outputs.BRANCH_EXISTS == 0 }}
-        shell: bash
-        run: |
-          patch_version="${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}"
-          current_version="${{ steps.fetch_current_version.outputs.DOTNET_CURRENT_MAJOR_MINOR_PATCH_VERSION }}"
-
-          # Update globals
-          echo Updating globals
-          globals_temp=$(mktemp)
-          jq --unbuffered --arg patch_version "$patch_version" '.sdk.version = $patch_version' ./src/global.json > "$globals_temp" && mv "$globals_temp" ./src/global.json
-
-          # Update devcontainer
-          echo Updating devcontainer
-          devcontainer_temp=$(mktemp)
-          jq --unbuffered --arg patch_version "$patch_version" '.features."ghcr.io/devcontainers/features/dotnet".version = $patch_version' ./.devcontainer/devcontainer.json > "$devcontainer_temp" && mv "$devcontainer_temp" ./.devcontainer/devcontainer.json
-
-          # Update dev.sh
-          echo Updating start script
-          sed -i "s/DOTNETSDK_VERSION=\"$current_version\"/DOTNETSDK_VERSION=\"$patch_version\"/g" ./src/dev.sh
-      - name: GIT commit and push all changed files
-        if: ${{ steps.fetch_latest_version.outputs.SHOULD_UPDATE == 1 && steps.fetch_latest_version.outputs.BRANCH_EXISTS == 0 }}
-        id: create_branch
-        run: |
-          branch_name="feature/dotnetsdk-upgrade/${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}"
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
-
-          git checkout -b $branch_name
-          git commit -a -m "Upgrade dotnet sdk to v${{ steps.fetch_latest_version.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}"
-          git push --set-upstream origin $branch_name
-
-  create-pr:
-    needs: [dotnet-update]
-    if: ${{ needs.dotnet-update.outputs.SHOULD_UPDATE == 1 && needs.dotnet-update.outputs.BRANCH_EXISTS == 0 }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}
-      - name: Create Pull Request
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr create -B main -H feature/dotnetsdk-upgrade/${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }} --title "Update dotnet sdk to latest version @${{ needs.dotnet-update.outputs.DOTNET_LATEST_MAJOR_MINOR_PATCH_VERSION }}" --label "dependencies" --label "dependencies-weekly-check" --label "dependencies-not-dependabot" --label "dotnet" --body "
-            https://dotnetcli.blob.core.windows.net/dotnet/Sdk/${{ needs.dotnet-update.outputs.DOTNET_CURRENT_MAJOR_MINOR_VERSION }}/latest.version
-            
-              
-            ---
-              
-            Autogenerated by [DotNet SDK Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/dotnet-upgrade.yml)"

.github/workflows/node-upgrade.yml

@@ -1,112 +0,0 @@
-name: Auto Update Node Version
-
-on:
-  schedule:
-    - cron: "0 6 * * 1" # Weekly, every Monday
-  workflow_dispatch:
-
-jobs:
-  update-node:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - name: Get latest Node versions
-        id: node-versions
-        run: |
-          set -e
-          echo "Fetching latest Node.js releases..."
-          # Get latest v20.x release
-          LATEST_NODE20=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
-            jq -r '.[] | select(.tag_name | startswith("v20.")) | .tag_name' | \
-            head -1 | sed 's/^v//')
-          # Get latest v24.x release  
-          LATEST_NODE24=$(curl -s https://api.github.com/repos/nodejs/node/releases | \
-            jq -r '.[] | select(.tag_name | startswith("v24.")) | .tag_name' | \
-            head -1 | sed 's/^v//')
-          echo "Found Node.js releases: 20=$LATEST_NODE20, 24=$LATEST_NODE24"
-          # Verify these versions are available in alpine_nodejs releases
-          echo "Verifying availability in alpine_nodejs..."
-          ALPINE_RELEASES=$(curl -s https://api.github.com/repos/actions/alpine_nodejs/releases | jq -r '.[].tag_name')
-          if ! echo "$ALPINE_RELEASES" | grep -q "^node20-$LATEST_NODE20$"; then
-            echo "::warning title=Node 20 Fallback::Node 20 version $LATEST_NODE20 not found in alpine_nodejs releases, using fallback"
-            LATEST_NODE20=$(echo "$ALPINE_RELEASES" | grep "^node20-" | head -1 | sed 's/^node20-//')
-            echo "Using latest available alpine_nodejs Node 20: $LATEST_NODE20"
-          fi
-          if ! echo "$ALPINE_RELEASES" | grep -q "^node24-$LATEST_NODE24$"; then
-            echo "::warning title=Node 24 Fallback::Node 24 version $LATEST_NODE24 not found in alpine_nodejs releases, using fallback"
-            LATEST_NODE24=$(echo "$ALPINE_RELEASES" | grep "^node24-" | head -1 | sed 's/^node24-//')
-            echo "Using latest available alpine_nodejs Node 24: $LATEST_NODE24"
-          fi
-          # Abort if no valid Node versions are found
-          if [ -z "$LATEST_NODE20" ] && [ -z "$LATEST_NODE24" ]; then
-            echo "::error title=Node Version Update::Could not find valid Node 20 or Node 24 version in alpine_nodejs releases. Aborting."
-            exit 1
-          fi
-          # Check current versions in externals.sh
-          CURRENT_NODE20=$(grep "NODE20_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
-          CURRENT_NODE24=$(grep "NODE24_VERSION=" src/Misc/externals.sh | cut -d'"' -f2)
-          echo "current_node20=$CURRENT_NODE20" >> $GITHUB_OUTPUT
-          echo "current_node24=$CURRENT_NODE24" >> $GITHUB_OUTPUT
-          # Determine if updates are needed
-          NEEDS_UPDATE20="false"
-          NEEDS_UPDATE24="false"
-          if [ -n "$LATEST_NODE20" ] && [ "$CURRENT_NODE20" != "$LATEST_NODE20" ]; then
-            NEEDS_UPDATE20="true"
-            echo "::notice title=Node 20 Update Available::Current: $CURRENT_NODE20 → Latest: $LATEST_NODE20"
-          fi
-          if [ -n "$LATEST_NODE24" ] && [ "$CURRENT_NODE24" != "$LATEST_NODE24" ]; then
-            NEEDS_UPDATE24="true"
-            echo "::notice title=Node 24 Update Available::Current: $CURRENT_NODE24 → Latest: $LATEST_NODE24"
-          fi
-          if [ "$NEEDS_UPDATE20" == "false" ] && [ "$NEEDS_UPDATE24" == "false" ]; then
-            echo "::notice title=No Updates Needed::All Node.js versions are up to date"
-          fi
-          echo "latest_node20=$LATEST_NODE20" >> $GITHUB_OUTPUT
-          echo "latest_node24=$LATEST_NODE24" >> $GITHUB_OUTPUT
-          echo "needs_update20=$NEEDS_UPDATE20" >> $GITHUB_OUTPUT
-          echo "needs_update24=$NEEDS_UPDATE24" >> $GITHUB_OUTPUT
-      - name: Update externals.sh and create PR
-        if: steps.node-versions.outputs.needs_update20 == 'true' || steps.node-versions.outputs.needs_update24 == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -e
-          # Only update if a valid version is found
-          if [ "${{ steps.node-versions.outputs.needs_update20 }}" == "true" ] && [ -n "${{ steps.node-versions.outputs.latest_node20 }}" ]; then
-            sed -i 's/NODE20_VERSION="[^"]*"/NODE20_VERSION="${{ steps.node-versions.outputs.latest_node20 }}"/' src/Misc/externals.sh
-          fi
-          if [ "${{ steps.node-versions.outputs.needs_update24 }}" == "true" ] && [ -n "${{ steps.node-versions.outputs.latest_node24 }}" ]; then
-            sed -i 's/NODE24_VERSION="[^"]*"/NODE24_VERSION="${{ steps.node-versions.outputs.latest_node24 }}"/' src/Misc/externals.sh
-          fi
-          # Configure git
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
-          # Create branch and commit changes
-          branch_name="chore/update-node"
-          git checkout -b "$branch_name"
-          git commit -a -m "chore: update Node versions (20: ${{ steps.node-versions.outputs.latest_node20 }}, 24: ${{ steps.node-versions.outputs.latest_node24 }})"
-          git push --force origin "$branch_name"
-          # Create PR body using here-doc for proper formatting
-          cat > pr_body.txt << EOF
-Automated Node.js version update:
-
-- Node 20: ${{ steps.node-versions.outputs.current_node20 }} → ${{ steps.node-versions.outputs.latest_node20 }}
-- Node 24: ${{ steps.node-versions.outputs.current_node24 }} → ${{ steps.node-versions.outputs.latest_node24 }}
-
-This update ensures we're using the latest stable Node.js versions for security and performance improvements.
-
-**Note**: When updating Node versions, remember to also create a new release of alpine_nodejs at the updated version following the instructions at: https://github.com/actions/alpine_nodejs
-
----
-Autogenerated by [Node Version Upgrade Workflow](https://github.com/actions/runner/blob/main/.github/workflows/node-upgrade.yml)
-EOF
-          # Create PR
-          gh pr create -B main -H "$branch_name" \
-            --title "chore: update Node versions" \
-            --label "dependencies" \
-            --label "dependencies-weekly-check" \
-            --label "dependencies-not-dependabot" \
-            --label "node" \
-            --label "javascript" \
-            --body-file pr_body.txt
-          echo "::notice title=PR Created::Successfully created Node.js version update PR on branch $branch_name"

.github/workflows/npm-audit-typescript.yml

@@ -1,235 +0,0 @@
-name: NPM Audit Fix with TypeScript Auto-Fix
-
-on:
-  workflow_dispatch:
-
-jobs:
-  npm-audit-with-ts-fix:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-      - name: NPM install and audit fix with TypeScript auto-repair
-        working-directory: src/Misc/expressionFunc/hashFiles
-        run: |
-          npm install
-
-          # Check for vulnerabilities first
-          echo "Checking for npm vulnerabilities..."
-          if npm audit --audit-level=moderate; then
-            echo "✅ No moderate or higher vulnerabilities found"
-            exit 0
-          fi
-
-          echo "⚠️ Vulnerabilities found, attempting npm audit fix..."
-
-          # Attempt audit fix and capture the result
-          if npm audit fix; then
-            echo "✅ npm audit fix completed successfully"
-            AUDIT_FIX_STATUS="success"
-          else
-            echo "⚠️ npm audit fix failed or had issues"
-            AUDIT_FIX_STATUS="failed"
-            
-            # Try audit fix with --force as a last resort for critical/high vulns only
-            echo "Checking if critical/high vulnerabilities remain..."
-            if ! npm audit --audit-level=high; then
-              echo "🚨 Critical/high vulnerabilities remain, attempting --force fix..."
-              if npm audit fix --force; then
-                echo "⚠️ npm audit fix --force completed (may have breaking changes)"
-                AUDIT_FIX_STATUS="force-fixed"
-              else
-                echo "❌ npm audit fix --force also failed"
-                AUDIT_FIX_STATUS="force-failed"
-              fi
-            else
-              echo "✅ Only moderate/low vulnerabilities remain after failed fix"
-              AUDIT_FIX_STATUS="partial-success"
-            fi
-          fi
-
-          echo "AUDIT_FIX_STATUS=$AUDIT_FIX_STATUS" >> $GITHUB_ENV
-
-          # Try to fix TypeScript issues automatically
-          echo "Attempting to fix TypeScript compatibility issues..."
-
-          # Check if build fails
-          if ! npm run build 2>/dev/null; then
-            echo "Build failed, attempting automated fixes..."
-            
-            # Common fix 1: Update @types/node to latest compatible version
-            echo "Trying to update @types/node to latest version..."
-            npm update @types/node
-            
-            # Common fix 2: If that doesn't work, try installing a specific known-good version
-            if ! npm run build 2>/dev/null; then
-              echo "Trying specific @types/node version..."
-              # Try Node 20 compatible version
-              npm install --save-dev @types/node@^20.0.0
-            fi
-            
-            # Common fix 3: Clear node_modules and reinstall if still failing
-            if ! npm run build 2>/dev/null; then
-              echo "Clearing node_modules and reinstalling..."
-              rm -rf node_modules package-lock.json
-              npm install
-              
-              # Re-run audit fix after clean install if it was successful before
-              if [[ "$AUDIT_FIX_STATUS" == "success" || "$AUDIT_FIX_STATUS" == "force-fixed" ]]; then
-                echo "Re-running npm audit fix after clean install..."
-                npm audit fix || echo "Audit fix failed on second attempt"
-              fi
-            fi
-            
-            # Common fix 4: Try updating TypeScript itself
-            if ! npm run build 2>/dev/null; then
-              echo "Trying to update TypeScript..."
-              npm update typescript
-            fi
-            
-            # Final check
-            if npm run build 2>/dev/null; then
-              echo "✅ Successfully fixed TypeScript issues automatically"
-            else
-              echo "⚠️ Could not automatically fix TypeScript issues"
-            fi
-          else
-            echo "✅ Build passes after audit fix"
-          fi
-
-      - name: Create PR if changes exist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          HUSKY: 0 # Disable husky hooks for automated commits
-        run: |
-          # Check if there are any changes
-          if [ -n "$(git status --porcelain)" ]; then
-            # Configure git
-            git config --global user.name "github-actions[bot]"
-            git config --global user.email "<41898282+github-actions[bot]@users.noreply.github.com>"
-
-            # Create branch and commit changes
-            branch_name="chore/npm-audit-fix-with-ts-repair"
-            git checkout -b "$branch_name"
-            
-            # Commit with --no-verify to skip husky hooks
-            git commit -a -m "chore: npm audit fix with automated TypeScript compatibility fixes" --no-verify
-            git push --force origin "$branch_name"
-            
-            # Check final build status and gather info about what was changed
-            build_status="✅ Build passes"
-            fixes_applied=""
-            cd src/Misc/expressionFunc/hashFiles
-            
-            # Check what packages were updated
-            if git diff HEAD~1 package.json | grep -q "@types/node"; then
-              fixes_applied+="\n- Updated @types/node version for TypeScript compatibility"
-            fi
-            if git diff HEAD~1 package.json | grep -q "typescript"; then
-              fixes_applied+="\n- Updated TypeScript version"
-            fi
-            if git diff HEAD~1 package-lock.json | grep -q "resolved"; then
-              fixes_applied+="\n- Updated package dependencies via npm audit fix"
-            fi
-            
-            if ! npm run build 2>/dev/null; then
-              build_status="⚠️ Build fails - manual review required"
-            fi
-            cd - > /dev/null
-            
-            # Create enhanced PR body using here-doc for proper formatting
-            audit_status_msg=""
-            case "$AUDIT_FIX_STATUS" in
-              "success")
-                audit_status_msg="✅ **Audit Fix**: Completed successfully"
-                ;;
-              "partial-success")
-                audit_status_msg="⚠️ **Audit Fix**: Partial success (only moderate/low vulnerabilities remain)"
-                ;;
-              "force-fixed")
-                audit_status_msg="⚠️ **Audit Fix**: Completed with --force (may have breaking changes)"
-                ;;
-              "failed"|"force-failed")
-                audit_status_msg="❌ **Audit Fix**: Failed to resolve vulnerabilities"
-                ;;
-              *)
-                audit_status_msg="❓ **Audit Fix**: Status unknown"
-                ;;
-            esac
-            
-            if [[ "$build_status" == *"fails"* ]]; then
-              cat > pr_body.txt << EOF
-          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
-
-          **Build Status**: ⚠️ Build fails - manual review required
-          $audit_status_msg
-
-          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
-
-          ⚠️ **Manual Review Required**: The build is currently failing after automated fixes were attempted.
-
-          Common issues and solutions:
-          - Check for TypeScript version compatibility with Node.js types
-          - Review breaking changes in updated dependencies
-          - Consider pinning problematic dependency versions temporarily
-          - Review tsconfig.json for compatibility settings
-
-          **Automated Fix Strategy**:
-          1. Run npm audit fix with proper error handling
-          2. Update @types/node to latest compatible version
-          3. Try Node 20 specific @types/node version if needed
-          4. Clean reinstall dependencies if conflicts persist
-          5. Update TypeScript compiler if necessary
-
-          ---
-
-          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
-          EOF
-            else
-              cat > pr_body.txt << EOF
-          Automated npm audit fix with TypeScript auto-repair for hashFiles dependencies.
-
-          **Build Status**: ✅ Build passes
-          $audit_status_msg
-
-          This workflow attempts to automatically fix TypeScript compatibility issues that may arise from npm audit fixes.
-
-          ✅ **Ready to Merge**: All automated fixes were successful and the build passes.
-
-          **Automated Fix Strategy**:
-          1. Run npm audit fix with proper error handling
-          2. Update @types/node to latest compatible version
-          3. Try Node 20 specific @types/node version if needed
-          4. Clean reinstall dependencies if conflicts persist
-          5. Update TypeScript compiler if necessary
-
-          ---
-
-          Autogenerated by [NPM Audit Fix with TypeScript Auto-Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit-ts-fix.yml)
-          EOF
-            fi
-            
-            if [ -n "$fixes_applied" ]; then
-              # Add the fixes applied section to the file
-              sed -i "/This workflow attempts/a\\
-          \\
-          **Automated Fixes Applied**:$fixes_applied" pr_body.txt
-            fi
-            
-            # Create PR with appropriate labels
-            labels="dependencies,dependencies-not-dependabot,typescript,npm,security"
-            if [[ "$build_status" == *"fails"* ]]; then
-              labels="dependencies,dependencies-not-dependabot,typescript,npm,security,needs-manual-review"
-            fi
-            
-            # Create PR
-            gh pr create -B main -H "$branch_name" \
-              --title "chore: npm audit fix with TypeScript auto-repair" \
-              --label "$labels" \
-              --body-file pr_body.txt
-          else
-            echo "No changes to commit"
-          fi

.github/workflows/npm-audit.yml

@@ -1,137 +0,0 @@
-name: NPM Audit Fix
-
-on:
-  schedule:
-    - cron: "0 7 * * 1" # Weekly on Monday at 7 AM UTC
-  workflow_dispatch:
-
-jobs:
-  npm-audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v5
-      
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-          
-      - name: NPM install and audit fix
-        working-directory: src/Misc/expressionFunc/hashFiles
-        run: |
-          npm install
-          
-          # Check what vulnerabilities exist
-          echo "=== Checking current vulnerabilities ==="
-          npm audit || true
-          
-          # Apply audit fix --force to get security updates
-          echo "=== Applying npm audit fix --force ==="
-          npm audit fix --force
-          
-          # Test if build still works and set status
-          echo "=== Testing build compatibility ==="
-          if npm run all; then
-            echo "✅ Build successful after audit fix"
-            echo "AUDIT_FIX_STATUS=success" >> $GITHUB_ENV
-          else
-            echo "❌ Build failed after audit fix - will create PR with fix instructions"
-            echo "AUDIT_FIX_STATUS=build_failed" >> $GITHUB_ENV
-          fi
-          
-      - name: Create PR if changes exist
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          # Check if there are any changes
-          if [ -n "$(git status --porcelain)" ]; then
-            # Configure git
-            git config --global user.name "github-actions[bot]"
-            git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            
-            # Create branch and commit changes
-            branch_name="chore/npm-audit-fix-$(date +%Y%m%d)"
-            git checkout -b "$branch_name"
-            git add .
-            git commit -m "chore: npm audit fix for hashFiles dependencies" --no-verify
-            git push origin "$branch_name"
-            
-            # Create PR body based on what actually happened
-            if [ "$AUDIT_FIX_STATUS" = "success" ]; then
-              cat > pr_body.txt << 'EOF'
-          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
-          
-          **✅ Full Fix Applied Successfully**
-          This update addresses npm security advisories and ensures dependencies are secure and up-to-date.
-          
-          **Changes made:**
-          - Applied `npm audit fix --force` to resolve security vulnerabilities
-          - Updated package-lock.json with security patches
-          - Verified build compatibility with `npm run all`
-          
-          **Next steps:**
-          - Review the dependency changes  
-          - Verify the hashFiles functionality still works as expected
-          - Merge when ready
-          
-          ---
-          
-          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
-          EOF
-            elif [ "$AUDIT_FIX_STATUS" = "build_failed" ]; then
-              cat > pr_body.txt << 'EOF'
-          Automated npm audit fix for security vulnerabilities in hashFiles dependencies.
-          
-          **⚠️ Security Fixes Applied - Build Issues Need Manual Resolution**
-          This update applies important security patches but causes build failures that require manual fixes.
-          
-          **Changes made:**
-          - Applied `npm audit fix --force` to resolve security vulnerabilities
-          - Updated package-lock.json with security patches
-          
-          **⚠️ Build Issues Detected:**
-          The build fails after applying security fixes, likely due to TypeScript compatibility issues with updated `@types/node`.
-          
-          **Required Manual Fixes:**
-          1. Review TypeScript compilation errors in the build output
-          2. Update TypeScript configuration if needed
-          3. Consider pinning `@types/node` to a compatible version
-          4. Run `npm run all` locally to verify fixes
-          
-          **Next steps:**
-          - **DO NOT merge until build issues are resolved**
-          - Apply manual fixes for TypeScript compatibility
-          - Test the hashFiles functionality still works as expected
-          - Merge when build passes
-          
-          ---
-          
-          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
-          EOF
-            else
-              # Fallback case
-              cat > pr_body.txt << 'EOF'
-          Automated npm audit attempted for security vulnerabilities in hashFiles dependencies.
-          
-          **ℹ️ No Changes Applied**
-          No security vulnerabilities were found or no changes were needed.
-          
-          ---
-          
-          Autogenerated by [NPM Audit Fix Workflow](https://github.com/actions/runner/blob/main/.github/workflows/npm-audit.yml)
-          EOF
-            fi
-            
-            # Create PR
-            gh pr create -B main -H "$branch_name" \
-              --title "chore: npm audit fix for hashFiles dependencies" \
-              --label "dependencies" \
-              --label "dependencies-weekly-check" \
-              --label "dependencies-not-dependabot" \
-              --label "npm" \
-              --label "typescript" \
-              --label "security" \
-              --body-file pr_body.txt
-          else
-            echo "✅ No changes to commit - npm audit fix did not modify any files"
-          fi

.github/workflows/release.yml

@@ -11,15 +11,16 @@ jobs:
     if: startsWith(github.ref, 'refs/heads/releases/') || github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v3
 
     # Make sure ./releaseVersion match ./src/runnerversion
     # Query GitHub release ensure version is not used
     - name: Check version
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@0.3.0
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
+          const core = require('@actions/core')
           const fs = require('fs');
           const runnerVersion = fs.readFileSync('${{ github.workspace }}/src/runnerversion', 'utf8').replace(/\n$/g, '')
           const releaseVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '')
@@ -29,7 +30,7 @@ jobs:
             return
           }
           try {
-            const release = await github.rest.repos.getReleaseByTag({
+            const release = await github.repos.getReleaseByTag({
               owner: '${{ github.event.repository.owner.name }}',
               repo: '${{ github.event.repository.name }}',
               tag: 'v' + runnerVersion
@@ -49,12 +50,29 @@ jobs:
       linux-arm64-sha: ${{ steps.sha.outputs.linux-arm64-sha256 }}
       linux-arm-sha: ${{ steps.sha.outputs.linux-arm-sha256 }}
       win-x64-sha: ${{ steps.sha.outputs.win-x64-sha256 }}
-      win-arm64-sha: ${{ steps.sha.outputs.win-arm64-sha256 }}
       osx-x64-sha: ${{ steps.sha.outputs.osx-x64-sha256 }}
       osx-arm64-sha: ${{ steps.sha.outputs.osx-arm64-sha256 }}
+      linux-x64-sha-noexternals: ${{ steps.sha_noexternals.outputs.linux-x64-sha256 }}
+      linux-arm64-sha-noexternals: ${{ steps.sha_noexternals.outputs.linux-arm64-sha256 }}
+      linux-arm-sha-noexternals: ${{ steps.sha_noexternals.outputs.linux-arm-sha256 }}
+      win-x64-sha-noexternals: ${{ steps.sha_noexternals.outputs.win-x64-sha256 }}
+      osx-x64-sha-noexternals: ${{ steps.sha_noexternals.outputs.osx-x64-sha256 }}
+      osx-arm64-sha-noexternals: ${{ steps.sha_noexternals.outputs.osx-arm64-sha256 }}
+      linux-x64-sha-noruntime: ${{ steps.sha_noruntime.outputs.linux-x64-sha256 }}
+      linux-arm64-sha-noruntime: ${{ steps.sha_noruntime.outputs.linux-arm64-sha256 }}
+      linux-arm-sha-noruntime: ${{ steps.sha_noruntime.outputs.linux-arm-sha256 }}
+      win-x64-sha-noruntime: ${{ steps.sha_noruntime.outputs.win-x64-sha256 }}
+      osx-x64-sha-noruntime: ${{ steps.sha_noruntime.outputs.osx-x64-sha256 }}
+      osx-arm64-sha-noruntime: ${{ steps.sha_noruntime.outputs.osx-arm64-sha256 }}
+      linux-x64-sha-noruntime-noexternals: ${{ steps.sha_noruntime_noexternals.outputs.linux-x64-sha256 }}
+      linux-arm64-sha-noruntime-noexternals: ${{ steps.sha_noruntime_noexternals.outputs.linux-arm64-sha256 }}
+      linux-arm-sha-noruntime-noexternals: ${{ steps.sha_noruntime_noexternals.outputs.linux-arm-sha256 }}
+      win-x64-sha-noruntime-noexternals: ${{ steps.sha_noruntime_noexternals.outputs.win-x64-sha256 }}
+      osx-x64-sha-noruntime-noexternals: ${{ steps.sha_noruntime_noexternals.outputs.osx-x64-sha256 }}
+      osx-arm64-sha-noruntime-noexternals: ${{ steps.sha_noruntime_noexternals.outputs.osx-arm64-sha256 }}
     strategy:
       matrix:
-        runtime: [ linux-x64, linux-arm64, linux-arm, win-x64, osx-x64, osx-arm64, win-arm64 ]
+        runtime: [ linux-x64, linux-arm64, linux-arm, win-x64, osx-x64, osx-arm64 ]
         include:
         - runtime: linux-x64
           os: ubuntu-latest
@@ -71,22 +89,18 @@ jobs:
         - runtime: osx-x64
           os: macOS-latest
           devScript: ./dev.sh
-
+        
         - runtime: osx-arm64
           os: macOS-latest
           devScript: ./dev.sh
 
         - runtime: win-x64
-          os: windows-latest
-          devScript: ./dev
-
-        - runtime: win-arm64
-          os: windows-latest
+          os: windows-2019
           devScript: ./dev
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v3
 
     # Build runner layout
     - name: Build & Layout Release
@@ -109,91 +123,154 @@ jobs:
         file=$(ls)
         sha=$(sha256sum $file | awk '{ print $1 }')
         echo "Computed sha256: $sha for $file"
-        echo "${{matrix.runtime}}-sha256=$sha" >> $GITHUB_OUTPUT
+        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
       shell: bash
       id: sha
       name: Compute SHA256
       working-directory: _package
+    - run: |
+        file=$(ls)
+        sha=$(sha256sum $file | awk '{ print $1 }')
+        echo "Computed sha256: $sha for $file"
+        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
+        echo "::set-output name=sha256::$sha"
+      shell: bash
+      id: sha_noexternals
+      name: Compute SHA256
+      working-directory: _package_trims/trim_externals
+    - run: |
+        file=$(ls)
+        sha=$(sha256sum $file | awk '{ print $1 }')
+        echo "Computed sha256: $sha for $file"
+        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
+        echo "::set-output name=sha256::$sha"
+      shell: bash
+      id: sha_noruntime
+      name: Compute SHA256
+      working-directory: _package_trims/trim_runtime
+    - run: |
+        file=$(ls)
+        sha=$(sha256sum $file | awk '{ print $1 }')
+        echo "Computed sha256: $sha for $file"
+        echo "::set-output name=${{matrix.runtime}}-sha256::$sha"
+        echo "::set-output name=sha256::$sha"
+      shell: bash
+      id: sha_noruntime_noexternals
+      name: Compute SHA256
+      working-directory: _package_trims/trim_runtime_externals
+    
+    - name: Create trimmedpackages.json for ${{ matrix.runtime }}
+      if: matrix.runtime == 'win-x64'
+      uses: actions/github-script@0.3.0
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const core = require('@actions/core')
+          const fs = require('fs');
+          const runnerVersion = fs.readFileSync('src/runnerversion', 'utf8').replace(/\n$/g, '')
+          var trimmedPackages = fs.readFileSync('src/Misc/trimmedpackages_zip.json', 'utf8').replace(/<RUNNER_VERSION>/g, runnerVersion).replace(/<RUNNER_PLATFORM>/g, '${{ matrix.runtime }}')
+          trimmedPackages = trimmedPackages.replace(/<RUNTIME_HASH>/g, '${{hashFiles('**/_layout_trims/runtime/**/*')}}')
+          trimmedPackages = trimmedPackages.replace(/<EXTERNALS_HASH>/g, '${{hashFiles('**/_layout_trims/externals/**/*')}}')
+
+          trimmedPackages = trimmedPackages.replace(/<NO_RUNTIME_EXTERNALS_HASH>/g, '${{steps.sha_noruntime_noexternals.outputs.sha256}}')
+          trimmedPackages = trimmedPackages.replace(/<NO_RUNTIME_HASH>/g, '${{steps.sha_noruntime.outputs.sha256}}')
+          trimmedPackages = trimmedPackages.replace(/<NO_EXTERNALS_HASH>/g, '${{steps.sha_noexternals.outputs.sha256}}')
+
+          console.log(trimmedPackages)
+          fs.writeFileSync('${{ matrix.runtime }}-trimmedpackages.json', trimmedPackages)
+
+    - name: Create trimmedpackages.json for ${{ matrix.runtime }}
+      if: matrix.runtime != 'win-x64'
+      uses: actions/github-script@0.3.0
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const core = require('@actions/core')
+          const fs = require('fs');
+          const runnerVersion = fs.readFileSync('src/runnerversion', 'utf8').replace(/\n$/g, '')
+          var trimmedPackages = fs.readFileSync('src/Misc/trimmedpackages_targz.json', 'utf8').replace(/<RUNNER_VERSION>/g, runnerVersion).replace(/<RUNNER_PLATFORM>/g, '${{ matrix.runtime }}')
+          trimmedPackages = trimmedPackages.replace(/<RUNTIME_HASH>/g, '${{hashFiles('**/_layout_trims/runtime/**/*')}}')
+          trimmedPackages = trimmedPackages.replace(/<EXTERNALS_HASH>/g, '${{hashFiles('**/_layout_trims/externals/**/*')}}')
+
+          trimmedPackages = trimmedPackages.replace(/<NO_RUNTIME_EXTERNALS_HASH>/g, '${{steps.sha_noruntime_noexternals.outputs.sha256}}')
+          trimmedPackages = trimmedPackages.replace(/<NO_RUNTIME_HASH>/g, '${{steps.sha_noruntime.outputs.sha256}}')
+          trimmedPackages = trimmedPackages.replace(/<NO_EXTERNALS_HASH>/g, '${{steps.sha_noexternals.outputs.sha256}}')
+
+          console.log(trimmedPackages)
+          fs.writeFileSync('${{ matrix.runtime }}-trimmedpackages.json', trimmedPackages)
 
     # Upload runner package tar.gz/zip as artifact.
+    # Since each package name is unique, so we don't need to put ${{matrix}} info into artifact name
     - name: Publish Artifact
       if: github.event_name != 'pull_request'
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v2
       with:
-        name: runner-packages-${{ matrix.runtime }}
+        name: runner-packages
         path: |
           _package
+          _package_trims/trim_externals
+          _package_trims/trim_runtime
+          _package_trims/trim_runtime_externals
+          ${{ matrix.runtime }}-trimmedpackages.json
 
   release:
     needs: build
     runs-on: ubuntu-latest
     steps:
 
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v3
 
     # Download runner package tar.gz/zip produced by 'build' job
-    - name: Download Artifact (win-x64)
-      uses: actions/download-artifact@v5
+    - name: Download Artifact
+      uses: actions/download-artifact@v1
       with:
-        name: runner-packages-win-x64
-        path: ./
-    - name: Download Artifact (win-arm64)
-      uses: actions/download-artifact@v5
-      with:
-        name: runner-packages-win-arm64
-        path: ./
-    - name: Download Artifact (osx-x64)
-      uses: actions/download-artifact@v5
-      with:
-        name: runner-packages-osx-x64
-        path: ./
-    - name: Download Artifact (osx-arm64)
-      uses: actions/download-artifact@v5
-      with:
-        name: runner-packages-osx-arm64
-        path: ./
-    - name: Download Artifact (linux-x64)
-      uses: actions/download-artifact@v5
-      with:
-        name: runner-packages-linux-x64
-        path: ./
-    - name: Download Artifact (linux-arm)
-      uses: actions/download-artifact@v5
-      with:
-        name: runner-packages-linux-arm
-        path: ./
-    - name: Download Artifact (linux-arm64)
-      uses: actions/download-artifact@v5
-      with:
-        name: runner-packages-linux-arm64
+        name: runner-packages
         path: ./
 
     # Create ReleaseNote file
     - name: Create ReleaseNote
       id: releaseNote
-      uses: actions/github-script@v8.0.0
+      uses: actions/github-script@0.3.0
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}
         script: |
+          const core = require('@actions/core')
           const fs = require('fs');
           const runnerVersion = fs.readFileSync('${{ github.workspace }}/src/runnerversion', 'utf8').replace(/\n$/g, '')
           var releaseNote = fs.readFileSync('${{ github.workspace }}/releaseNote.md', 'utf8').replace(/<RUNNER_VERSION>/g, runnerVersion)
           releaseNote = releaseNote.replace(/<WIN_X64_SHA>/g, '${{needs.build.outputs.win-x64-sha}}')
-          releaseNote = releaseNote.replace(/<WIN_ARM64_SHA>/g, '${{needs.build.outputs.win-arm64-sha}}')
           releaseNote = releaseNote.replace(/<OSX_X64_SHA>/g, '${{needs.build.outputs.osx-x64-sha}}')
           releaseNote = releaseNote.replace(/<OSX_ARM64_SHA>/g, '${{needs.build.outputs.osx-arm64-sha}}')
           releaseNote = releaseNote.replace(/<LINUX_X64_SHA>/g, '${{needs.build.outputs.linux-x64-sha}}')
           releaseNote = releaseNote.replace(/<LINUX_ARM_SHA>/g, '${{needs.build.outputs.linux-arm-sha}}')
           releaseNote = releaseNote.replace(/<LINUX_ARM64_SHA>/g, '${{needs.build.outputs.linux-arm64-sha}}')
+          releaseNote = releaseNote.replace(/<WIN_X64_SHA_NOEXTERNALS>/g, '${{needs.build.outputs.win-x64-sha-noexternals}}')
+          releaseNote = releaseNote.replace(/<OSX_X64_SHA_NOEXTERNALS>/g, '${{needs.build.outputs.osx-x64-sha-noexternals}}')
+          releaseNote = releaseNote.replace(/<OSX_ARM64_SHA_NOEXTERNALS>/g, '${{needs.build.outputs.osx-arm64-sha-noexternals}}')
+          releaseNote = releaseNote.replace(/<LINUX_X64_SHA_NOEXTERNALS>/g, '${{needs.build.outputs.linux-x64-sha-noexternals}}')
+          releaseNote = releaseNote.replace(/<LINUX_ARM_SHA_NOEXTERNALS>/g, '${{needs.build.outputs.linux-arm-sha-noexternals}}')
+          releaseNote = releaseNote.replace(/<LINUX_ARM64_SHA_NOEXTERNALS>/g, '${{needs.build.outputs.linux-arm64-sha-noexternals}}')
+          releaseNote = releaseNote.replace(/<WIN_X64_SHA_NORUNTIME>/g, '${{needs.build.outputs.win-x64-sha-noruntime}}')
+          releaseNote = releaseNote.replace(/<OSX_X64_SHA_NORUNTIME>/g, '${{needs.build.outputs.osx-x64-sha-noruntime}}')
+          releaseNote = releaseNote.replace(/<OSX_ARM64_SHA_NORUNTIME>/g, '${{needs.build.outputs.osx-arm64-sha-noruntime}}')
+          releaseNote = releaseNote.replace(/<LINUX_X64_SHA_NORUNTIME>/g, '${{needs.build.outputs.linux-x64-sha-noruntime}}')
+          releaseNote = releaseNote.replace(/<LINUX_ARM_SHA_NORUNTIME>/g, '${{needs.build.outputs.linux-arm-sha-noruntime}}')
+          releaseNote = releaseNote.replace(/<LINUX_ARM64_SHA_NORUNTIME>/g, '${{needs.build.outputs.linux-arm64-sha-noruntime}}')
+          releaseNote = releaseNote.replace(/<WIN_X64_SHA_NORUNTIME_NOEXTERNALS>/g, '${{needs.build.outputs.win-x64-sha-noruntime-noexternals}}')
+          releaseNote = releaseNote.replace(/<OSX_X64_SHA_NORUNTIME_NOEXTERNALS>/g, '${{needs.build.outputs.osx-x64-sha-noruntime-noexternals}}')
+          releaseNote = releaseNote.replace(/<OSX_ARM64_SHA_NORUNTIME_NOEXTERNALS>/g, '${{needs.build.outputs.osx-arm64-sha-noruntime-noexternals}}')
+          releaseNote = releaseNote.replace(/<LINUX_X64_SHA_NORUNTIME_NOEXTERNALS>/g, '${{needs.build.outputs.linux-x64-sha-noruntime-noexternals}}')
+          releaseNote = releaseNote.replace(/<LINUX_ARM_SHA_NORUNTIME_NOEXTERNALS>/g, '${{needs.build.outputs.linux-arm-sha-noruntime-noexternals}}')
+          releaseNote = releaseNote.replace(/<LINUX_ARM64_SHA_NORUNTIME_NOEXTERNALS>/g, '${{needs.build.outputs.linux-arm64-sha-noruntime-noexternals}}')
           console.log(releaseNote)
           core.setOutput('version', runnerVersion);
           core.setOutput('note', releaseNote);
 
     - name: Validate Packages HASH
+      working-directory: _package
       run: |
         ls -l
         echo "${{needs.build.outputs.win-x64-sha}}  actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}.zip" | shasum -a 256 -c
-        echo "${{needs.build.outputs.win-arm64-sha}}  actions-runner-win-arm64-${{ steps.releaseNote.outputs.version }}.zip" | shasum -a 256 -c
         echo "${{needs.build.outputs.osx-x64-sha}}  actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c
         echo "${{needs.build.outputs.osx-arm64-sha}}  actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c
         echo "${{needs.build.outputs.linux-x64-sha}}  actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}.tar.gz" | shasum -a 256 -c
@@ -214,132 +291,305 @@ jobs:
 
     # Upload release assets (full runner packages)
     - name: Upload Release Asset (win-x64)
-      uses: actions/upload-release-asset@v1.0.2
+      uses: actions/upload-release-asset@v1.0.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}.zip
+        asset_path: ${{ github.workspace }}/_package/actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}.zip
         asset_name: actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}.zip
         asset_content_type: application/octet-stream
 
-    - name: Upload Release Asset (win-arm64)
-      uses: actions/upload-release-asset@v1.0.2
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-win-arm64-${{ steps.releaseNote.outputs.version }}.zip
-        asset_name: actions-runner-win-arm64-${{ steps.releaseNote.outputs.version }}.zip
-        asset_content_type: application/octet-stream
-
     - name: Upload Release Asset (linux-x64)
-      uses: actions/upload-release-asset@v1.0.2
+      uses: actions/upload-release-asset@v1.0.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}.tar.gz
+        asset_path: ${{ github.workspace }}/_package/actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_name: actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (osx-x64)
-      uses: actions/upload-release-asset@v1.0.2
+      uses: actions/upload-release-asset@v1.0.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}.tar.gz
+        asset_path: ${{ github.workspace }}/_package/actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_name: actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (osx-arm64)
-      uses: actions/upload-release-asset@v1.0.2
+      uses: actions/upload-release-asset@v1.0.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz
+        asset_path: ${{ github.workspace }}/_package/actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_name: actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (linux-arm)
-      uses: actions/upload-release-asset@v1.0.2
+      uses: actions/upload-release-asset@v1.0.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}.tar.gz
+        asset_path: ${{ github.workspace }}/_package/actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_name: actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_content_type: application/octet-stream
 
     - name: Upload Release Asset (linux-arm64)
-      uses: actions/upload-release-asset@v1.0.2
+      uses: actions/upload-release-asset@v1.0.1
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
         upload_url: ${{ steps.createRelease.outputs.upload_url }}
-        asset_path: ${{ github.workspace }}/actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz
+        asset_path: ${{ github.workspace }}/_package/actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_name: actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}.tar.gz
         asset_content_type: application/octet-stream
 
-  publish-image:
-    needs: release
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    env:
-      REGISTRY: ghcr.io
-      IMAGE_NAME: ${{ github.repository_owner }}/actions-runner
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
+    # Upload release assets (trim externals)
+    - name: Upload Release Asset (win-x64-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_externals/actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-noexternals.zip
+        asset_name: actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-noexternals.zip
+        asset_content_type: application/octet-stream
 
-      - name: Compute image version
-        id: image
-        uses: actions/github-script@v8.0.0
-        with:
-          script: |
-            const fs = require('fs');
-            const runnerVersion = fs.readFileSync('${{ github.workspace }}/releaseVersion', 'utf8').replace(/\n$/g, '')
-            console.log(`Using runner version ${runnerVersion}`)
-            core.setOutput('version', runnerVersion);
+    - name: Upload Release Asset (linux-x64-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_externals/actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_name: actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_content_type: application/octet-stream
 
-      - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+    - name: Upload Release Asset (osx-x64-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_externals/actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_name: actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_content_type: application/octet-stream
 
-      - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Upload Release Asset (osx-arm64-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_externals/actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_name: actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_content_type: application/octet-stream
 
-      - name: Build and push Docker image
-        id: build-and-push
-        uses: docker/build-push-action@v6
-        with:
-          context: ./images
-          platforms: |
-            linux/amd64
-            linux/arm64
-          tags: |
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.image.outputs.version }}
-            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
-          build-args: |
-            RUNNER_VERSION=${{ steps.image.outputs.version }}
-          push: true
-          labels: |
-            org.opencontainers.image.source=${{github.server_url}}/${{github.repository}}
-            org.opencontainers.image.description=https://github.com/actions/runner/releases/tag/v${{ steps.image.outputs.version }}
-            org.opencontainers.image.licenses=MIT
+    - name: Upload Release Asset (linux-arm-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_externals/actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_name: actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_content_type: application/octet-stream
 
-      - name: Generate attestation
-        uses: actions/attest-build-provenance@v3
-        with:
-          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          subject-digest: ${{ steps.build-and-push.outputs.digest }}
-          push-to-registry: true
+    - name: Upload Release Asset (linux-arm64-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_externals/actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_name: actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-noexternals.tar.gz
+        asset_content_type: application/octet-stream
+
+    # Upload release assets (trim runtime)
+    - name: Upload Release Asset (win-x64-noruntime)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime/actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-noruntime.zip
+        asset_name: actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-noruntime.zip
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-x64-noruntime)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime/actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_name: actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (osx-x64-noruntime)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime/actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_name: actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (osx-arm64-noruntime)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime/actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_name: actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-arm-noruntime)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime/actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_name: actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-arm64-noruntime)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime/actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_name: actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-noruntime.tar.gz
+        asset_content_type: application/octet-stream
+
+    # Upload release assets (trim runtime and externals)
+    - name: Upload Release Asset (win-x64-noruntime-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime_externals/actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.zip
+        asset_name: actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.zip
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-x64-noruntime-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime_externals/actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_name: actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (osx-x64-noruntime-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime_externals/actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_name: actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (osx-arm64-noruntime-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime_externals/actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_name: actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-arm-noruntime-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime_externals/actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_name: actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-arm64-noruntime-noexternals)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/_package_trims/trim_runtime_externals/actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_name: actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-noruntime-noexternals.tar.gz
+        asset_content_type: application/octet-stream
+
+    # Upload release assets (trimmedpackages.json)
+    - name: Upload Release Asset (win-x64-trimmedpackages.json)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/win-x64-trimmedpackages.json
+        asset_name: actions-runner-win-x64-${{ steps.releaseNote.outputs.version }}-trimmedpackages.json
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-x64-trimmedpackages.json)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/linux-x64-trimmedpackages.json
+        asset_name: actions-runner-linux-x64-${{ steps.releaseNote.outputs.version }}-trimmedpackages.json
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (osx-x64-trimmedpackages.json)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/osx-x64-trimmedpackages.json
+        asset_name: actions-runner-osx-x64-${{ steps.releaseNote.outputs.version }}-trimmedpackages.json
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (osx-arm64-trimmedpackages.json)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/osx-arm64-trimmedpackages.json
+        asset_name: actions-runner-osx-arm64-${{ steps.releaseNote.outputs.version }}-trimmedpackages.json
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-arm-trimmedpackages.json)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/linux-arm-trimmedpackages.json
+        asset_name: actions-runner-linux-arm-${{ steps.releaseNote.outputs.version }}-trimmedpackages.json
+        asset_content_type: application/octet-stream
+
+    - name: Upload Release Asset (linux-arm64-trimmedpackages.json)
+      uses: actions/upload-release-asset@v1.0.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ steps.createRelease.outputs.upload_url }}
+        asset_path: ${{ github.workspace }}/linux-arm64-trimmedpackages.json
+        asset_name: actions-runner-linux-arm64-${{ steps.releaseNote.outputs.version }}-trimmedpackages.json
+        asset_content_type: application/octet-stream

.github/workflows/stale-bot.yml

@@ -1,16 +0,0 @@
-name: Stale Bot
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '0 0 * * 1' # every monday at midnight
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v10
-        with:
-          stale-issue-message: "This issue is stale because it has been open 365 days with no activity. Remove stale label or comment or this will be closed in 15 days."
-          close-issue-message: "This issue was closed because it has been stalled for 15 days with no activity."
-          exempt-issue-labels: "keep"
-          days-before-stale: 365
-          days-before-close: 15

.gitignore

@@ -26,5 +26,4 @@ _dotnetsdk
 TestResults
 TestLogs
 .DS_Store
-.mono
 **/*.DotSettings.user

.husky/pre-commit

@@ -1 +0,0 @@
-cd src/Misc/expressionFunc/hashFiles && npx lint-staged

README.md

@@ -20,20 +20,6 @@ Runner releases:
 
 ![linux](docs/res/linux_sm.png)  [Pre-reqs](docs/start/envlinux.md) | [Download](https://github.com/actions/runner/releases)
 
-### Note
+## Contribute
 
-Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. 
-
-We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
-
-We are taking the following steps to better direct requests related to GitHub Actions, including:
-
-1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions)
-
-2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
-
-3. Security Issues should be handled as per our [security.md](security.md)
-
-We will still provide security updates for this project and fix major breaking changes during this time.
-
-You are welcome to still raise bugs in this repo.
+We accept contributions in the form of issues and pull requests.  [Read more here](docs/contribute.md) before contributing.

docs/adrs/0276-problem-matchers.md

@@ -250,42 +250,6 @@ Two problem matchers can be used:
 }
 ```
 
-#### Default from path
-
-The problem matcher can specify a `fromPath` property at the top level, which applies when a specific pattern doesn't provide a value for `fromPath`. This is useful for tools that don't include project file information in their output.
-
-For example, given the following compiler output that doesn't include project file information:
-
-```
-ClassLibrary.cs(16,24): warning CS0612: 'ClassLibrary.Helpers.MyHelper.Name' is obsolete
-```
-
-A problem matcher with a default from path can be used:
-
-```json
-{
-    "problemMatcher": [
-        {
-            "owner": "csc-minimal",
-            "fromPath": "ClassLibrary/ClassLibrary.csproj",
-            "pattern": [
-                {
-                    "regexp": "^(.+)\\((\\d+),(\\d+)\\): (error|warning) (.+): (.*)$",
-                    "file": 1,
-                    "line": 2,
-                    "column": 3,
-                    "severity": 4,
-                    "code": 5,
-                    "message": 6
-                }
-            ]
-        }
-    ]
-}
-```
-
-This ensures that the file is rooted to the correct path when there's not enough information in the error messages to extract a `fromPath`.
-
 #### Mitigate regular expression denial of service (ReDos)
 
 If a matcher exceeds a 1 second timeout when processing a line, retry up to two three times total.

docs/adrs/1751-runner-job-hooks.md

@@ -23,7 +23,7 @@ This feature is mainly intended for self hosted runner administrators.
   - `ACTIONS_RUNNER_HOOK_JOB_STARTED`
   - `ACTIONS_RUNNER_HOOK_JOB_COMPLETED`
 
-You can set these variables to the **absolute** path of a `.sh` or `.ps1` file.
+You can set these variables to the **absolute** path of a a `.sh` or `.ps1` file.
 
 We will execute `pwsh` (fallback to `powershell`) or `bash` (fallback to `sh`) as appropriate.
 - `.sh` files will execute with the args `-e {pathtofile}`

docs/adrs/1891-container-hooks.md

@@ -1,596 +0,0 @@
-# ADR 0000: Container Hooks
-
-**Date**: 2022-05-12
-
-**Status**: Accepted
-
-# Background
-
-[Job Hooks](https://github.com/actions/runner/blob/main/docs/adrs/1751-runner-job-hooks.md) have given users the ability to customize how their self hosted runners run a job.
-Users also want the ability to customize how they run containers during the scope of the job, rather then being locked into the docker implementation we have in the runner. They may want to use podman, kubernetes, or even change the docker commands we run. 
-We should give them that option, and publish examples how how they can create their own hooks.
-
-# Guiding Principles
-- **Extensibility** is the focus, we need to make sure we are flexible enough to cover current and future scenarios, even at the cost of making it harder to utilize these hooks
-- Args should map **directly** to yaml values provided by the user. 
-  - For example, the current runner overrides `HOME`, we can do that in the hook, but we shouldn't pass that hook as an ENV with the other env's the user has set, as that is not user input, it is how the runner invokes containers
-
-## Interface
-- You will set the variable `ACTIONS_RUNNER_CONTAINER_HOOKS=/Users/foo/runner/hooks.js` which is the entrypoint to your hook handler.
-  - There is no partial opt in, you must handle every hook 
-- We will pass a command and some args via `stdin`
-- An exit code of 0 is a success, every other exit code is a failure
-- We will support the same runner commands we support in [Job Hooks](https://github.com/actions/runner/blob/main/docs/adrs/1751-runner-job-hooks.md)
-- On timeout, we will send a sigint to your process. If you fail to terminate within a reasonable amount of time, we will send a sigkill, and eventually kill the process tree.
-
-An example input looks like
-```json
-{
-  "command": "job_cleanup",
-  "responseFile": "/users/thboop/runner/_work/{guid}.json",
-  "args": {},
-  "state": 
-  {
-      "id": "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480"
-  }
-}
-```
-
-`command` is the command we expect you to invoke
-`responseFile` is the file you need to write your output to, if the command has output
-`args` are the specific arguments the command needs
-`state` is a json blog you can pass around to maintain your state, this is covered in more details below.
-
-### Writing responses to a file
-All text written to stdout or stderr should appear in the job or step logs. With that in mind, we support a few ways to actually return data:
-1. Wrapping the json in some unique tag and processing it like we do commands
-2. Writing to a file
-
-For 1, users typically view logging information as a safe action, so we worry someone accidentialy logging unsantized information and causing unexpected or un-secure behavior. We eventually plan to move off of stdout/stderr style commands in favor of a runner cli. 
-Investing in this area doesn't make a lot of sense at this time.
-
-While writing to a file to communicate isn't the most ideal pattern, its an existing pattern in the runner and serves us well, so lets reuse it.
-
-### Output
-Your output must be correctly formatted json. An example output looks like:
-
-```
-{
-  "state": {},
-  "context"
-  {
-    "container" : 
-    {
-      "id": "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480"
-      "network": "github_network_53269bd575974817b43f4733536b200c"
-    }
-    "services": {
-      "redis": {
-        "id": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105",
-        "ports": {
-          "8080": "8080"
-        },
-      "network": "github_network_53269bd575974817b43f4733536b200c"
-    }
-  }
-  "alpine: true,
-}
-```
-
-`state` is a unique field any command can return. If it is not empty, we will store the state for you and pass it into all future commands. You can overwrite it by having the next hook invoked return a unique state.
-
-Other fields are dependent upon the command being run.
-
-### Versioning
-We will not version these hooks at launch. If needed, we can always major version split these hooks in the future. We will ship in Beta to allow for breaking changes for a few months.
-
-### The Job Context
-The [job context](https://docs.github.com/en/actions/learn-github-actions/contexts#example-contents-of-the-job-context) currently has a variety of fields that correspond to containers. We should consider allowing hooks to populate new fields in the job context. That is out of scope for this original release however.
-
-## Hooks
-Hooks are to be implemented at a very high level, and map to actions the runner does, rather then specific docker actions like `docker build` or `docker create`. By mapping to runner actions, we create a very extensible framework that is flexible enough to solve any user concerns in the future. By providing first party implementations, we give users easy starting points to customize specific hooks (like `docker build`) without having to write full blown solutions.
-
-The other would be to provide hooks that mirror every docker call we make, and expose more hooks to help support k8s users, with the expectation that users may have to no-op on multiple hooks if they don't correspond to our use case.
-
-Why we don't want to go that way
-- It feels clunky, users need to understand which hooks they need to implement and which they can ignore, which isn't a great UX
-- It doesn't scale well, I don't want to build a solution where we may need to add more hooks, by mapping to runner actions, updating hooks is a painful experience for users
-- Its overwhelming, its easier to tell users to build 4 hooks and track data themselves, rather then 16 hooks where the runner needs certain information and then needs to provide that information back into each hook. If we expose `Container Create`, you need to return the container you created, then we do `container run` which uses that container. If we just give you an image and say create and run this container, you don't need to store the container id in the runner, and it maps better to k8s scenarios where we don't really have container ids.
-
-### Prepare_job hook
-The `prepare_job` hook is called when a job is started. We pass in any job or service containers the job has. We expect that you:
-- Prune anything from previous jobs if needed
-- Create a network if needed
-- Pull the job and service containers
-- Start the job container
-- Start the service containers
-- Write to the response file some information we need
-  - Required: if the container is alpine, otherwise x64
-  - Optional: any context fields you want to set on the job context, otherwise they will be unavailable for users to use
-- Return 0 when the health checks have succeeded and the job/service containers are started
-
-This hook will **always** be called if you have container hooks enabled, even if no service or job containers exist in the job. This allows you to fail the job or implement a default job container if you want to and no job container has been provided.
-
-
-<details>
-<summary>Example Input</summary>
-<br>
-  
-```
-{
-  "command": "prepare_job",
-  "responseFile": "/users/thboop/runner/_work/{guid}.json",
-  "state": {},
-  "args": 
-  {
-    "jobContainer": {
-      "image": "node:14.16",
-      "workingDirectory": "/__w/thboop-test2/thboop-test2",
-      "createOptions": "--cpus 1",
-      "environmentVariables": {
-        "NODE_ENV": "development"
-      },
-      "userMountVolumes:[
-        {
-          "sourceVolumePath": "my_docker_volume",
-          "targetVolumePath": "/volume_mount",
-          "readOnly": false
-        },
-      ],
-      "mountVolumes": [
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work",
-          "targetVolumePath": "/__w",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/externals",
-          "targetVolumePath": "/__e",
-          "readOnly": true
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp",
-          "targetVolumePath": "/__w/_temp",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_actions",
-          "targetVolumePath": "/__w/_actions",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_tool",
-          "targetVolumePath": "/__w/_tool",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp/_github_home",
-          "targetVolumePath": "/github/home",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp/_github_workflow",
-          "targetVolumePath": "/github/workflow",
-          "readOnly": false
-        }
-      ],
-      "registry": {
-        "username": "foo",
-        "password": "bar",
-        "serverUrl": "https://index.docker.io/v1"
-      },
-      "portMappings": [ "8080:80/tcp", "8080:80/udp" ]
-    },
-    "services": [
-      {
-        "contextName": "redis",
-        "image": "redis",
-        "createOptions": "--cpus 1",
-        "environmentVariables": {},
-        "mountVolumes": [],
-        "portMappings": [ "8080:80/tcp", "8080:80/udp" ]
-        "registry": {
-          "username": "foo",
-          "password": "bar",
-          "serverUrl": "https://index.docker.io/v1"
-        }
-      }
-    ]
-  }
-}
-```
-
-</details>
-
-<details>
-<summary>Field Descriptions</summary>
-<br>
-
-```
-Arg Fields:
-
-jobContainer: **Optional** An Object containing information about the specified job container
-  "image": **Required** A string containing the docker image
-  "workingDirectory": **Required** A string containing the absolute path of the working directory
-  "createOptions": **Optional** The optional create options specified in the [YAML](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container#example-running-a-job-within-a-container)
-  "environmentVariables": **Optional** A map of key value env's to set
-  "userMountVolumes: ** Optional** an array of user mount volumes set in the [YAML](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container#example-running-a-job-within-a-container)
-    "sourceVolumePath": **Required** The source path to the volume to be mounted into the docker container
-    "targetVolumePath": **Required** The target path to the volume to be mounted into the docker container
-    "readOnly": false **Required** whether or not the mount should be read only
-  "mountVolumes": **Required** an array of mounts to mount into the container, same fields as above
-    "sourceVolumePath": **Required** The source path to the volume to be mounted into the docker container
-    "targetVolumePath": **Required** The target path to the volume to be mounted into the docker container
-    "readOnly": false **Required** whether or not the mount should be read only
-  "registry" **Optional** docker registry credentials to use when using a private container registry
-    "username": **Optional** the username
-    "password": **Optional** the password
-    "serverUrl": **Optional** the registry url
-  "portMappings": **Optional** an array of source:target ports to map into the container
- 
-"services": an array of service containers to spin up
-  "contextName": **Required** the name of the service in the Job context
-  "image": **Required** A string containing the docker image
-  "createOptions": **Optional** The optional create options specified in the [YAML](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container#example-running-a-job-within-a-container)
-  "environmentVariables": **Optional** A map of key value env's to set
-  "mountVolumes": **Required** an array of mounts to mount into the container, same fields as above
-    "sourceVolumePath": **Required** The source path to the volume to be mounted into the docker container
-    "targetVolumePath": **Required** The target path to the volume to be mounted into the docker container
-    "readOnly": false **Required** whether or not the mount should be read only
-  "registry" **Optional** docker registry credentials to use when using a private container registry
-    "username": **Optional** the username
-    "password": **Optional** the password
-    "serverUrl": **Optional** the registry url
-  "portMappings": **Optional** an array of source:target ports to map into the container
-```
-
-</details>
-
-<details>
-<summary>Example Output</summary>
-<br>
-
-```
-{
-  "state": 
-  {
-    "network": "github_network_53269bd575974817b43f4733536b200c",
-    "jobContainer" : "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480",
-    "serviceContainers": 
-    {
-      "redis": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105"
-    }
-  },
-  "context"
-  {
-    "container" : 
-    {
-      "id": "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480"
-      "network": "github_network_53269bd575974817b43f4733536b200c"
-    }
-    "services": {
-      "redis": {
-        "id": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105",
-        "ports": {
-          "8080": "8080"
-        },
-      "network": "github_network_53269bd575974817b43f4733536b200c"
-    }
-  }
-  "alpine: true,
-}
-```
-
-</details>
-
-
-### Cleanup Job
-The `cleanup_job` hook is called at the end of a job and expects you to:
-- Stop any running service or job containers (or the equiavalent pod)
-- Stop the network (if one exists)
-- Delete any job or service containers (or the equiavalent pod)
-- Delete the network (if one exists)
-- Cleanup anything else that was created for the run
-
-Its input looks like
-
-<details>
-<summary>Example Input</summary>
-<br>
-
-```
-  "command": "cleanup_job",
-  "responseFile": null,
-  "state":
-  {
-    "network": "github_network_53269bd575974817b43f4733536b200c",
-    "jobContainer" : "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480",
-    "serviceContainers": 
-    {
-      "redis": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105"
-    }
-  }
-  "args": {}
-```
-  
-</details>
-
-No args are provided.
-  
-No output is expected.
-
-
-### Run Container Step
-The `run_container_step` is called once per container action in your job and expects you to:
-- Pull or build the required container (or fail if you cannot)
-- Run the container action and return the exit code of the container
-- Stream any step logs output to stdout and stderr
-- Cleanup the container after it executes
-
-<details>
-<summary>Example Input for Image</summary>
-<br>
-
-```
-  "command": "run_container_step",
-  "responseFile": null,
-  "state":
-  {
-    "network": "github_network_53269bd575974817b43f4733536b200c",
-    "jobContainer" : "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480",
-    "serviceContainers": 
-    {
-      "redis": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105"
-    }
-  }
-  "args":      
-  {
-      "image": "node:14.16",
-      "dockerfile": null,
-      "entryPointArgs": ["-f", "/dev/null"],
-      "entryPoint": "tail",
-      "workingDirectory": "/__w/thboop-test2/thboop-test2",
-      "createOptions": "--cpus 1",
-      "environmentVariables": {
-        "NODE_ENV": "development"
-      },
-      "prependPath":["/foo/bar", "bar/foo"]
-      "userMountVolumes:[
-        {
-          "sourceVolumePath": "my_docker_volume",
-          "targetVolumePath": "/volume_mount",
-          "readOnly": false
-        },
-      ],
-      "mountVolumes": [
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work",
-          "targetVolumePath": "/__w",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/externals",
-          "targetVolumePath": "/__e",
-          "readOnly": true
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp",
-          "targetVolumePath": "/__w/_temp",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_actions",
-          "targetVolumePath": "/__w/_actions",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_tool",
-          "targetVolumePath": "/__w/_tool",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp/_github_home",
-          "targetVolumePath": "/github/home",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp/_github_workflow",
-          "targetVolumePath": "/github/workflow",
-          "readOnly": false
-        }
-      ],
-      "registry": null,
-      "portMappings": { "80": "801" }
-    },
-```
-  
-</details>
-
-
-<details>
-<summary>Example Input for dockerfile</summary>
-<br>
-
-```
-  "command": "run_container_step",
-  "responseFile": null,
-  "state":
-  {
-    "network": "github_network_53269bd575974817b43f4733536b200c",
-    "jobContainer" : "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480",
-    "services": 
-    {
-      "redis": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105"
-    }
-  }
-  "args":      
-  {
-      "image": null,
-      "dockerfile": /__w/_actions/foo/dockerfile,
-      "entryPointArgs": ["hello world"],
-      "entryPoint": "echo",
-      "workingDirectory": "/__w/thboop-test2/thboop-test2",
-      "createOptions": "--cpus 1",
-      "environmentVariables": {
-        "NODE_ENV": "development"
-      },
-      "prependPath":["/foo/bar", "bar/foo"]
-      "userMountVolumes:[
-        {
-          "sourceVolumePath": "my_docker_volume",
-          "targetVolumePath": "/volume_mount",
-          "readOnly": false
-        },
-      ],      
-      "mountVolumes": [
-        {
-          "sourceVolumePath": "my_docker_volume",
-          "targetVolumePath": "/volume_mount",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work",
-          "targetVolumePath": "/__w",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/externals",
-          "targetVolumePath": "/__e",
-          "readOnly": true
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp",
-          "targetVolumePath": "/__w/_temp",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_actions",
-          "targetVolumePath": "/__w/_actions",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_tool",
-          "targetVolumePath": "/__w/_tool",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp/_github_home",
-          "targetVolumePath": "/github/home",
-          "readOnly": false
-        },
-        {
-          "sourceVolumePath": "/home/thomas/git/runner/_layout/_work/_temp/_github_workflow",
-          "targetVolumePath": "/github/workflow",
-          "readOnly": false
-        }
-      ],
-      "registry": null,
-      "portMappings": [ "8080:80/tcp", "8080:80/udp" ]
-    },
-  }
-```
-  
-</details>
-
-
-<details>
-<summary>Field Descriptions</summary>
-<br>
-
-```
-Arg Fields:
-
-
-"image": **Optional** A string containing the docker image. Otherwise a dockerfile must be provided
-"dockerfile": **Optional** A string containing the path to the dockerfile, otherwise an image must be provided
-"entryPointArgs": **Optional** A list containing the entry point args
-"entryPoint": **Optional** The container entry point to use if the default image entrypoint should be overwritten
-"workingDirectory": **Required** A string containing the absolute path of the working directory
-"createOptions": **Optional** The optional create options specified in the [YAML](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container#example-running-a-job-within-a-container)
-"environmentVariables": **Optional** A map of key value env's to set
-"prependPath": **Optional** an array of additional paths to prepend to the $PATH variable
-"userMountVolumes: ** Optional** an array of user mount volumes set in the [YAML](https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container#example-running-a-job-within-a-container)
-  "sourceVolumePath": **Required** The source path to the volume to be mounted into the docker container
-  "targetVolumePath": **Required** The target path to the volume to be mounted into the docker container
-  "readOnly": false **Required** whether or not the mount should be read only
-"mountVolumes": **Required** an array of mounts to mount into the container, same fields as above
-  "sourceVolumePath": **Required** The source path to the volume to be mounted into the docker container
-  "targetVolumePath": **Required** The target path to the volume to be mounted into the docker container
-  "readOnly": false **Required** whether or not the mount should be read only
-"registry" **Optional** docker registry credentials to use when using a private container registry
-  "username": **Optional** the username
-  "password": **Optional** the password
-  "serverUrl": **Optional** the registry url
-"portMappings": **Optional** an array of source:target ports to map into the container
-```
-  
-</details>
-
-No output is expected
-
-Currently we build all container actions at the start of the job. By doing it during the hook, we move this to just in time building for hooks. We could expose a hook to build/pull a container action, and have those called at the start of a job, but doing so would require hook authors to track the build containers in the state, which could be painful.
-
-### Run Script Step
-The `run_script_step` expects you to:
-- Invoke the provided script inside the job container and return the exit code
-- Stream any step log output to stdout and stderr
-
-<details>
-<summary>Example Input</summary>
-<br>
-
-
-```
-  "command": "run_script_step",
-  "responseFile": null,
-  "state":
-  {
-    "network": "github_network_53269bd575974817b43f4733536b200c",
-    "jobContainer" : "82e8219701fe096a35941d869cf8d71af1d943b5d3bdd718850fb87ac3042480",
-    "serviceContainers": 
-    {
-      "redis": "60972d9aa486605e66b0dad4abb638dc3d9116f566579e418166eedb8abb9105"
-    }
-  }
-  "args": 
-  {
-    "entryPointArgs": ["-e", "/runner/temp/abc123.sh"],
-    "entryPoint": "bash",
-    "environmentVariables": {
-      "NODE_ENV": "development"
-    },
-    "prependPath": ["/foo/bar", "bar/foo"],
-    "workingDirectory": "/__w/thboop-test2/thboop-test2"
-  }
-```
-  
-</details>
-
-<details>
-<summary>Field Descriptions</summary>
-<br>
-
-```
-Arg Fields:
-
-  
-"entryPointArgs": **Optional** A list containing the entry point args
-"entryPoint": **Optional** The container entry point to use if the default image entrypoint should be overwritten
-"prependPath": **Optional** an array of additional paths to prepend to the $PATH variable
-"workingDirectory": **Required** A string containing the absolute path of the working directory
-"environmentVariables": **Optional** A map of key value env's to set
-```
-
-</details>
-
-No output is expected
-
-
-## Limitations
-- We will only support linux on launch
-- Hooks are set by the runner admin, and thus are only supported on self hosted runners 
-
-## Consequences
-- We support non docker scenarios for self hosted runners and allow customers to customize their docker invocations
-- We ship/maintain docs on docker hooks and an open source repo with examples
-- We support these hooks and add enough telemetry to be able to troubleshoot support issues as they come in.

docs/adrs/2494-runner-image-tags.md

@@ -1,65 +0,0 @@
-# ADR 2494: Runner Image Tags
-
-**Date**: 2023-03-17
-
-**Status**: Accepted<!-- |Accepted|Rejected|Superceded|Deprecated -->
-
-## Context
-
-Following the [adoption of actions-runner-controller by GitHub](https://github.com/actions/actions-runner-controller/discussions/2072) and the introduction of the new runner scale set autoscaling mode, we needed to provide a basic runner image that could be used off the shelf without much friction.
-
-The [current runner image](https://github.com/actions/runner/pkgs/container/actions-runner) is published to GHCR. Each release of this image is tagged with the runner version and the most recent release is also tagged with `latest`.
-
-While the use of `latest` is common practice, we recommend that users pin a specific version of the runner image for a predictable runtime and improved security posture. However, we still notice that a large number of end users are relying on the `latest` tag & raising issues when they encounter problems.
-
-Add to that, the community actions-runner-controller maintainers have issued a [deprecation notice](https://github.com/actions/actions-runner-controller/issues/2056) of the `latest` tag for the existing runner images (https://github.com/orgs/actions-runner-controller/packages).
-
-## Decision
-
-Proceed with Option 2, keeping the `latest` tag and adding the `NOTES.txt` file to our helm charts with the notice.
-
-### Option 1: Remove the `latest` tag
-
-By removing the `latest` tag, we have to proceed with either of these options:
-
-1. Remove the runner image reference in the `values.yaml` provided with the `gha-runner-scale-set` helm chart and mark these fields as required so that users have to explicitly specify a runner image and a specific tag. This will obviously introduce more  friction for users who want to start using actions-runner-controller for the first time.
-
-```yaml
-  spec:
-    containers:
-    - name: runner
-      image: ""
-      tag: ""
-      command: ["/home/runner/run.sh"]
-```
-
-1. Pin a specific runner image tag in the `values.yaml` provided with the `gha-runner-scale-set` helm chart. This will reduce friction for users who want to start using actions-runner-controller for the first time but will require us to update the `values.yaml` with every new runner release.
-
-```yaml
-  spec:
-    containers:
-    - name: runner
-      image: "ghcr.io/actions/actions-runner"
-      tag: "v2.300.0"
-      command: ["/home/runner/run.sh"]
-```
-
-### Option 2: Keep the `latest` tag
-
-Keeping the `latest` tag is also a reasonable option especially if we don't expect to make any breaking changes to the runner image. We could enhance this by adding a [NOTES.txt](https://helm.sh/docs/chart_template_guide/notes_files/) to the helm chart which will be displayed to the user after a successful helm install/upgrade. This will help users understand the implications of using the `latest` tag and how to pin a specific version of the runner image.
-
-The runner image release workflow will need to be updated so that the image is pushed to GHCR and tagged only when the runner rollout has reached all scale units.
-
-## Consequences
-
-Proceeding with **option 1** means:
-
-1. We will enhance the runtime predictability and security posture of our end users
-1. We will have to update the `values.yaml` with every new runner release (that can be automated)
-1. We will introduce friction for users who want to start using actions-runner-controller for the first time
-
-Proceeding with **option 2** means:
-
-1. We will have to continue to maintain the `latest` tag
-1. We will assume that end users will be able to handle the implications of using the `latest` tag
-1. Runner image release workflow needs to be updated 

docs/checks/actions.md

@@ -7,26 +7,19 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente
 
 - For GitHub.com
   - The runner needs to access `https://api.github.com` for downloading actions.
-  - The runner needs to access `https://codeload.github.com` for downloading actions tar.gz/zip.
   - The runner needs to access `https://vstoken.actions.githubusercontent.com/_apis/.../` for requesting an access token.
   - The runner needs to access `https://pipelines.actions.githubusercontent.com/_apis/.../` for receiving workflow jobs.
-  - The runner needs to access `https://results-receiver.actions.githubusercontent.com/.../` for reporting progress and uploading logs during a workflow job execution.
-  ---
-  **NOTE:** for the full list of domains that are required to be in the firewall allow list refer to the [GitHub self-hosted runners requirements documentation](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github).
 
   These can by tested by running the following `curl` commands from your self-hosted runner machine:
 
     ```
-    curl -v https://api.github.com/zen
-    curl -v https://codeload.github.com/_ping
+    curl -v https://api.github.com/api/v3/zen
     curl -v https://vstoken.actions.githubusercontent.com/_apis/health
-    curl -v https://pipelines.actions.githubusercontent.com/_apis/health
-    curl -v https://results-receiver.actions.githubusercontent.com/health
+    curl -v https://pipelines.actions.githubusercontent/_apis/health
     ```
 
 - For GitHub Enterprise Server
   - The runner needs to access `https://[hostname]/api/v3` for downloading actions.
-  - The runner needs to access `https://codeload.[hostname]/_ping` for downloading actions tar.gz/zip.
   - The runner needs to access `https://[hostname]/_services/vstoken/_apis/.../` for requesting an access token.
   - The runner needs to access `https://[hostname]/_services/pipelines/_apis/.../` for receiving workflow jobs.
   
@@ -34,7 +27,6 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente
 
     ```
     curl -v https://[hostname]/api/v3/zen
-    curl -v https://codeload.[hostname]/_ping
     curl -v https://[hostname]/_services/vstoken/_apis/health
     curl -v https://[hostname]/_services/pipelines/_apis/health
     ```
@@ -50,10 +42,6 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente
 - Ping api.github.com or myGHES.com using dotnet
 - Make HTTP GET to https://api.github.com or https://myGHES.com/api/v3 using dotnet, check response headers contains `X-GitHub-Request-Id`
 ---
-- DNS lookup for codeload.github.com or codeload.myGHES.com using dotnet
-- Ping codeload.github.com or codeload.myGHES.com using dotnet
-- Make HTTP GET to https://codeload.github.com/_ping or https://codeload.myGHES.com/_ping using dotnet, check response headers contains `X-GitHub-Request-Id`
----
 - DNS lookup for vstoken.actions.githubusercontent.com using dotnet
 - Ping vstoken.actions.githubusercontent.com using dotnet
 - Make HTTP GET to https://vstoken.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/vstoken/_apis/health using dotnet, check response headers contains `x-vss-e2eid`
@@ -62,10 +50,6 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente
 - Ping pipelines.actions.githubusercontent.com using dotnet
 - Make HTTP GET to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid`
 - Make HTTP POST to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid`
----
-- DNS lookup for results-receiver.actions.githubusercontent.com using dotnet
-- Ping results-receiver.actions.githubusercontent.com using dotnet
-- Make HTTP GET to https://results-receiver.actions.githubusercontent.com/health using dotnet, check response headers contains `X-GitHub-Request-Id`
 
 ## How to fix the issue?
 
@@ -80,4 +64,4 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente
   
 ## Still not working?
 
-Contact [GitHub Support](https://support.github.com) if you have further questuons, or log an issue at https://github.com/actions/runner if you think it's a runner issue.
+Contact [GitHub Support](https://support.github.com] if you have further questuons, or log an issue at https://github.com/actions/runner if you think it's a runner issue.

docs/checks/git.md

@@ -20,30 +20,11 @@ The test also set environment variable `GIT_TRACE=1` and `GIT_CURL_VERBOSE=1` be
 
 ## How to fix the issue?
 
-### 1. Check global and system git config
-
-If you are having issues connecting to the server, check your global and system git config for any unexpected authentication headers. You might be seeing an error like:
-
-```
-fatal: unable to access 'https://github.com/actions/checkout/': The requested URL returned error: 400
-```
-
-The following commands can be used to check for unexpected authentication headers:
-
-```
-$ git config --global --list | grep extraheader
-http.extraheader=AUTHORIZATION: unexpected_auth_header
-
-$ git config --system --list | grep extraheader
-```
-
-The following command can be used to remove the above value: `git config --global --unset http.extraheader`
-
-### 2. Check the common network issue
+### 1. Check the common network issue
   
   > Please check the [network doc](./network.md)
 
-### 3. SSL certificate related issue
+### 2. SSL certificate related issue
 
   If you are seeing `SSL Certificate problem:` in the log, it means the `git` can't connect to the GitHub server due to SSL handshake failure.
   > Please check the [SSL cert doc](./sslcert.md)

docs/checks/network.md

@@ -14,7 +14,7 @@
 
 - A Proxy may try to modify the HTTPS request (like add or change some http headers) and causes the request become incompatible with the Actions Service (ASP.NetCore), Ex: [Nginx](https://github.com/dotnet/aspnetcore/issues/17081)
 
-- Firewall rules that block action runner from accessing [certain hosts](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github), ex: `*.github.com`, `*.actions.githubusercontent.com`, etc
+- Firewall rules that block action runner from accessing certain hosts, ex: `*.github.com`, `*.actions.githubusercontent.com`, etc
 
 
 ### Identify and solve these problems
@@ -42,7 +42,6 @@ If you are having trouble connecting, try these steps:
       - https://api.github.com/
       - https://vstoken.actions.githubusercontent.com/_apis/health
       - https://pipelines.actions.githubusercontent.com/_apis/health
-      - https://results-receiver.actions.githubusercontent.com/health
     - For GHES/GHAE
       - https://myGHES.com/_services/vstoken/_apis/health
       - https://myGHES.com/_services/pipelines/_apis/health

docs/checks/nodejs.md

@@ -4,9 +4,9 @@
 
 Make sure the built-in node.js has access to GitHub.com or GitHub Enterprise Server.
 
-The runner carries its own copies of node.js executables under `<runner_root>/externals/node20/` and `<runner_root>/externals/node24/`.
+The runner carries its own copy of node.js executable under `<runner_root>/externals/node16/`.
 
-All javascript base Actions will get executed by the built-in `node` at either `<runner_root>/externals/node20/` or `<runner_root>/externals/node24/` depending on the version specified in the action's metadata.
+All javascript base Actions will get executed by the built-in `node` at `<runner_root>/externals/node16/`.
 
 > Not the `node` from `$PATH`
 

docs/contribute.md

@@ -1,6 +1,6 @@
 # Contributions
 
-We welcome contributions in the form of issues and pull requests. We view the contributions and the process as the same for github and external contributors. Please note the runner typically requires changes across the entire system and we aim for issues in the runner to be entirely self contained and fixable here. Therefore, we will primarily handle bug issues opened in this repo and we kindly request you to create all feature and enhancement requests on the [GitHub Feedback](https://github.com/community/community/discussions/categories/actions-and-packages) page. 
+We welcome contributions in the form of issues and pull requests.  We view the contributions and the process as the same for github and external contributors.
 
 > IMPORTANT: Building your own runner is critical for the dev inner loop process when contributing changes.  However, only runners built and distributed by GitHub (releases) are supported in production.  Be aware that workflows and orchestrations run service side with the runner being a remote process to run steps.  For that reason, the service can pull the runner forward so customizations can be lost.
 
@@ -27,8 +27,6 @@ An ADR is an Architectural Decision Record.  This allows consensus on the direct
 
 ![Win](res/win_sm.png) Visual Studio 2017 or newer [Install here](https://visualstudio.microsoft.com) (needed for dev sh script)
 
-![Win-arm](res/win_sm.png) Visual Studio 2022 17.3 Preview or later. [Install here](https://docs.microsoft.com/en-us/visualstudio/releases/2022/release-notes-preview)
-
 ## Quickstart: Run a job from a real repository
 
 If you just want to get from building the sourcecode to using it to execute an action, you will need:
@@ -157,12 +155,4 @@ cat (Runner/Worker)_TIMESTAMP.log # view your log file
 ## Styling
 
 We use the .NET Foundation and CoreCLR style guidelines [located here](
-https://github.com/dotnet/runtime/blob/main/docs/coding-guidelines/coding-style.md)
-
-### Format C# Code
-
-To format both staged and unstaged .cs files
-```
-cd ./src
-./dev.(cmd|sh) format
-```
+https://github.com/dotnet/corefx/blob/master/Documentation/coding-guidelines/coding-style.md)

docs/contribute/vscode.md

@@ -35,7 +35,7 @@ All the configs below can be found in `.vscode/launch.json`.
 If you launch `Run` or `Run [build]`, it starts a process called `Runner.Listener`.
 This process will receive any job queued on this repository if the job runs on matching labels (e.g `runs-on: self-hosted`).
 Once a job is received, a `Runner.Listener` starts a new process of `Runner.Worker`.
-Since this is a different process, you can't use the same debugger session debug it.
+Since this is a diferent process, you can't use the same debugger session debug it.
 Instead, a parallel debugging session has to be started, using a different launch config.
 Luckily, VS Code supports multiple parallel debugging sessions.
 

docs/dependency-management.md

@@ -1,217 +0,0 @@
-# Runner Dependency Management Process
-
-## Overview
-
-This document outlines the automated dependency management process for the GitHub Actions Runner, designed to ensure we maintain up-to-date and secure dependencies while providing predictable release cycles.
-
-## Release Schedule
-
-- **Monthly Runner Releases**: New runner versions are released monthly
-- **Weekly Dependency Checks**: Automated workflows check for dependency updates every Monday
-- **Security Patches**: Critical security vulnerabilities are addressed immediately outside the regular schedule
-
-## Automated Workflows
-
-**Note**: These workflows are implemented across separate PRs for easier review and independent deployment. Each workflow includes comprehensive error handling and security-focused vulnerability detection.
-
-### 1. Foundation Labels
-
-- **Workflow**: `.github/workflows/setup-labels.yml` (PR #4024)
-- **Purpose**: Creates consistent dependency labels for all automation workflows
-- **Labels**: `dependencies`, `security`, `typescript`, `needs-manual-review`
-- **Prerequisite**: Must be merged before other workflows for proper labeling
-
-### 2. Node.js Version Updates
-
-- **Workflow**: `.github/workflows/node-upgrade.yml`
-- **Schedule**: Mondays at 6:00 AM UTC
-- **Purpose**: Updates Node.js 20 and 24 versions in `src/Misc/externals.sh`
-- **Source**: [nodejs.org](https://nodejs.org) and [actions/alpine_nodejs](https://github.com/actions/alpine_nodejs)
-- **Priority**: First (NPM depends on current Node.js versions)
-
-### 3. NPM Security Audit
-
-- **Primary Workflow**: `.github/workflows/npm-audit.yml` ("NPM Audit Fix")
-  - **Schedule**: Mondays at 7:00 AM UTC
-  - **Purpose**: Automated security vulnerability detection and basic fixes
-  - **Location**: `src/Misc/expressionFunc/hashFiles/`
-  - **Features**: npm audit, security patch application, PR creation
-  - **Dependency**: Runs after Node.js updates for optimal compatibility
-
-- **Fallback Workflow**: `.github/workflows/npm-audit-typescript.yml` ("NPM Audit Fix with TypeScript Auto-Fix")
-  - **Trigger**: Manual dispatch only
-  - **Purpose**: Manual security audit with TypeScript compatibility fixes
-  - **Use Case**: When scheduled workflow fails or needs custom intervention
-  - **Features**: Enhanced TypeScript auto-repair, graduated security response
-  - **How to Use**:
-    1. If the scheduled "NPM Audit Fix" workflow fails, go to Actions tab
-    2. Select "NPM Audit Fix with TypeScript Auto-Fix" workflow
-    3. Click "Run workflow" and optionally specify fix level (auto/manual)
-    4. Review the generated PR for TypeScript compatibility issues
-
-### 4. .NET SDK Updates
-
-- **Workflow**: `.github/workflows/dotnet-upgrade.yml`
-- **Schedule**: Mondays at midnight UTC
-- **Purpose**: Updates .NET SDK and package versions with build validation
-- **Features**: Global.json updates, NuGet package management, compatibility checking
-- **Independence**: Runs independently of Node.js/NPM updates
-
-### 5. Docker/Buildx Updates
-
-- **Workflow**: `.github/workflows/docker-buildx-upgrade.yml` ("Docker/Buildx Version Upgrade")
-- **Schedule**: Mondays at midnight UTC
-- **Purpose**: Updates Docker and Docker Buildx versions with multi-platform validation
-- **Features**: Container security scanning, multi-architecture build testing
-- **Independence**: Runs independently of other dependency updates
-
-### 6. Dependency Monitoring
-
-- **Workflow**: `.github/workflows/dependency-check.yml` ("Dependency Status Check")
-- **Schedule**: Mondays at 11:00 AM UTC
-- **Purpose**: Comprehensive status report of all dependencies with security audit
-- **Features**: Multi-dependency checking, npm audit status, build validation, choice of specific component checks
-- **Summary**: Runs last to capture results from all morning dependency updates
-
-## Release Process Integration
-
-### Pre-Release Checklist
-
-Before each monthly runner release:
-
-1. **Check Dependency PRs**:
-
-   ```bash
-   # List all open dependency PRs
-   gh pr list --label "dependencies" --state open
-   
-   # List only automated weekly dependency updates
-   gh pr list --label "dependencies-weekly-check" --state open
-   
-   # List only custom dependency automation (not dependabot)
-   gh pr list --label "dependencies-not-dependabot" --state open
-   ```
-
-2. **Run Manual Dependency Check**:
-   - Go to Actions tab → "Dependency Status Check" → "Run workflow"
-   - Review the summary for any outdated dependencies
-
-3. **Review and Merge Updates**:
-   - Prioritize security-related updates
-   - Test dependency updates in development environment
-   - Merge approved dependency PRs
-
-### Vulnerability Response
-
-#### Critical Security Vulnerabilities
-
-- **Response Time**: Within 24 hours
-- **Process**:
-  1. Assess impact on runner security
-  2. Create hotfix branch if runner data security is affected
-  3. Expedite patch release if necessary
-  4. Document in security advisory if applicable
-
-#### Non-Critical Vulnerabilities
-
-- **Response Time**: Next monthly release
-- **Process**:
-  1. Evaluate if vulnerability affects runner functionality
-  2. Include fix in regular dependency update cycle
-  3. Document in release notes
-
-## Monitoring and Alerts
-
-### GitHub Actions Workflow Status
-
-- All dependency workflows create PRs with the `dependencies` label
-- Failed workflows should be investigated immediately
-- Weekly dependency status reports are generated automatically
-
-### Manual Checks
-
-You can manually trigger dependency checks:
-
-- **Full Status**: Run "Dependency Status Check" workflow
-- **Specific Component**: Use the dropdown to check individual dependencies
-
-## Dependency Labels
-
-All automated dependency PRs are tagged with labels for easy filtering and management:
-
-### Primary Labels
-
-- **`dependencies`**: All automated dependency-related PRs
-- **`dependencies-weekly-check`**: Automated weekly dependency updates from scheduled workflows
-- **`dependencies-not-dependabot`**: Custom dependency automation (not created by dependabot)
-- **`security`**: Security vulnerability fixes and patches  
-- **`typescript`**: TypeScript compatibility and type definition updates
-- **`needs-manual-review`**: Complex updates requiring human verification
-
-### Technology-Specific Labels
-
-- **`node`**: Node.js version updates
-- **`javascript`**: JavaScript runtime and tooling updates
-- **`npm`**: NPM package and security updates
-- **`dotnet`**: .NET SDK and NuGet package updates
-- **`docker`**: Docker and container tooling updates
-
-### Workflow-Specific Branches
-
-- **Node.js updates**: `chore/update-node` branch
-- **NPM security fixes**: `chore/npm-audit-fix-YYYYMMDD` and `chore/npm-audit-fix-with-ts-repair` branches
-- **NuGet/.NET updates**: `feature/dotnetsdk-upgrade/{version}` branches
-- **Docker updates**: `feature/docker-buildx-upgrade` branch
-
-## Special Considerations
-
-### Node.js Updates
-
-When updating Node.js versions, remember to:
-
-1. Create a corresponding release in [actions/alpine_nodejs](https://github.com/actions/alpine_nodejs)
-2. Follow the alpine_nodejs getting started guide
-3. Test container builds with new Node versions
-
-### .NET SDK Updates
-
-- Only patch versions are auto-updated within the same major.minor version
-- Major/minor version updates require manual review and testing
-
-### Docker Updates
-
-- Updates include both Docker Engine and Docker Buildx
-- Verify compatibility with runner container workflows
-
-## Troubleshooting
-
-### Common Issues
-
-1. **NPM Audit Workflow Fails**:
-   - Check if `package.json` exists in `src/Misc/expressionFunc/hashFiles/`
-   - Verify Node.js setup step succeeded
-
-2. **Version Detection Fails**:
-   - Check if upstream APIs are available
-   - Verify parsing logic for version extraction
-
-3. **PR Creation Fails**:
-   - Ensure `GITHUB_TOKEN` has sufficient permissions
-   - Check if branch already exists
-
-### Contact
-
-For questions about the dependency management process:
-
-- Create an issue with the `dependencies` label
-- Review existing dependency management workflows
-- Consult the runner team for security-related concerns
-
-## Metrics and KPIs
-
-Track these metrics to measure dependency management effectiveness:
-
-- Number of open dependency PRs at release time
-- Time to merge dependency updates
-- Number of security vulnerabilities by severity
-- Release cycle adherence (monthly target)

docs/start/envlinux.md

@@ -4,7 +4,16 @@
 
 ## Supported Distributions and Versions
 
-Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#linux)."
+x64
+  - Red Hat Enterprise Linux 7
+  - CentOS 7
+  - Oracle Linux 7
+  - Fedora 29+
+  - Debian 9+
+  - Ubuntu 16.04+
+  - Linux Mint 18+
+  - openSUSE 15+
+  - SUSE Enterprise Linux (SLES) 12 SP2+
 
 ## Install .Net Core 3.x Linux Dependencies
 
@@ -25,7 +34,7 @@ The `installdependencies.sh` script should install all required dependencies on
 
 Debian based OS (Debian, Ubuntu, Linux Mint)
 
-- liblttng-ust1 or liblttng-ust0
+- liblttng-ust0
 - libkrb5-3
 - zlib1g
 - libssl1.1, libssl1.0.2 or libssl1.0.0

docs/start/envosx.md

@@ -4,6 +4,7 @@
 
 ## Supported Versions
 
-Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#macos)."
+  - macOS High Sierra (10.13) and later versions
+  - x64 and arm64 (Apple Silicon)
 
 ## [More .Net Core Prerequisites Information](https://docs.microsoft.com/en-us/dotnet/core/macos-prerequisites?tabs=netcore30)

docs/start/envwin.md

@@ -2,6 +2,11 @@
 
 ## Supported Versions
 
-Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#windows)."
+ - Windows 7 64-bit
+ - Windows 8.1 64-bit
+ - Windows 10 64-bit
+ - Windows Server 2012 R2 64-bit
+ - Windows Server 2016 64-bit
+ - Windows Server 2019 64-bit
 
 ## [More .NET Core Prerequisites Information](https://docs.microsoft.com/en-us/dotnet/core/windows-prerequisites?tabs=netcore30)

hooks/container/.eslintignore

@@ -0,0 +1,4 @@
+dist/
+lib/
+node_modules/
+**/__tests__/**

hooks/container/.eslintrc.json

@@ -0,0 +1,56 @@
+{
+  "plugins": ["@typescript-eslint"],
+  "extends": ["plugin:github/recommended"],
+  "parser": "@typescript-eslint/parser",
+  "parserOptions": {
+    "ecmaVersion": 9,
+    "sourceType": "module",
+    "project": "./tsconfig.json"
+  },
+  "rules": {
+    "eslint-comments/no-use": "off",
+    "import/no-namespace": "off",
+    "no-constant-condition": "off",
+    "no-unused-vars": "off",
+    "i18n-text/no-en": "off",
+    "@typescript-eslint/no-unused-vars": "error",
+    "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
+    "@typescript-eslint/no-require-imports": "error",
+    "@typescript-eslint/array-type": "error",
+    "@typescript-eslint/await-thenable": "error",
+    "camelcase": "off",
+    "@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
+    "@typescript-eslint/func-call-spacing": ["error", "never"],
+    "@typescript-eslint/no-array-constructor": "error",
+    "@typescript-eslint/no-empty-interface": "error",
+    "@typescript-eslint/no-explicit-any": "warn",
+    "@typescript-eslint/no-extraneous-class": "error",
+    "@typescript-eslint/no-floating-promises": "error",
+    "@typescript-eslint/no-for-in-array": "error",
+    "@typescript-eslint/no-inferrable-types": "error",
+    "@typescript-eslint/no-misused-new": "error",
+    "@typescript-eslint/no-namespace": "error",
+    "@typescript-eslint/no-non-null-assertion": "warn",
+    "@typescript-eslint/no-unnecessary-qualifier": "error",
+    "@typescript-eslint/no-unnecessary-type-assertion": "error",
+    "@typescript-eslint/no-useless-constructor": "error",
+    "@typescript-eslint/no-var-requires": "error",
+    "@typescript-eslint/prefer-for-of": "warn",
+    "@typescript-eslint/prefer-function-type": "warn",
+    "@typescript-eslint/prefer-includes": "error",
+    "@typescript-eslint/prefer-string-starts-ends-with": "error",
+    "@typescript-eslint/promise-function-async": "error",
+    "@typescript-eslint/require-array-sort-compare": "error",
+    "@typescript-eslint/restrict-plus-operands": "error",
+    "semi": "off",
+    "@typescript-eslint/semi": ["error", "never"],
+    "@typescript-eslint/type-annotation-spacing": "error",
+    "@typescript-eslint/unbound-method": "error",
+    "no-shadow": "off",
+    "@typescript-eslint/no-shadow": ["error"]
+  },
+  "env": {
+    "node": true,
+    "es6": true
+  }
+}

hooks/container/.gitignore

@@ -0,0 +1,3 @@
+node_modules/
+lib/
+dist/

hooks/container/.prettierignore

@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/

hooks/container/.prettierrc.json

@@ -0,0 +1,11 @@
+{
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": false,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid",
+  "parser": "typescript"
+}

hooks/container/CONTRIBUTING.md

@@ -0,0 +1,34 @@
+# Basic setup
+You'll need a runner compatible with hooks, a repository with container workflows to which you can register the runner and the hooks from this repository.
+
+
+
+## Getting Started
+- Run ` npm install && npm run bootstrap` to setup your environment and install all the needed packages
+- Run `npm run lint` and `npm run format` to ensure your charges will pass CI
+- Run `npm run build-all` to build and test end to end.
+
+
+## E2E
+- You'll need a runner compatible with hooks, a repository with container workflows to which you can register the runner and the hooks from this repository.
+- See [the runner contributing.md](../../github/CONTRIBUTING.MD) for how to get started with runner development.
+- Build your hook using `npm run build`
+- Enable the hooks by setting `ACTIONS_RUNNER_CONTAINER_HOOK=./src/{libraryname}/dist/index.js` file generated by [ncc](https://github.com/vercel/ncc)
+- Configure your self hosted runner against the a repository you have admin access
+- Run a workflow with a container job, for example
+```
+name: myjob
+on:
+  workflow_dispatch:
+jobs:
+  my_job:
+    runs-on: self-hosted
+    services:
+      redis:
+        image: redis
+    container:
+      image: alpine:3.15
+      options: --cpus 1
+    steps:
+      - run: pwd
+```

hooks/container/README.md

@@ -0,0 +1,10 @@
+# Container Hooks
+This repo contains example implementation of the container hook feature across various container providers. More information on how to implement your own hooks can be found in the [github docs]().
+
+Three projects are included in the `src` folder
+- k8s: A kubernetes hook implementation that spins up pods dynamically to run a job
+- docker: A hook implementation of the runner's docker implementation 
+- hooklib: a shared library which contains typescript definitions and utilities that the other projects consume
+
+### Want to contribute
+We welcome contributions.  See [how to contribute](CONTRIBUTING.md).

hooks/container/hooklib/.eslintignore

@@ -0,0 +1,3 @@
+dist/
+lib/
+node_modules/

hooks/container/hooklib/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "hooklib",
+  "version": "1.0.0",
+  "description": "",
+  "main": "lib/index.js",
+  "types": "index.d.ts",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "build": "tsc && ncc build",
+    "format": "prettier --write '**/*.ts'",
+    "format-check": "prettier --check '**/*.ts'",
+    "lint": "eslint src/**/*.ts"
+  },
+  "author": "",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^17.0.23",
+    "@typescript-eslint/parser": "^5.18.0",
+    "@zeit/ncc": "^0.22.3",
+    "eslint": "^8.12.0",
+    "eslint-plugin-github": "^4.3.6",
+    "prettier": "^2.6.2",
+    "typescript": "^4.6.3"
+  },
+  "dependencies": {
+    "@actions/core": "^1.6.0"
+  }
+}

hooks/container/hooklib/src/index.ts

@@ -0,0 +1,2 @@
+export * from './interfaces'
+export * from './utils'

hooks/container/hooklib/src/interfaces.ts

@@ -0,0 +1,87 @@
+export enum Command {
+  PrepareJob = 'prepare_job',
+  CleanupJob = 'cleanup_job',
+  RunContainerStep = 'run_container_step',
+  RunScriptStep = 'run_script_step'
+}
+
+export interface HookData {
+  command: Command
+  responseFile: string
+  args?: PrepareJobArgs | RunContainerStepArgs | RunScriptStepArgs
+  state?: object
+}
+
+export interface PrepareJobArgs {
+  container?: JobContainerInfo
+  services?: ServiceContainerInfo[]
+}
+
+export type RunContainerStepArgs = StepContainerInfo
+
+export interface RunScriptStepArgs {
+  entrypoint: string
+  entrypointArgs: string[]
+  environmentVariables?: {[key: string]: string}
+  prependPath?: string[]
+  workingDirectory: string
+}
+
+export interface ContainerInfo {
+  entrypoint?: string
+  entrypointArgs?: string[]
+  createOptions?: string
+  environmentVariables?: {[key: string]: string}
+  userMountVolumes?: Mount[]
+  registry?: Registry
+  portMappings?: string[]
+}
+
+export interface ServiceContainerInfo extends ContainerInfo {
+  contextName: string
+  image: string
+}
+
+export interface JobContainerInfo extends ContainerInfo {
+  image: string
+  workingDirectory: string
+  systemMountVolumes: Mount[]
+}
+
+export interface StepContainerInfo extends ContainerInfo {
+  prependPath?: string[]
+  workingDirectory: string
+  dockerfile?: string
+  image?: string
+  systemMountVolumes: Mount[]
+}
+
+export interface Mount {
+  sourceVolumePath: string
+  targetVolumePath: string
+  readOnly: boolean
+}
+
+export interface Registry {
+  username?: string
+  password?: string
+  serverUrl: string
+}
+
+export enum Protocol {
+  TCP = 'tcp',
+  UDP = 'udp'
+}
+
+export interface PrepareJobResponse {
+  state?: object
+  context?: ContainerContext
+  services?: {[key: string]: ContainerContext}
+  alpine: boolean
+}
+
+export interface ContainerContext {
+  id?: string
+  network?: string
+  ports?: {[key: string]: string}
+}

hooks/container/hooklib/src/utils.ts

@@ -0,0 +1,44 @@
+import * as core from '@actions/core'
+import * as events from 'events'
+import * as fs from 'fs'
+import * as os from 'os'
+import * as readline from 'readline'
+import {HookData} from './interfaces'
+
+export async function getInputFromStdin(): Promise<HookData> {
+  let input = ''
+
+  const rl = readline.createInterface({
+    input: process.stdin
+  })
+
+  rl.on('line', line => {
+    core.debug(`Line from STDIN: ${line}`)
+    input = line
+  })
+  await events.default.once(rl, 'close')
+  const inputJson = JSON.parse(input)
+  return inputJson as HookData
+}
+
+export function writeToResponseFile(filePath: string, message: any): void {
+  if (!filePath) {
+    throw new Error(`Expected file path`)
+  }
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Missing file at path: ${filePath}`)
+  }
+
+  fs.appendFileSync(filePath, `${toCommandValue(message)}${os.EOL}`, {
+    encoding: 'utf8'
+  })
+}
+
+function toCommandValue(input: any): string {
+  if (input === null || input === undefined) {
+    return ''
+  } else if (typeof input === 'string' || input instanceof String) {
+    return input as string
+  }
+  return JSON.stringify(input)
+}

hooks/container/hooklib/tsconfig.json

@@ -0,0 +1,11 @@
+{
+    "extends": "../../tsconfig.json",
+    "compilerOptions": {
+      "baseUrl": "./",
+      "outDir": "./lib",
+      "rootDir": "./src"
+    },
+    "include": [
+      "./src"
+    ]
+  }

hooks/container/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "hooks",
+  "version": "1.0.0",
+  "description": "Three projects are included - k8s: a kubernetes hook implementation that spins up pods dynamically to run a job - docker: A hook implementation of the runner's docker implementation  - A hook lib, which contains shared typescript definitions and utilities that the other packages consume",
+  "main": "",
+  "directories": {
+    "doc": "docs"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "bootstrap": "npm install --prefix src/hooklib && npm install --prefix src/k8s && npm install --prefix src/docker",
+    "format": "prettier --write '**/*.ts'",
+    "format-check": "prettier --check '**/*.ts'",
+    "lint": "eslint src/**/*.ts",
+    "build-all": "npm run build --prefix src/hooklib && npm run build --prefix src/k8s && npm run build --prefix src/docker"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/runner.git"
+  },
+  "author": "",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/actions/runner/issues"
+  },
+  "homepage": "https://github.com/actions/runner#readme",
+  "dependencies": {
+  },
+  "devDependencies": {
+    "@types/node": "^17.0.23",
+    "@typescript-eslint/parser": "^5.18.0",
+    "eslint": "^8.12.0",
+    "eslint-plugin-github": "^4.3.6",
+    "prettier": "^2.6.2",
+    "typescript": "^4.6.3"
+  }
+}

hooks/container/tsconfig.json

@@ -0,0 +1,70 @@
+{
+  "compilerOptions": {
+    /* Visit https://aka.ms/tsconfig.json to read more about this file */
+    "outDir": "./lib",
+    "rootDir": "./src",
+    /* Basic Options */
+    // "incremental": true,                   /* Enable incremental compilation */
+    "target": "es5",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019', 'ES2020', or 'ESNEXT'. */
+    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', 'es2020', or 'ESNext'. */
+    // "lib": [],                             /* Specify library files to be included in the compilation. */
+    // "allowJs": true,                       /* Allow javascript files to be compiled. */
+    // "checkJs": true,                       /* Report errors in .js files. */
+    // "jsx": "preserve",                     /* Specify JSX code generation: 'preserve', 'react-native', or 'react'. */
+    "declaration": true,                   /* Generates corresponding '.d.ts' file. */
+    // "declarationMap": true,                /* Generates a sourcemap for each corresponding '.d.ts' file. */
+    // "sourceMap": true,                     /* Generates corresponding '.map' file. */
+    // "outFile": "./",                       /* Concatenate and emit output to single file. */
+    // "outDir": "./",                        /* Redirect output structure to the directory. */
+    // "rootDir": "./",                       /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */
+    // "composite": true,                     /* Enable project compilation */
+    // "tsBuildInfoFile": "./",               /* Specify file to store incremental compilation information */
+    // "removeComments": true,                /* Do not emit comments to output. */
+    // "noEmit": true,                        /* Do not emit outputs. */
+    // "importHelpers": true,                 /* Import emit helpers from 'tslib'. */
+    // "downlevelIteration": true,            /* Provide full support for iterables in 'for-of', spread, and destructuring when targeting 'ES5' or 'ES3'. */
+    // "isolatedModules": true,               /* Transpile each file as a separate module (similar to 'ts.transpileModule'). */
+
+    /* Strict Type-Checking Options */
+    "strict": true,                           /* Enable all strict type-checking options. */
+    "noImplicitAny": false,                 /* Raise error on expressions and declarations with an implied 'any' type. */
+    // "strictNullChecks": true,              /* Enable strict null checks. */
+    // "strictFunctionTypes": true,           /* Enable strict checking of function types. */
+    // "strictBindCallApply": true,           /* Enable strict 'bind', 'call', and 'apply' methods on functions. */
+    // "strictPropertyInitialization": true,  /* Enable strict checking of property initialization in classes. */
+    // "noImplicitThis": true,                /* Raise error on 'this' expressions with an implied 'any' type. */
+    // "alwaysStrict": true,                  /* Parse in strict mode and emit "use strict" for each source file. */
+
+    /* Additional Checks */
+    // "noUnusedLocals": true,                /* Report errors on unused locals. */
+    // "noUnusedParameters": true,            /* Report errors on unused parameters. */
+    // "noImplicitReturns": true,             /* Report error when not all code paths in function return a value. */
+    // "noFallthroughCasesInSwitch": true,    /* Report errors for fallthrough cases in switch statement. */
+
+    /* Module Resolution Options */
+    // "moduleResolution": "node",            /* Specify module resolution strategy: 'node' (Node.js) or 'classic' (TypeScript pre-1.6). */
+    // "baseUrl": "./",                       /* Base directory to resolve non-absolute module names. */
+    // "paths": {},                           /* A series of entries which re-map imports to lookup locations relative to the 'baseUrl'. */
+    // "rootDirs": [],                        /* List of root folders whose combined content represents the structure of the project at runtime. */
+    // "typeRoots": [],                       /* List of folders to include type definitions from. */
+    // "types": [],                           /* Type declaration files to be included in compilation. */
+    // "allowSyntheticDefaultImports": true,  /* Allow default imports from modules with no default export. This does not affect code emit, just typechecking. */
+    "esModuleInterop": true,                  /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
+    // "preserveSymlinks": true,              /* Do not resolve the real path of symlinks. */
+    // "allowUmdGlobalAccess": true,          /* Allow accessing UMD globals from modules. */
+
+    /* Source Map Options */
+    // "sourceRoot": "",                      /* Specify the location where debugger should locate TypeScript files instead of source locations. */
+    // "mapRoot": "",                         /* Specify the location where debugger should locate map files instead of generated locations. */
+    // "inlineSourceMap": true,               /* Emit a single file with source maps instead of having a separate file. */
+    // "inlineSources": true,                 /* Emit the source alongside the sourcemaps within a single file; requires '--inlineSourceMap' or '--sourceMap' to be set. */
+
+    /* Experimental Options */
+    // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
+    // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
+
+    /* Advanced Options */
+    "skipLibCheck": true,                     /* Skip type checking of declaration files. */
+    "forceConsistentCasingInFileNames": true  /* Disallow inconsistently-cased references to the same file. */
+  }
+}

images/Dockerfile

@@ -1,67 +0,0 @@
-# Source: https://github.com/dotnet/dotnet-docker
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy AS build
-
-ARG TARGETOS
-ARG TARGETARCH
-ARG RUNNER_VERSION
-ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=28.4.0
-ARG BUILDX_VERSION=0.28.0
-
-RUN apt update -y && apt install curl unzip -y
-
-WORKDIR /actions-runner
-RUN export RUNNER_ARCH=${TARGETARCH} \
-    && if [ "$RUNNER_ARCH" = "amd64" ]; then export RUNNER_ARCH=x64 ; fi \
-    && curl -f -L -o runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-${TARGETOS}-${RUNNER_ARCH}-${RUNNER_VERSION}.tar.gz \
-    && tar xzf ./runner.tar.gz \
-    && rm runner.tar.gz
-
-RUN curl -f -L -o runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \
-    && unzip ./runner-container-hooks.zip -d ./k8s \
-    && rm runner-container-hooks.zip
-
-RUN export RUNNER_ARCH=${TARGETARCH} \
-    && if [ "$RUNNER_ARCH" = "amd64" ]; then export DOCKER_ARCH=x86_64 ; fi \
-    && if [ "$RUNNER_ARCH" = "arm64" ]; then export DOCKER_ARCH=aarch64 ; fi \
-    && curl -fLo docker.tgz https://download.docker.com/${TARGETOS}/static/stable/${DOCKER_ARCH}/docker-${DOCKER_VERSION}.tgz \
-    && tar zxvf docker.tgz \
-    && rm -rf docker.tgz \
-    && mkdir -p /usr/local/lib/docker/cli-plugins \
-    && curl -fLo /usr/local/lib/docker/cli-plugins/docker-buildx \
-        "https://github.com/docker/buildx/releases/download/v${BUILDX_VERSION}/buildx-v${BUILDX_VERSION}.linux-${TARGETARCH}" \
-    && chmod +x /usr/local/lib/docker/cli-plugins/docker-buildx
-
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy
-
-ENV DEBIAN_FRONTEND=noninteractive
-ENV RUNNER_MANUALLY_TRAP_SIG=1
-ENV ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT=1
-ENV ImageOS=ubuntu22
-
-# 'gpg-agent' and 'software-properties-common' are needed for the 'add-apt-repository' command that follows
-RUN apt update -y \
-    && apt install -y --no-install-recommends sudo lsb-release gpg-agent software-properties-common curl jq unzip \
-    && rm -rf /var/lib/apt/lists/*
-
-# Configure git-core/ppa based on guidance here:  https://git-scm.com/download/linux
-RUN add-apt-repository ppa:git-core/ppa \
-    && apt update -y \
-    && apt install -y git \
-    && rm -rf /var/lib/apt/lists/*
-
-RUN adduser --disabled-password --gecos "" --uid 1001 runner \
-    && groupadd docker --gid 123 \
-    && usermod -aG sudo runner \
-    && usermod -aG docker runner \
-    && echo "%sudo   ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \
-    && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers
-
-WORKDIR /home/runner
-
-COPY --chown=runner:docker --from=build /actions-runner .
-COPY --from=build /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-buildx
-
-RUN install -o root -g root -m 755 docker/* /usr/bin/ && rm -rf docker
-
-USER runner

releaseNote.md

@@ -1,32 +1,17 @@
-## What's Changed
-* Update Docker to v28.3.2 and Buildx to v0.26.1 by @github-actions[bot] in https://github.com/actions/runner/pull/3953
-* Fix if statement structure in update script and variable reference by @salmanmkc in https://github.com/actions/runner/pull/3956
-* Add V2 flow for runner deletion by @Samirat in https://github.com/actions/runner/pull/3954
-* Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables by @salmanmkc in https://github.com/actions/runner/pull/3948
-* Update Node20 and Node24 to latest by @djs-intel in https://github.com/actions/runner/pull/3972
-* Redirect supported OS doc section to current public Docs location by @corycalahan in https://github.com/actions/runner/pull/3979
-* Bump Microsoft.NET.Test.Sdk from 17.13.0 to 17.14.1 by @dependabot[bot] in https://github.com/actions/runner/pull/3975
-* Bump Azure.Storage.Blobs from 12.24.0 to 12.25.0 by @dependabot[bot] in https://github.com/actions/runner/pull/3974
-* Bump actions/download-artifact from 4 to 5 by @dependabot[bot] in https://github.com/actions/runner/pull/3973
-* Bump actions/checkout from 4 to 5 by @dependabot[bot] in https://github.com/actions/runner/pull/3982
+## Features
+- Added a pre-release package for the `macOS-arm64` architecture
+  - Note that this packages is pre-release status and may not work with all existing actions
 
-## New Contributors
-* @Samirat made their first contribution in https://github.com/actions/runner/pull/3954
-* @djs-intel made their first contribution in https://github.com/actions/runner/pull/3972
+## Bugs
+- Fixed an issue where live console logs would fail to close (#1903)
 
-**Full Changelog**: https://github.com/actions/runner/compare/v2.327.1...v2.328.0
-
-_Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
-To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.
-See https://docs.github.com/en/enterprise-cloud@latest/actions/hosting-your-own-runners/adding-self-hosted-runners_
+## Misc
 
 ## Windows x64
-
 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.
 
 The following snipped needs to be run on `powershell`:
-
-```powershell
+``` powershell
 # Create a folder under the drive root
 mkdir \actions-runner ; cd \actions-runner
 # Download the latest runner package
@@ -36,25 +21,9 @@ Add-Type -AssemblyName System.IO.Compression.FileSystem ;
 [System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-x64-<RUNNER_VERSION>.zip", "$PWD")
 ```
 
-## Windows arm64
-
-We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.
-
-The following snipped needs to be run on `powershell`:
-
-```powershell
-# Create a folder under the drive root
-mkdir \actions-runner ; cd \actions-runner
-# Download the latest runner package
-Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-win-arm64-<RUNNER_VERSION>.zip -OutFile actions-runner-win-arm64-<RUNNER_VERSION>.zip
-# Extract the installer
-Add-Type -AssemblyName System.IO.Compression.FileSystem ;
-[System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-arm64-<RUNNER_VERSION>.zip", "$PWD")
-```
-
 ## OSX x64
 
-```bash
+``` bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -63,9 +32,9 @@ curl -O -L https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>
 tar xzf ./actions-runner-osx-x64-<RUNNER_VERSION>.tar.gz
 ```
 
-## OSX arm64 (Apple silicon)
+## [Pre-release] OSX arm64 (Apple silicon)
 
-```bash
+``` bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -76,7 +45,7 @@ tar xzf ./actions-runner-osx-arm64-<RUNNER_VERSION>.tar.gz
 
 ## Linux x64
 
-```bash
+``` bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -87,7 +56,7 @@ tar xzf ./actions-runner-linux-x64-<RUNNER_VERSION>.tar.gz
 
 ## Linux arm64
 
-```bash
+``` bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -98,7 +67,7 @@ tar xzf ./actions-runner-linux-arm64-<RUNNER_VERSION>.tar.gz
 
 ## Linux arm
 
-```bash
+``` bash
 # Create a folder
 mkdir actions-runner && cd actions-runner
 # Download the latest runner package
@@ -108,7 +77,6 @@ tar xzf ./actions-runner-linux-arm-<RUNNER_VERSION>.tar.gz
 ```
 
 ## Using your self hosted runner
-
 For additional details about configuring, running, or shutting down the runner please check out our [product docs.](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/adding-self-hosted-runners)
 
 ## SHA-256 Checksums
@@ -116,9 +84,29 @@ For additional details about configuring, running, or shutting down the runner p
 The SHA-256 checksums for the packages included in this build are shown below:
 
 - actions-runner-win-x64-<RUNNER_VERSION>.zip <!-- BEGIN SHA win-x64 --><WIN_X64_SHA><!-- END SHA win-x64 -->
-- actions-runner-win-arm64-<RUNNER_VERSION>.zip <!-- BEGIN SHA win-arm64 --><WIN_ARM64_SHA><!-- END SHA win-arm64 -->
 - actions-runner-osx-x64-<RUNNER_VERSION>.tar.gz <!-- BEGIN SHA osx-x64 --><OSX_X64_SHA><!-- END SHA osx-x64 -->
 - actions-runner-osx-arm64-<RUNNER_VERSION>.tar.gz <!-- BEGIN SHA osx-arm64 --><OSX_ARM64_SHA><!-- END SHA osx-arm64 -->
 - actions-runner-linux-x64-<RUNNER_VERSION>.tar.gz <!-- BEGIN SHA linux-x64 --><LINUX_X64_SHA><!-- END SHA linux-x64 -->
 - actions-runner-linux-arm64-<RUNNER_VERSION>.tar.gz <!-- BEGIN SHA linux-arm64 --><LINUX_ARM64_SHA><!-- END SHA linux-arm64 -->
 - actions-runner-linux-arm-<RUNNER_VERSION>.tar.gz <!-- BEGIN SHA linux-arm --><LINUX_ARM_SHA><!-- END SHA linux-arm -->
+
+- actions-runner-win-x64-<RUNNER_VERSION>-noexternals.zip <!-- BEGIN SHA win-x64_noexternals --><WIN_X64_SHA_NOEXTERNALS><!-- END SHA win-x64_noexternals -->
+- actions-runner-osx-x64-<RUNNER_VERSION>-noexternals.tar.gz <!-- BEGIN SHA osx-x64_noexternals --><OSX_X64_SHA_NOEXTERNALS><!-- END SHA osx-x64_noexternals -->
+- actions-runner-osx-arm64-<RUNNER_VERSION>-noexternals.tar.gz <!-- BEGIN SHA osx-arm64_noexternals --><OSX_ARM64_SHA_NOEXTERNALS><!-- END SHA osx-arm64_noexternals -->
+- actions-runner-linux-x64-<RUNNER_VERSION>-noexternals.tar.gz <!-- BEGIN SHA linux-x64_noexternals --><LINUX_X64_SHA_NOEXTERNALS><!-- END SHA linux-x64_noexternals -->
+- actions-runner-linux-arm64-<RUNNER_VERSION>-noexternals.tar.gz <!-- BEGIN SHA linux-arm64_noexternals --><LINUX_ARM64_SHA_NOEXTERNALS><!-- END SHA linux-arm64_noexternals -->
+- actions-runner-linux-arm-<RUNNER_VERSION>-noexternals.tar.gz <!-- BEGIN SHA linux-arm_noexternals --><LINUX_ARM_SHA_NOEXTERNALS><!-- END SHA linux-arm_noexternals -->
+
+- actions-runner-win-x64-<RUNNER_VERSION>-noruntime.zip <!-- BEGIN SHA win-x64_noruntime --><WIN_X64_SHA_NORUNTIME><!-- END SHA win-x64_noruntime -->
+- actions-runner-osx-x64-<RUNNER_VERSION>-noruntime.tar.gz <!-- BEGIN SHA osx-x64_noruntime --><OSX_X64_SHA_NORUNTIME><!-- END SHA osx-x64_noruntime -->
+- actions-runner-osx-arm64-<RUNNER_VERSION>-noruntime.tar.gz <!-- BEGIN SHA osx-arm64_noruntime --><OSX_ARM64_SHA_NORUNTIME><!-- END SHA osx-arm64_noruntime -->
+- actions-runner-linux-x64-<RUNNER_VERSION>-noruntime.tar.gz <!-- BEGIN SHA linux-x64_noruntime --><LINUX_X64_SHA_NORUNTIME><!-- END SHA linux-x64_noruntime -->
+- actions-runner-linux-arm64-<RUNNER_VERSION>-noruntime.tar.gz <!-- BEGIN SHA linux-arm64_noruntime --><LINUX_ARM64_SHA_NORUNTIME><!-- END SHA linux-arm64_noruntime -->
+- actions-runner-linux-arm-<RUNNER_VERSION>-noruntime.tar.gz <!-- BEGIN SHA linux-arm_noruntime --><LINUX_ARM_SHA_NORUNTIME><!-- END SHA linux-arm_noruntime -->
+
+- actions-runner-win-x64-<RUNNER_VERSION>-noruntime-noexternals.zip <!-- BEGIN SHA win-x64_noruntime_noexternals --><WIN_X64_SHA_NORUNTIME_NOEXTERNALS><!-- END SHA win-x64_noruntime_noexternals -->
+- actions-runner-osx-x64-<RUNNER_VERSION>-noruntime-noexternals.tar.gz <!-- BEGIN SHA osx-x64_noruntime_noexternals --><OSX_X64_SHA_NORUNTIME_NOEXTERNALS><!-- END SHA osx-x64_noruntime_noexternals -->
+- actions-runner-osx-arm64-<RUNNER_VERSION>-noruntime-noexternals.tar.gz <!-- BEGIN SHA osx-arm64_noruntime_noexternals --><OSX_ARM64_SHA_NORUNTIME_NOEXTERNALS><!-- END SHA osx-arm64_noruntime_noexternals -->
+- actions-runner-linux-x64-<RUNNER_VERSION>-noruntime-noexternals.tar.gz <!-- BEGIN SHA linux-x64_noruntime_noexternals --><LINUX_X64_SHA_NORUNTIME_NOEXTERNALS><!-- END SHA linux-x64_noruntime_noexternals -->
+- actions-runner-linux-arm64-<RUNNER_VERSION>-noruntime-noexternals.tar.gz <!-- BEGIN SHA linux-arm64_noruntime_noexternals --><LINUX_ARM64_SHA_NORUNTIME_NOEXTERNALS><!-- END SHA linux-arm64_noruntime_noexternals -->
+- actions-runner-linux-arm-<RUNNER_VERSION>-noruntime-noexternals.tar.gz <!-- BEGIN SHA linux-arm_noruntime_noexternals --><LINUX_ARM_SHA_NORUNTIME_NOEXTERNALS><!-- END SHA linux-arm_noruntime_noexternals -->

scripts/create-latest-svc.sh

@@ -8,12 +8,12 @@ set -e
 # Configures it as a service more secure
 # Should be used on VMs and not containers
 # Works on OSX and Linux
-# Assumes x64 arch (support arm64)
+# Assumes x64 arch
 # See EXAMPLES below
 
 flags_found=false
 
-while getopts 's:g:n:r:u:l:df' opt; do
+while getopts 's:g:n:r:u:l:' opt; do
     flags_found=true
 
     case $opt in
@@ -35,12 +35,6 @@ while getopts 's:g:n:r:u:l:df' opt; do
     l)
         labels=$OPTARG
         ;;
-    f)
-        replace='true'
-        ;;
-    d)
-        disableupdate='true'
-        ;;
     *)
         echo "
 Runner Service Installer
@@ -55,9 +49,7 @@ Usage:
     -n          optional  name of the runner, defaults to hostname
     -r          optional  name of the runner group to add the runner to, defaults to the Default group
     -u          optional  user svc will run as, defaults to current
-    -l          optional  list of labels (split by comma) applied on the runner
-    -d          optional  allow runner to remain on the current version for one month after the release of a newer version
-    -f          optional  replace any existing runner with the same name"
+    -l          optional  list of labels (split by comma) applied on the runner"
         exit 0
         ;;
     esac
@@ -87,9 +79,6 @@ sudo echo
 runner_plat=linux
 [ ! -z "$(which sw_vers)" ] && runner_plat=osx;
 
-runner_arch=x64
-[ ! -z "$(arch | grep arm64)" ] && runner_arch=arm64
-
 function fatal()
 {
    echo "error: $1" >&2
@@ -142,7 +131,7 @@ echo "Downloading latest runner ..."
 # For the GHES Alpha, download the runner from github.com
 latest_version_label=$(curl -s -X GET 'https://api.github.com/repos/actions/runner/releases/latest' | jq -r '.tag_name')
 latest_version=$(echo ${latest_version_label:1})
-runner_file="actions-runner-${runner_plat}-${runner_arch}-${latest_version}.tar.gz"
+runner_file="actions-runner-${runner_plat}-x64-${latest_version}.tar.gz"
 
 if [ -f "${runner_file}" ]; then
     echo "${runner_file} exists. skipping download."
@@ -180,8 +169,8 @@ fi
 
 echo
 echo "Configuring ${runner_name} @ $runner_url"
-echo "./config.sh --unattended --url $runner_url --token *** --name $runner_name ${labels:+--labels $labels} ${runner_group:+--runnergroup \"$runner_group\"} ${disableupdate:+--disableupdate}"
-sudo -E -u ${svc_user} ./config.sh --unattended --url $runner_url --token $RUNNER_TOKEN ${replace:+--replace} --name $runner_name ${labels:+--labels $labels} ${runner_group:+--runnergroup "$runner_group"} ${disableupdate:+--disableupdate}
+echo "./config.sh --unattended --url $runner_url --token *** --name $runner_name ${labels:+--labels $labels} ${runner_group:+--runnergroup \"$runner_group\"}"
+sudo -E -u ${svc_user} ./config.sh --unattended --url $runner_url --token $RUNNER_TOKEN --name $runner_name ${labels:+--labels $labels} ${runner_group:+--runnergroup "$runner_group"}
 
 #---------------------------------------
 # Configuring as a service

scripts/delete.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#/bin/bash
 
 set -e
 
@@ -12,7 +12,7 @@ set -e
 #
 # Usage:
 #     export RUNNER_CFG_PAT=<yourPAT>
-#     ./delete.sh <scope> [<name>]
+#     ./delete.sh scope name
 #
 #      scope required  repo (:owner/:repo) or org (:organization)
 #      name  optional  defaults to hostname.  name to delete
@@ -26,17 +26,17 @@ set -e
 runner_scope=${1}
 runner_name=${2}
 
-function fatal() 
+echo "Deleting runner ${runner_name} @ ${runner_scope}"
+
+function fatal()
 {
    echo "error: $1" >&2
    exit 1
 }
 
 if [ -z "${runner_scope}" ]; then fatal "supply scope as argument 1"; fi
+if [ -z "${runner_name}" ]; then fatal "supply name as argument 2"; fi
 if [ -z "${RUNNER_CFG_PAT}" ]; then fatal "RUNNER_CFG_PAT must be set before calling"; fi
-if [ -z "${runner_name}" ]; then runner_name=`hostname`; fi
-
-echo "Deleting runner ${runner_name} @ ${runner_scope}"
 
 which curl || fatal "curl required.  Please install in PATH with apt-get, brew, etc"
 which jq || fatal "jq required.  Please install in PATH with apt-get, brew, etc"

src/.editorconfig

@@ -1,5 +1,5 @@
 [*.cs]
-charset = utf-8-bom
+charset = utf-8
 insert_final_newline = true
 
 csharp_new_line_before_else = true

src/Directory.Build.props

@@ -24,9 +24,6 @@
   <PropertyGroup Condition="'$(BUILD_OS)' == 'Windows' AND '$(PackageRuntime)' == 'win-x86'">
     <DefineConstants>$(DefineConstants);X86</DefineConstants>
   </PropertyGroup>
-  <PropertyGroup Condition="'$(BUILD_OS)' == 'Windows' AND '$(PackageRuntime)' == 'win-arm64'">
-    <DefineConstants>$(DefineConstants);ARM64</DefineConstants>
-  </PropertyGroup>
 
   <PropertyGroup Condition="'$(BUILD_OS)' == 'OSX' AND '$(PackageRuntime)' == 'osx-x64'">
     <DefineConstants>$(DefineConstants);X64</DefineConstants>
@@ -57,13 +54,4 @@
   <PropertyGroup>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
   </PropertyGroup>
-
-  <PropertyGroup>
-    <!-- Enable NuGet package auditing -->
-    <NuGetAudit>true</NuGetAudit>
-    <!-- Audit direct and transitive packages -->
-    <NuGetAuditMode>all</NuGetAuditMode>
-    <!-- Report low, moderate, high and critical advisories -->
-    <NuGetAuditLevel>moderate</NuGetAuditLevel>
-  </PropertyGroup>
 </Project>

src/Misc/contentHash/dotnetRuntime/linux-arm

@@ -0,0 +1 @@
+1d709d93e5d3c6c6c656a61aa6c1781050224788a05b0e6ecc4c3c0408bdf89c

src/Misc/contentHash/dotnetRuntime/linux-arm64

@@ -0,0 +1 @@
+b92a47cfeaad02255b1f7a377060651b73ae5e5db22a188dbbcb4183ab03a03d

src/Misc/contentHash/dotnetRuntime/linux-x64

@@ -0,0 +1 @@
+68a9a8ef0843a8bb74241894f6f63fd76241a82295c5337d3cc7a940a314c78e

src/Misc/contentHash/dotnetRuntime/osx-arm64

@@ -0,0 +1 @@
+02c7126ff4d63ee2a0ae390c81434c125630522aadf35903bbeebb1a99d8af99

src/Misc/contentHash/dotnetRuntime/osx-x64

@@ -0,0 +1 @@
+c9d5a542f8d765168855a89e83ae0a8970d00869041c4f9a766651c04c72b212

src/Misc/contentHash/dotnetRuntime/win-x64

@@ -0,0 +1 @@
+d94f2fbaf210297162bc9f3add819d73682c3aa6899e321c3872412b924d5504

src/Misc/contentHash/externals/linux-arm

@@ -0,0 +1 @@
+6ed30a2c1ee403a610d63e82bb230b9ba846a9c25cec9e4ea8672fb6ed4e1a51

src/Misc/contentHash/externals/linux-arm64

@@ -0,0 +1 @@
+711c30c51ec52c9b7a9a2eb399d6ab2ab5ee1dc72de11879f2f36f919f163d78

src/Misc/contentHash/externals/linux-x64

@@ -0,0 +1 @@
+a49479ca4b4988a06c097e8d22c51fd08a11c13f40807366236213d0e008cf6a

src/Misc/contentHash/externals/osx-arm64

@@ -0,0 +1 @@
+cc4708962a80325de0baa5ae8484e0cb9ae976ac6a4178c1c0d448b8c52bd7f7

src/Misc/contentHash/externals/osx-x64

@@ -0,0 +1 @@
+8e97df75230b843462a9b4c578ccec604ee4b4a1066120c85b04374317fa372b

src/Misc/contentHash/externals/win-x64

@@ -0,0 +1 @@
+f75a671e5a188c76680739689aa75331a2c09d483dce9c80023518c48fd67a18

src/Misc/expressionFunc/hashFiles/.prettierrc.json

@@ -1,19 +1,11 @@
-
 {
-  "printWidth": 80,
-  "tabWidth": 2,
-  "useTabs": false,
-  "semi": false,
-  "singleQuote": true,
-  "trailingComma": "none",
-  "bracketSpacing": false,
-  "arrowParens": "avoid",
-  "overrides": [
-    {
-      "files": "*.{js,ts,json}",
-      "options": {
-        "tabWidth": 2
-      }
-    }
-  ]
-}
+    "printWidth": 80,
+    "tabWidth": 2,
+    "useTabs": false,
+    "semi": false,
+    "singleQuote": true,
+    "trailingComma": "none",
+    "bracketSpacing": false,
+    "arrowParens": "avoid",
+    "parser": "typescript"
+  }

src/Misc/expressionFunc/hashFiles/README.md

@@ -1,3 +1 @@
-To compile this package (output will be stored in `Misc/layoutbin`) run `npm install && npm run prepare && npm run all`.
-
-When you commit changes to the JSON or Typescript file, the javascript binary will be automatically re-compiled and added to the latest commit.
+To update hashFiles under `Misc/layoutbin` run `npm install && npm run all`

src/Misc/expressionFunc/hashFiles/package.json

@@ -9,8 +9,7 @@
     "format-check": "prettier --check **/*.ts",
     "lint": "eslint src/**/*.ts",
     "pack": "ncc build -o ../../layoutbin/hashFiles",
-    "all": "npm run format && npm run lint && npm run build && npm run pack",
-    "prepare": "cd ../../../../ && husky"
+    "all": "npm run build && npm run format && npm run lint && npm run pack"
   },
   "repository": {
     "type": "git",
@@ -19,32 +18,18 @@
   "keywords": [
     "actions"
   ],
-  "lint-staged": {
-    "*.md": [
-      "prettier --write",
-      "git add ."
-    ],
-    "*.{ts,json}": [
-      "sh -c 'npm run all'",
-      "git add ."
-    ]
-  },
   "author": "GitHub Actions",
   "license": "MIT",
   "dependencies": {
-    "@actions/glob": "^0.4.0"
+    "@actions/glob": "^0.1.0"
   },
   "devDependencies": {
-    "@types/node": "^20.6.2",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
-    "@typescript-eslint/parser": "^6.7.2",
-    "@vercel/ncc": "^0.38.3",
-    "eslint": "^8.47.0",
-    "eslint-plugin-github": "^4.10.2",
-    "eslint-plugin-prettier": "^5.0.0",
-    "husky": "^9.1.7",
-    "lint-staged": "^15.5.0",
-    "prettier": "^3.0.3",
-    "typescript": "^5.9.2"
+    "@types/node": "^12.7.12",
+    "@typescript-eslint/parser": "^5.15.0",
+    "@zeit/ncc": "^0.20.5",
+    "eslint": "^8.11.0",
+    "eslint-plugin-github": "^4.3.5",
+    "prettier": "^1.19.1",
+    "typescript": "^3.6.4"
   }
 }

src/Misc/expressionFunc/hashFiles/src/hashFiles.ts

@@ -52,13 +52,12 @@ async function run(): Promise<void> {
   }
 }
 
-;(async () => {
-  try {
-    const out = await run()
+run()
+  .then(out => {
     console.log(out)
     process.exit(0)
-  } catch (err) {
+  })
+  .catch(err => {
     console.error(err)
     process.exit(1)
-  }
-})()
+  })

src/Misc/externals.sh

@@ -3,11 +3,8 @@ PACKAGERUNTIME=$1
 PRECACHE=$2
 
 NODE_URL=https://nodejs.org/dist
-NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
-# When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
-# Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.5"
-NODE24_VERSION="24.7.0"
+NODE12_VERSION="12.22.7"
+NODE16_VERSION="16.13.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args
@@ -57,22 +54,12 @@ function acquireExternalTool() {
             # Download from source to the partial file.
             echo "Downloading $download_source"
             mkdir -p "$(dirname "$download_target")" || checkRC 'mkdir'
-
-            CURL_VERSION=$(curl --version | awk 'NR==1{print $2}')
-            echo "Curl version: $CURL_VERSION"
-
             # curl -f Fail silently (no output at all) on HTTP errors (H)
+            #      -k Allow connections to SSL sites without certs (H)
             #      -S Show error. With -s, make curl show errors when they occur
             #      -L Follow redirects (H)
             #      -o FILE    Write to FILE instead of stdout
-            #      --retry 3   Retries transient errors 3 times (timeouts, 5xx)
-            if [[ "$(printf '%s\n' "7.71.0" "$CURL_VERSION" | sort -V | head -n1)" != "7.71.0" ]]; then
-                # Curl version is less than or equal to 7.71.0, skipping retry-all-errors flag
-                 curl -fSL --retry 3 -o "$partial_target" "$download_source" 2>"${download_target}_download.log" || checkRC 'curl'
-            else
-                # Curl version is greater than 7.71.0, running curl with --retry-all-errors flag
-                 curl -fSL --retry 3 --retry-all-errors -o "$partial_target" "$download_source" 2>"${download_target}_download.log" || checkRC 'curl'
-            fi
+            curl -fkSL -o "$partial_target" "$download_source" 2>"${download_target}_download.log" || checkRC 'curl'
 
             # Move the partial file to the download target.
             mv "$partial_target" "$download_target" || checkRC 'mv'
@@ -138,22 +125,10 @@ function acquireExternalTool() {
 
 # Download the external tools only for Windows.
 if [[ "$PACKAGERUNTIME" == "win-x64" || "$PACKAGERUNTIME" == "win-x86" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.exe" node20/bin
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.lib" node20/bin
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.exe" node24/bin
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.lib" node24/bin
-    if [[ "$PRECACHE" != "" ]]; then
-        acquireExternalTool "https://github.com/microsoft/vswhere/releases/download/2.6.7/vswhere.exe" vswhere
-    fi
-fi
-
-# Download the external tools only for Windows.
-if [[ "$PACKAGERUNTIME" == "win-arm64" ]]; then
-    # todo: replace these with official release when available
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.exe" node20/bin
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.lib" node20/bin
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.exe" node24/bin
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.lib" node24/bin
+    acquireExternalTool "$NODE_URL/v${NODE12_VERSION}/$PACKAGERUNTIME/node.exe" node12/bin
+    acquireExternalTool "$NODE_URL/v${NODE12_VERSION}/$PACKAGERUNTIME/node.lib" node12/bin
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/$PACKAGERUNTIME/node.exe" node16/bin
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/$PACKAGERUNTIME/node.lib" node16/bin
     if [[ "$PRECACHE" != "" ]]; then
         acquireExternalTool "https://github.com/microsoft/vswhere/releases/download/2.6.7/vswhere.exe" vswhere
     fi
@@ -161,29 +136,29 @@ fi
 
 # Download the external tools only for OSX.
 if [[ "$PACKAGERUNTIME" == "osx-x64" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-darwin-x64.tar.gz" node20 fix_nested_dir
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-darwin-x64.tar.gz" node24 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE12_VERSION}/node-v${NODE12_VERSION}-darwin-x64.tar.gz" node12 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-darwin-x64.tar.gz" node16 fix_nested_dir
 fi
 
 if [[ "$PACKAGERUNTIME" == "osx-arm64" ]]; then
     # node.js v12 doesn't support macOS on arm64.
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-darwin-arm64.tar.gz" node20 fix_nested_dir
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-darwin-arm64.tar.gz" node24 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-darwin-arm64.tar.gz" node16 fix_nested_dir
 fi
 
 # Download the external tools for Linux PACKAGERUNTIMEs.
 if [[ "$PACKAGERUNTIME" == "linux-x64" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-x64.tar.gz" node20 fix_nested_dir
-    acquireExternalTool "$NODE_ALPINE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-alpine-x64.tar.gz" node20_alpine
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-linux-x64.tar.gz" node24 fix_nested_dir
-    acquireExternalTool "$NODE_ALPINE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-alpine-x64.tar.gz" node24_alpine
+    acquireExternalTool "$NODE_URL/v${NODE12_VERSION}/node-v${NODE12_VERSION}-linux-x64.tar.gz" node12 fix_nested_dir
+    acquireExternalTool "https://vstsagenttools.blob.core.windows.net/tools/nodejs/${NODE12_VERSION}/alpine/x64/node-v${NODE12_VERSION}-alpine-x64.tar.gz" node12_alpine
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-linux-x64.tar.gz" node16 fix_nested_dir
+    acquireExternalTool "https://vstsagenttools.blob.core.windows.net/tools/nodejs/${NODE16_VERSION}/alpine/x64/node-v${NODE16_VERSION}-alpine-x64.tar.gz" node16_alpine
 fi
 
 if [[ "$PACKAGERUNTIME" == "linux-arm64" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-arm64.tar.gz" node20 fix_nested_dir
-    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-linux-arm64.tar.gz" node24 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE12_VERSION}/node-v${NODE12_VERSION}-linux-arm64.tar.gz" node12 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-linux-arm64.tar.gz" node16 fix_nested_dir
 fi
 
 if [[ "$PACKAGERUNTIME" == "linux-arm" ]]; then
-    acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-armv7l.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE12_VERSION}/node-v${NODE12_VERSION}-linux-armv7l.tar.gz" node12 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE16_VERSION}/node-v${NODE16_VERSION}-linux-armv7l.tar.gz" node16 fix_nested_dir
 fi

src/Misc/layoutbin/RunnerService.js

@@ -24,8 +24,7 @@ if (exitServiceAfterNFailures <= 0) {
   exitServiceAfterNFailures = NaN;
 }
 
-var unknownFailureRetryCount = 0;
-var retriableFailureRetryCount = 0;
+var consecutiveFailureCount = 0;
 
 var gracefulShutdown = function () {
   console.log("Shutting down runner listener");
@@ -63,8 +62,7 @@ var runService = function () {
 
       listener.stdout.on("data", (data) => {
         if (data.toString("utf8").includes("Listening for Jobs")) {
-          unknownFailureRetryCount = 0;
-          retriableFailureRetryCount = 0;
+          consecutiveFailureCount = 0;
         }
         process.stdout.write(data.toString("utf8"));
       });
@@ -94,43 +92,24 @@ var runService = function () {
           console.log(
             "Runner listener exit with retryable error, re-launch runner in 5 seconds."
           );
-          unknownFailureRetryCount = 0;
-          retriableFailureRetryCount++;
-          if (retriableFailureRetryCount >= 10) {
-            console.error(
-              "Stopping the runner after 10 consecutive re-tryable failures"
-            );
-            stopping = true;
-          }
+          consecutiveFailureCount = 0;
         } else if (code === 3 || code === 4) {
           console.log(
             "Runner listener exit because of updating, re-launch runner in 5 seconds."
           );
-          unknownFailureRetryCount = 0;
-          retriableFailureRetryCount++;
-          if (retriableFailureRetryCount >= 10) {
-            console.error(
-              "Stopping the runner after 10 consecutive re-tryable failures"
-            );
-            stopping = true;
-          }
-        } else if (code === 5) {
-          console.log(
-            "Runner listener exit with Session Conflict error, stop the service, no retry needed."
-          );
-          stopping = true;
+          consecutiveFailureCount = 0;
         } else {
           var messagePrefix = "Runner listener exit with undefined return code";
-          unknownFailureRetryCount++;
-          retriableFailureRetryCount = 0;
+          consecutiveFailureCount++;
           if (
             !isNaN(exitServiceAfterNFailures) &&
-            unknownFailureRetryCount >= exitServiceAfterNFailures
+            consecutiveFailureCount >= exitServiceAfterNFailures
           ) {
             console.error(
-              `${messagePrefix}, exiting service after ${unknownFailureRetryCount} consecutive failures`
+              `${messagePrefix}, exiting service after ${consecutiveFailureCount} consecutive failures`
             );
-            stopping = true
+            gracefulShutdown();
+            return;
           } else {
             console.log(`${messagePrefix}, re-launch runner in 5 seconds.`);
           }

src/Misc/layoutbin/installdependencies.sh

@@ -66,7 +66,7 @@ then
             fi
         fi
 
-        $apt_get update && $apt_get install -y libkrb5-3 zlib1g
+        $apt_get update && $apt_get install -y liblttng-ust0 libkrb5-3 zlib1g
         if [ $? -ne 0 ]
         then
             echo "'$apt_get' failed with exit code '$?'"
@@ -94,14 +94,6 @@ then
             fi
         }
 
-        apt_get_with_fallbacks liblttng-ust1 liblttng-ust0
-        if [ $? -ne 0 ]
-        then
-            echo "'$apt_get' failed with exit code '$?'"
-            print_errormessage
-            exit 1
-        fi
-
         apt_get_with_fallbacks libssl1.1$ libssl1.0.2$ libssl1.0.0$
         if [ $? -ne 0 ]
         then

src/Misc/layoutbin/runsvc.sh

@@ -10,7 +10,7 @@ if [ -f ".path" ]; then
     echo ".path=${PATH}"
 fi
 
-nodever="node20"
+nodever=${GITHUB_ACTIONS_RUNNER_FORCED_NODE_VERSION:-node16}
 
 # insert anything to setup env when running as a service
 # run the host process which keep the listener alive

src/Misc/layoutbin/update.cmd.template

@@ -120,9 +120,6 @@ if ERRORLEVEL 1 (
 
 echo [%date% %time%] Update succeed >> "%logfile%" 2>&1
 
-type nul > update.finished
-echo [%date% %time%] update.finished file creation succeed >> "%logfile%" 2>&1
-
 rem rename the update log file with %logfile%.succeed/.failed/succeedneedrestart
 rem runner service host can base on the log file name determin the result of the runner update
 echo [%date% %time%] Rename "%logfile%" to be "%logfile%.succeed" >> "%logfile%" 2>&1

src/Misc/layoutbin/update.sh.template

@@ -123,7 +123,7 @@ fi
 # fix upgrade issue with macOS when running as a service
 attemptedtargetedfix=0
 currentplatform=$(uname | awk '{print tolower($0)}')
-if [[ "$currentplatform" == 'darwin'  && $restartinteractiverunner -eq 0 ]]; then
+if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
     # We needed a fix for https://github.com/actions/runner/issues/743
     # We will recreate the ./externals/nodeXY/bin/node of the past runner version that launched the runnerlistener service
     # Otherwise mac gatekeeper kills the processes we spawn on creation as we are running a process with no backing file
@@ -135,23 +135,12 @@ if [[ "$currentplatform" == 'darwin'  && $restartinteractiverunner -eq 0 ]]; the
     then
         # inspect the open file handles to find the node process
         # we can't actually inspect the process using ps because it uses relative paths and doesn't follow symlinks
-        # Try finding node24 first, then fallback to earlier versions if needed
-        nodever="node24"
+        nodever="node16"
         path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-        if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node20
+        if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node12
         then
-            nodever="node20"
+            nodever="node12"
             path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-            if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node16
-            then
-                nodever="node16"
-                path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-                if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node12
-                then
-                    nodever="node12"
-                    path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-                fi
-            fi
         fi
         if [[ $? -eq 0 && -n "$path" ]]
         then
@@ -189,24 +178,8 @@ if [[ "$currentplatform" == 'darwin'  && $restartinteractiverunner -eq 0 ]]; the
     fi
 fi
 
-# update runsvc.sh
-if [ -f "$rootfolder/runsvc.sh" ]
-then
-    date "+[%F %T-%4N] Update runsvc.sh" >> "$logfile" 2>&1
-    cat "$rootfolder/bin/runsvc.sh" > "$rootfolder/runsvc.sh"
-    if [ $? -ne 0 ]
-    then
-        date "+[%F %T-%4N] Can't update $rootfolder/runsvc.sh using $rootfolder/bin/runsvc.sh" >> "$logfile" 2>&1
-        mv -fv "$logfile" "$logfile.failed"
-        exit 1
-    fi
-fi
-
 date "+[%F %T-%4N] Update succeed" >> "$logfile"
 
-touch update.finished
-date "+[%F %T-%4N] update.finished file creation succeed" >> "$logfile"
-
 # rename the update log file with %logfile%.succeed/.failed/succeedneedrestart
 # runner service host can base on the log file name determin the result of the runner update
 date "+[%F %T-%4N] Rename $logfile to be $logfile.succeed" >> "$logfile" 2>&1

src/Misc/layoutroot/run-helper.cmd.template

@@ -1,8 +1,8 @@
 @echo off
-SET UPDATEFILE=update.finished
+
 "%~dp0\bin\Runner.Listener.exe" run %*
 
-rem using `if %ERRORLEVEL% EQU N` instead of `if ERRORLEVEL N`
+rem using `if %ERRORLEVEL% EQU N` insterad of `if ERRORLEVEL N`
 rem `if ERRORLEVEL N` means: error level is N or MORE
   
 if %ERRORLEVEL% EQU 0 (
@@ -22,37 +22,18 @@ if %ERRORLEVEL% EQU 2 (
 )
 
 if %ERRORLEVEL% EQU 3 (
-  rem Wait for 30 seconds or for flag file to exists for the ephemeral runner update process finish
-  echo "Runner listener exit because of updating, re-launch runner after successful update"
-  FOR /L %%G IN (1,1,30) DO (
-    IF EXIST %UPDATEFILE% (
-      echo "Update finished successfully."
-      del %FILE%
-      exit /b 1
-    )
-    ping 127.0.0.1 -n 2 -w 1000 >NUL
-  )
+  rem Sleep 5 seconds to wait for the runner update process finish
+  echo "Runner listener exit because of updating, re-launch runner in 5 seconds"
+  ping 127.0.0.1 -n 6 -w 1000 >NUL
   exit /b 1
 )
 
 if %ERRORLEVEL% EQU 4 (
-  rem Wait for 30 seconds or for flag file to exists for the runner update process finish
-  echo "Runner listener exit because of updating, re-launch runner after successful update"
-  FOR /L %%G IN (1,1,30) DO (
-    IF EXIST %UPDATEFILE% (
-      echo "Update finished successfully."
-      del %FILE%
-      exit /b 1
-    )
-    ping 127.0.0.1 -n 2 -w 1000 >NUL
-  )
+  rem Sleep 5 seconds to wait for the ephemeral runner update process finish
+  echo "Runner listener exit because of updating, re-launch ephemeral runner in 5 seconds"
+  ping 127.0.0.1 -n 6 -w 1000 >NUL
   exit /b 1
 )
 
-if %ERRORLEVEL% EQU 5 (
-  echo "Runner listener exit with Session Conflict error, stop the service, no retry needed."
-  exit /b 0
-)
-
 echo "Exiting after unknown error code: %ERRORLEVEL%"
 exit /b 0

src/Misc/layoutroot/run-helper.sh.template

@@ -17,22 +17,6 @@ while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symli
     [[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located
 done
 DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
-
-# Wait for docker to start
-if [ ! -z "$RUNNER_WAIT_FOR_DOCKER_IN_SECONDS" ]; then
-    if [ "$RUNNER_WAIT_FOR_DOCKER_IN_SECONDS" -gt 0 ]; then
-        echo "Waiting for docker to be ready."
-        for i in $(seq "$RUNNER_WAIT_FOR_DOCKER_IN_SECONDS"); do
-            if docker ps > /dev/null 2>&1; then
-                echo "Docker is ready."
-                break
-            fi
-            "$DIR"/safe_sleep.sh 1
-        done
-    fi
-fi
-
-updateFile="update.finished"
 "$DIR"/bin/Runner.Listener run $*
 
 returnCode=$?
@@ -47,32 +31,15 @@ elif [[ $returnCode == 2 ]]; then
     "$DIR"/safe_sleep.sh 5
     exit 2
 elif [[ $returnCode == 3 ]]; then
-    # Wait for 30 seconds or for flag file to exists for the runner update process finish
-    echo "Runner listener exit because of updating, re-launch runner after successful update"
-    for i in {0..30}; do
-        if test -f "$updateFile"; then
-            echo "Update finished successfully."
-            rm "$updateFile"
-            break
-        fi
-        "$DIR"/safe_sleep.sh 1
-    done
+    # Sleep 5 seconds to wait for the runner update process finish
+    echo "Runner listener exit because of updating, re-launch runner in 5 seconds"
+    "$DIR"/safe_sleep.sh 5
     exit 2
 elif [[ $returnCode == 4 ]]; then
-    # Wait for 30 seconds or for flag file to exists for the ephemeral runner update process finish
-    echo "Runner listener exit because of updating, re-launch runner after successful update"
-    for i in {0..30}; do
-        if test -f "$updateFile"; then
-            echo "Update finished successfully."
-            rm "$updateFile"
-            break
-        fi
-        "$DIR"/safe_sleep.sh 1
-    done
+    # Sleep 5 seconds to wait for the ephemeral runner update process finish
+    echo "Runner listener exit because of updating, re-launch ephemeral runner in 5 seconds"
+    "$DIR"/safe_sleep.sh 5
     exit 2
-elif [[ $returnCode == 5 ]]; then
-    echo "Runner listener exit with Session Conflict error, stop the service, no retry needed."
-    exit 0
 else
     echo "Exiting with unknown error code: ${returnCode}"
     exit 0

src/Misc/layoutroot/run.sh

@@ -9,79 +9,16 @@ while [ -h "$SOURCE" ]; do # resolve $SOURCE until the file is no longer a symli
     [[ $SOURCE != /* ]] && SOURCE="$DIR/$SOURCE" # if $SOURCE was a relative symlink, we need to resolve it relative to the path where the symlink file was located
 done
 DIR="$( cd -P "$( dirname "$SOURCE" )" && pwd )"
-
-run() {
-    # run the helper process which keep the listener alive
-    while :;
-    do
-        cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh
-        "$DIR"/run-helper.sh $*
-        returnCode=$?
-        if [[ $returnCode -eq 2 ]]; then
-            echo "Restarting runner..."
-        else
-            echo "Exiting runner..."
-            exit 0
-        fi
-    done
-}
-
-runWithManualTrap() {
-    # Set job control
-    set -m
-
-    trap 'kill -INT -$PID' INT TERM
-
-    # run the helper process which keep the listener alive
-    while :;
-    do
-        cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh
-        "$DIR"/run-helper.sh $* &
-        PID=$!
-        wait $PID
-        returnCode=$?
-        if [[ $returnCode -eq 2 ]]; then
-            echo "Restarting runner..."
-        else
-            echo "Exiting runner..."
-            # Unregister signal handling before exit
-            trap - INT TERM
-            # wait for last parts to be logged
-            wait $PID
-            exit $returnCode
-        fi
-    done
-}
-
-function updateCerts() {
-    local sudo_prefix=""
-    local user_id=`id -u`
-
-    if [ $user_id -ne 0 ]; then
-        if [[ ! -x "$(command -v sudo)" ]]; then
-            echo "Warning: failed to update certificate store: sudo is required but not found"
-            return 1
-        else
-            sudo_prefix="sudo"
-        fi
-    fi
-
-    if [[ -x "$(command -v update-ca-certificates)" ]]; then
-        eval $sudo_prefix "update-ca-certificates"
-    elif [[ -x "$(command -v update-ca-trust)" ]]; then
-        eval $sudo_prefix "update-ca-trust"
+cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh
+# run the helper process which keep the listener alive
+while :;
+do
+    "$DIR"/run-helper.sh $*
+    returnCode=$?
+    if [[ $returnCode -eq 2 ]]; then
+        echo "Restarting runner..."
     else
-        echo "Warning: failed to update certificate store: update-ca-certificates or update-ca-trust not found. This can happen if you're using a different runner base image."
-        return 1
+        echo "Exiting runner..."
+        exit 0
     fi
-}
-
-if [[ ! -z "$RUNNER_UPDATE_CA_CERTS" ]]; then
-    updateCerts
-fi
-
-if [[ -z "$RUNNER_MANUALLY_TRAP_SIG" ]]; then
-    run $*
-else
-    runWithManualTrap $*
-fi
+done

src/Misc/layoutroot/safe_sleep.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
 SECONDS=0
-while [[ $SECONDS -lt $1 ]]; do
+while [[ $SECONDS != $1 ]]; do
     :
 done

src/Misc/runnercoreassets

@@ -0,0 +1,57 @@
+actions.runner.plist.template
+actions.runner.service.template
+checkScripts/downloadCert.js
+checkScripts/makeWebRequest.js
+darwin.svc.sh.template
+hashFiles/index.js
+installdependencies.sh
+macos-run-invoker.js
+Microsoft.IdentityModel.Logging.dll
+Microsoft.IdentityModel.Tokens.dll
+Minimatch.dll
+Newtonsoft.Json.Bson.dll
+Newtonsoft.Json.dll
+Runner.Common.deps.json
+Runner.Common.dll
+Runner.Common.pdb
+Runner.Listener
+Runner.Listener.deps.json
+Runner.Listener.dll
+Runner.Listener.exe
+Runner.Listener.pdb
+Runner.Listener.runtimeconfig.json
+Runner.PluginHost
+Runner.PluginHost.deps.json
+Runner.PluginHost.dll
+Runner.PluginHost.exe
+Runner.PluginHost.pdb
+Runner.PluginHost.runtimeconfig.json
+Runner.Plugins.deps.json
+Runner.Plugins.dll
+Runner.Plugins.pdb
+Runner.Sdk.deps.json
+Runner.Sdk.dll
+Runner.Sdk.pdb
+Runner.Worker
+Runner.Worker.deps.json
+Runner.Worker.dll
+Runner.Worker.exe
+Runner.Worker.pdb
+Runner.Worker.runtimeconfig.json
+RunnerService.exe
+RunnerService.exe.config
+RunnerService.js
+RunnerService.pdb
+runsvc.sh
+Sdk.deps.json
+Sdk.dll
+Sdk.pdb
+System.IdentityModel.Tokens.Jwt.dll
+System.Net.Http.Formatting.dll
+System.Security.Cryptography.Pkcs.dll
+System.Security.Cryptography.ProtectedData.dll
+System.ServiceProcess.ServiceController.dll
+systemd.svc.sh.template
+update.cmd.template
+update.sh.template
+YamlDotNet.dll

src/Misc/runnerdotnetruntimeassets

@@ -0,0 +1,264 @@
+api-ms-win-core-console-l1-1-0.dll
+api-ms-win-core-console-l1-2-0.dll
+api-ms-win-core-datetime-l1-1-0.dll
+api-ms-win-core-debug-l1-1-0.dll
+api-ms-win-core-errorhandling-l1-1-0.dll
+api-ms-win-core-fibers-l1-1-0.dll
+api-ms-win-core-file-l1-1-0.dll
+api-ms-win-core-file-l1-2-0.dll
+api-ms-win-core-file-l2-1-0.dll
+api-ms-win-core-handle-l1-1-0.dll
+api-ms-win-core-heap-l1-1-0.dll
+api-ms-win-core-interlocked-l1-1-0.dll
+api-ms-win-core-libraryloader-l1-1-0.dll
+api-ms-win-core-localization-l1-2-0.dll
+api-ms-win-core-memory-l1-1-0.dll
+api-ms-win-core-namedpipe-l1-1-0.dll
+api-ms-win-core-processenvironment-l1-1-0.dll
+api-ms-win-core-processthreads-l1-1-0.dll
+api-ms-win-core-processthreads-l1-1-1.dll
+api-ms-win-core-profile-l1-1-0.dll
+api-ms-win-core-rtlsupport-l1-1-0.dll
+api-ms-win-core-string-l1-1-0.dll
+api-ms-win-core-synch-l1-1-0.dll
+api-ms-win-core-synch-l1-2-0.dll
+api-ms-win-core-sysinfo-l1-1-0.dll
+api-ms-win-core-timezone-l1-1-0.dll
+api-ms-win-core-util-l1-1-0.dll
+api-ms-win-crt-conio-l1-1-0.dll
+api-ms-win-crt-convert-l1-1-0.dll
+api-ms-win-crt-environment-l1-1-0.dll
+api-ms-win-crt-filesystem-l1-1-0.dll
+api-ms-win-crt-heap-l1-1-0.dll
+api-ms-win-crt-locale-l1-1-0.dll
+api-ms-win-crt-math-l1-1-0.dll
+api-ms-win-crt-multibyte-l1-1-0.dll
+api-ms-win-crt-private-l1-1-0.dll
+api-ms-win-crt-process-l1-1-0.dll
+api-ms-win-crt-runtime-l1-1-0.dll
+api-ms-win-crt-stdio-l1-1-0.dll
+api-ms-win-crt-string-l1-1-0.dll
+api-ms-win-crt-time-l1-1-0.dll
+api-ms-win-crt-utility-l1-1-0.dll
+clrcompression.dll
+clretwrc.dll
+clrjit.dll
+coreclr.dll
+createdump
+createdump.exe
+dbgshim.dll
+hostfxr.dll
+hostpolicy.dll
+libclrjit.dylib
+libclrjit.so
+libcoreclr.dylib
+libcoreclr.so
+libcoreclrtraceptprovider.so
+libdbgshim.dylib
+libdbgshim.so
+libhostfxr.dylib
+libhostfxr.so
+libhostpolicy.dylib
+libhostpolicy.so
+libmscordaccore.dylib
+libmscordaccore.so
+libmscordbi.dylib
+libmscordbi.so
+Microsoft.CSharp.dll
+Microsoft.DiaSymReader.Native.amd64.dll
+Microsoft.VisualBasic.Core.dll
+Microsoft.VisualBasic.dll
+Microsoft.Win32.Primitives.dll
+Microsoft.Win32.Registry.dll
+mscordaccore.dll
+mscordaccore_amd64_amd64_6.0.522.21309.dll
+mscordbi.dll
+mscorlib.dll
+mscorrc.debug.dll
+mscorrc.dll
+msquic.dll
+netstandard.dll
+SOS_README.md
+System.AppContext.dll
+System.Buffers.dll
+System.Collections.Concurrent.dll
+System.Collections.dll
+System.Collections.Immutable.dll
+System.Collections.NonGeneric.dll
+System.Collections.Specialized.dll
+System.ComponentModel.Annotations.dll
+System.ComponentModel.DataAnnotations.dll
+System.ComponentModel.dll
+System.ComponentModel.EventBasedAsync.dll
+System.ComponentModel.Primitives.dll
+System.ComponentModel.TypeConverter.dll
+System.Configuration.dll
+System.Console.dll
+System.Core.dll
+System.Data.Common.dll
+System.Data.DataSetExtensions.dll
+System.Data.dll
+System.Diagnostics.Contracts.dll
+System.Diagnostics.Debug.dll
+System.Diagnostics.DiagnosticSource.dll
+System.Diagnostics.FileVersionInfo.dll
+System.Diagnostics.Process.dll
+System.Diagnostics.StackTrace.dll
+System.Diagnostics.TextWriterTraceListener.dll
+System.Diagnostics.Tools.dll
+System.Diagnostics.TraceSource.dll
+System.Diagnostics.Tracing.dll
+System.dll
+System.Drawing.dll
+System.Drawing.Primitives.dll
+System.Dynamic.Runtime.dll
+System.Formats.Asn1.dll
+System.Globalization.Calendars.dll
+System.Globalization.dll
+System.Globalization.Extensions.dll
+System.Globalization.Native.dylib
+System.Globalization.Native.so
+System.IO.Compression.Brotli.dll
+System.IO.Compression.dll
+System.IO.Compression.FileSystem.dll
+System.IO.Compression.Native.a
+System.IO.Compression.Native.dll
+System.IO.Compression.Native.dylib
+System.IO.Compression.Native.so
+System.IO.Compression.ZipFile.dll
+System.IO.dll
+System.IO.FileSystem.AccessControl.dll
+System.IO.FileSystem.dll
+System.IO.FileSystem.DriveInfo.dll
+System.IO.FileSystem.Primitives.dll
+System.IO.FileSystem.Watcher.dll
+System.IO.IsolatedStorage.dll
+System.IO.MemoryMappedFiles.dll
+System.IO.Pipes.AccessControl.dll
+System.IO.Pipes.dll
+System.IO.UnmanagedMemoryStream.dll
+System.Linq.dll
+System.Linq.Expressions.dll
+System.Linq.Parallel.dll
+System.Linq.Queryable.dll
+System.Memory.dll
+System.Native.a
+System.Native.dylib
+System.Native.so
+System.Net.dll
+System.Net.Http.dll
+System.Net.Http.Json.dll
+System.Net.Http.Native.a
+System.Net.Http.Native.dylib
+System.Net.Http.Native.so
+System.Net.HttpListener.dll
+System.Net.Mail.dll
+System.Net.NameResolution.dll
+System.Net.NetworkInformation.dll
+System.Net.Ping.dll
+System.Net.Primitives.dll
+System.Net.Quic.dll
+System.Net.Requests.dll
+System.Net.Security.dll
+System.Net.Security.Native.a
+System.Net.Security.Native.dylib
+System.Net.Security.Native.so
+System.Net.ServicePoint.dll
+System.Net.Sockets.dll
+System.Net.WebClient.dll
+System.Net.WebHeaderCollection.dll
+System.Net.WebProxy.dll
+System.Net.WebSockets.Client.dll
+System.Net.WebSockets.dll
+System.Numerics.dll
+System.Numerics.Vectors.dll
+System.ObjectModel.dll
+System.Private.CoreLib.dll
+System.Private.DataContractSerialization.dll
+System.Private.Uri.dll
+System.Private.Xml.dll
+System.Private.Xml.Linq.dll
+System.Reflection.DispatchProxy.dll
+System.Reflection.dll
+System.Reflection.Emit.dll
+System.Reflection.Emit.ILGeneration.dll
+System.Reflection.Emit.Lightweight.dll
+System.Reflection.Extensions.dll
+System.Reflection.Metadata.dll
+System.Reflection.Primitives.dll
+System.Reflection.TypeExtensions.dll
+System.Resources.Reader.dll
+System.Resources.ResourceManager.dll
+System.Resources.Writer.dll
+System.Runtime.CompilerServices.Unsafe.dll
+System.Runtime.CompilerServices.VisualC.dll
+System.Runtime.dll
+System.Runtime.Extensions.dll
+System.Runtime.Handles.dll
+System.Runtime.InteropServices.dll
+System.Runtime.InteropServices.RuntimeInformation.dll
+System.Runtime.InteropServices.WindowsRuntime.dll
+System.Runtime.Intrinsics.dll
+System.Runtime.Loader.dll
+System.Runtime.Numerics.dll
+System.Runtime.Serialization.dll
+System.Runtime.Serialization.Formatters.dll
+System.Runtime.Serialization.Json.dll
+System.Runtime.Serialization.Primitives.dll
+System.Runtime.Serialization.Xml.dll
+System.Runtime.WindowsRuntime.dll
+System.Runtime.WindowsRuntime.UI.Xaml.dll
+System.Security.AccessControl.dll
+System.Security.Claims.dll
+System.Security.Cryptography.Algorithms.dll
+System.Security.Cryptography.Cng.dll
+System.Security.Cryptography.Csp.dll
+System.Security.Cryptography.Encoding.dll
+System.Security.Cryptography.Native.Apple.a
+System.Security.Cryptography.Native.Apple.dylib
+System.Security.Cryptography.Native.OpenSsl.a
+System.Security.Cryptography.Native.OpenSsl.dylib
+System.Security.Cryptography.Native.OpenSsl.so
+System.Security.Cryptography.OpenSsl.dll
+System.Security.Cryptography.Primitives.dll
+System.Security.Cryptography.X509Certificates.dll
+System.Security.Cryptography.XCertificates.dll
+System.Security.dll
+System.Security.Principal.dll
+System.Security.Principal.Windows.dll
+System.Security.SecureString.dll
+System.ServiceModel.Web.dll
+System.ServiceProcess.dll
+System.Text.Encoding.CodePages.dll
+System.Text.Encoding.dll
+System.Text.Encoding.Extensions.dll
+System.Text.Encodings.Web.dll
+System.Text.Json.dll
+System.Text.RegularExpressions.dll
+System.Threading.Channels.dll
+System.Threading.dll
+System.Threading.Overlapped.dll
+System.Threading.Tasks.Dataflow.dll
+System.Threading.Tasks.dll
+System.Threading.Tasks.Extensions.dll
+System.Threading.Tasks.Parallel.dll
+System.Threading.Thread.dll
+System.Threading.ThreadPool.dll
+System.Threading.Timer.dll
+System.Transactions.dll
+System.Transactions.Local.dll
+System.ValueTuple.dll
+System.Web.dll
+System.Web.HttpUtility.dll
+System.Windows.dll
+System.Xml.dll
+System.Xml.Linq.dll
+System.Xml.ReaderWriter.dll
+System.Xml.Serialization.dll
+System.Xml.XDocument.dll
+System.Xml.XmlDocument.dll
+System.Xml.XmlSerializer.dll
+System.Xml.XPath.dll
+System.Xml.XPath.XDocument.dll
+ucrtbase.dll
+WindowsBase.dll

src/Misc/trimmedpackages_targz.json

@@ -0,0 +1,24 @@
+[
+    {
+        "HashValue": "<NO_RUNTIME_EXTERNALS_HASH>",
+        "DownloadUrl": "https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-<RUNNER_PLATFORM>-<RUNNER_VERSION>-noruntime-noexternals.tar.gz",
+        "TrimmedContents": {
+            "dotnetRuntime": "<RUNTIME_HASH>",
+            "externals": "<EXTERNALS_HASH>"
+        }
+    },
+    {
+        "HashValue": "<NO_RUNTIME_HASH>",
+        "DownloadUrl": "https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-<RUNNER_PLATFORM>-<RUNNER_VERSION>-noruntime.tar.gz",
+        "TrimmedContents": {
+            "dotnetRuntime": "<RUNTIME_HASH>"
+        }
+    },
+    {
+        "HashValue": "<NO_EXTERNALS_HASH>",
+        "DownloadUrl": "https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-<RUNNER_PLATFORM>-<RUNNER_VERSION>-noexternals.tar.gz",
+        "TrimmedContents": {
+            "externals": "<EXTERNALS_HASH>"
+        }
+    }
+]

src/Misc/trimmedpackages_zip.json

@@ -0,0 +1,24 @@
+[
+    {
+        "HashValue": "<NO_RUNTIME_EXTERNALS_HASH>",
+        "DownloadUrl": "https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-<RUNNER_PLATFORM>-<RUNNER_VERSION>-noruntime-noexternals.zip",
+        "TrimmedContents": {
+            "dotnetRuntime": "<RUNTIME_HASH>",
+            "externals": "<EXTERNALS_HASH>"
+        }
+    },
+    {
+        "HashValue": "<NO_RUNTIME_HASH>",
+        "DownloadUrl": "https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-<RUNNER_PLATFORM>-<RUNNER_VERSION>-noruntime.zip",
+        "TrimmedContents": {
+            "dotnetRuntime": "<RUNTIME_HASH>"
+        }
+    },
+    {
+        "HashValue": "<NO_EXTERNALS_HASH>",
+        "DownloadUrl": "https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-<RUNNER_PLATFORM>-<RUNNER_VERSION>-noexternals.zip",
+        "TrimmedContents": {
+            "externals": "<EXTERNALS_HASH>"
+        }
+    }
+]

src/Runner.Common/ActionCommand.cs

@@ -1,4 +1,5 @@
-using GitHub.Runner.Sdk;
+using GitHub.Runner.Common.Util;
+using GitHub.Runner.Sdk;
 using System;
 using System.Collections.Generic;
 
@@ -31,7 +32,7 @@ namespace GitHub.Runner.Common
             new EscapeMapping(token: "%", replacement: "%25"),
         };
 
-        private readonly Dictionary<string, string> _properties = new(StringComparer.OrdinalIgnoreCase);
+        private readonly Dictionary<string, string> _properties = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
         public const string Prefix = "##[";
         public const string _commandKey = "::";
 

src/Runner.Common/ActionResult.cs

@@ -1,4 +1,6 @@
-namespace GitHub.Runner.Common
+using System;
+
+namespace GitHub.Runner.Common
 {
     public enum ActionResult
     {
@@ -10,4 +12,4 @@
 
         Skipped = 3
     }
-}
+}

src/Runner.Common/ActionsRunServer.cs

@@ -1,51 +0,0 @@
-using System;
-using System.Threading;
-using System.Threading.Tasks;
-using GitHub.DistributedTask.Pipelines;
-using GitHub.DistributedTask.WebApi;
-using GitHub.Services.Common;
-using GitHub.Services.WebApi;
-
-namespace GitHub.Runner.Common
-{
-    [ServiceLocator(Default = typeof(ActionsRunServer))]
-    public interface IActionsRunServer : IRunnerService
-    {
-        Task ConnectAsync(Uri serverUrl, VssCredentials credentials);
-
-        Task<AgentJobRequestMessage> GetJobMessageAsync(string id, CancellationToken token);
-    }
-
-    public sealed class ActionsRunServer : RunnerService, IActionsRunServer
-    {
-        private bool _hasConnection;
-        private VssConnection _connection;
-        private ActionsRunServerHttpClient _actionsRunServerClient;
-
-        public async Task ConnectAsync(Uri serverUrl, VssCredentials credentials)
-        {
-            _connection = await EstablishVssConnection(serverUrl, credentials, TimeSpan.FromSeconds(100));
-            _actionsRunServerClient = _connection.GetClient<ActionsRunServerHttpClient>();
-            _hasConnection = true;
-        }
-
-        private void CheckConnection()
-        {
-            if (!_hasConnection)
-            {
-                throw new InvalidOperationException($"SetConnection");
-            }
-        }
-
-        public Task<AgentJobRequestMessage> GetJobMessageAsync(string id, CancellationToken cancellationToken)
-        {
-            CheckConnection();
-            var jobMessage = RetryRequest<AgentJobRequestMessage>(async () =>
-                                                    {
-                                                        return await _actionsRunServerClient.GetJobMessageAsync(id, cancellationToken);
-                                                    }, cancellationToken);
-
-            return jobMessage;
-        }
-    }
-}

src/Runner.Common/AuthMigration.cs

@@ -1,13 +0,0 @@
-using System;
-
-namespace GitHub.Runner.Common
-{
-    public class AuthMigrationEventArgs : EventArgs
-    {
-        public AuthMigrationEventArgs(string trace)
-        {
-            Trace = trace;
-        }
-        public string Trace { get; private set; }
-    }
-}

src/Runner.Common/BrokerServer.cs

@@ -1,119 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Threading;
-using System.Threading.Tasks;
-using GitHub.Actions.RunService.WebApi;
-using GitHub.DistributedTask.Pipelines;
-using GitHub.DistributedTask.WebApi;
-using GitHub.Runner.Sdk;
-using GitHub.Services.Common;
-using GitHub.Services.WebApi;
-using Sdk.RSWebApi.Contracts;
-using Sdk.WebApi.WebApi.RawClient;
-
-namespace GitHub.Runner.Common
-{
-    [ServiceLocator(Default = typeof(BrokerServer))]
-    public interface IBrokerServer : IRunnerService
-    {
-        Task ConnectAsync(Uri serverUrl, VssCredentials credentials);
-
-        Task<TaskAgentSession> CreateSessionAsync(TaskAgentSession session, CancellationToken cancellationToken);
-        Task DeleteSessionAsync(CancellationToken cancellationToken);
-
-        Task<TaskAgentMessage> GetRunnerMessageAsync(Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, bool disableUpdate, CancellationToken token);
-
-        Task AcknowledgeRunnerRequestAsync(string runnerRequestId, Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, CancellationToken token);
-
-        Task UpdateConnectionIfNeeded(Uri serverUri, VssCredentials credentials);
-
-        Task ForceRefreshConnection(VssCredentials credentials);
-    }
-
-    public sealed class BrokerServer : RunnerService, IBrokerServer
-    {
-        private bool _hasConnection;
-        private Uri _brokerUri;
-        private RawConnection _connection;
-        private BrokerHttpClient _brokerHttpClient;
-
-        public async Task ConnectAsync(Uri serverUri, VssCredentials credentials)
-        {
-            Trace.Entering();
-            _brokerUri = serverUri;
-
-            _connection = VssUtil.CreateRawConnection(serverUri, credentials);
-            _brokerHttpClient = await _connection.GetClientAsync<BrokerHttpClient>();
-            _hasConnection = true;
-        }
-
-        private void CheckConnection()
-        {
-            if (!_hasConnection)
-            {
-                throw new InvalidOperationException($"SetConnection");
-            }
-        }
-
-        public async Task<TaskAgentSession> CreateSessionAsync(TaskAgentSession session, CancellationToken cancellationToken)
-        {
-            CheckConnection();
-            var jobMessage = await _brokerHttpClient.CreateSessionAsync(session, cancellationToken);
-
-            return jobMessage;
-        }
-
-        public Task<TaskAgentMessage> GetRunnerMessageAsync(Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, bool disableUpdate, CancellationToken cancellationToken)
-        {
-            CheckConnection();
-            var brokerSession = RetryRequest<TaskAgentMessage>(
-                async () => await _brokerHttpClient.GetRunnerMessageAsync(sessionId, version, status, os, architecture, disableUpdate, cancellationToken), cancellationToken, shouldRetry: ShouldRetryException);
-
-            return brokerSession;
-        }
-
-        public async Task AcknowledgeRunnerRequestAsync(string runnerRequestId, Guid? sessionId, TaskAgentStatus status, string version, string os, string architecture, CancellationToken cancellationToken)
-        {
-            CheckConnection();
-
-            // No retries
-            await _brokerHttpClient.AcknowledgeRunnerRequestAsync(runnerRequestId, sessionId, version, status, os, architecture, cancellationToken);
-        }
-
-        public async Task DeleteSessionAsync(CancellationToken cancellationToken)
-        {
-            CheckConnection();
-            await _brokerHttpClient.DeleteSessionAsync(cancellationToken);
-        }
-
-        public Task UpdateConnectionIfNeeded(Uri serverUri, VssCredentials credentials)
-        {
-            if (_brokerUri != serverUri || !_hasConnection)
-            {
-                return ConnectAsync(serverUri, credentials);
-            }
-
-            return Task.CompletedTask;
-        }
-
-        public Task ForceRefreshConnection(VssCredentials credentials)
-        {
-            if (!string.IsNullOrEmpty(_brokerUri?.AbsoluteUri))
-            {
-                return ConnectAsync(_brokerUri, credentials);
-            }
-
-            return Task.CompletedTask;
-        }
-
-        public bool ShouldRetryException(Exception ex)
-        {
-            if (ex is AccessDeniedException || ex is RunnerNotFoundException || ex is HostedRunnerDeprovisionedException)
-            {
-                return false;
-            }
-
-            return true;
-        }
-    }
-}

src/Runner.Common/CommandLineParser.cs

@@ -1,4 +1,5 @@
-using System;
+using GitHub.Runner.Common.Util;
+using System;
 using System.Collections.Generic;
 using GitHub.DistributedTask.Logging;
 using GitHub.Runner.Sdk;

src/Runner.Common/ConfigurationStore.cs

@@ -1,4 +1,5 @@
-using GitHub.Runner.Sdk;
+using GitHub.Runner.Common.Util;
+using GitHub.Runner.Sdk;
 using System;
 using System.IO;
 using System.Linq;
@@ -18,7 +19,7 @@ namespace GitHub.Runner.Common
         private bool? _isHostedServer;
 
         [DataMember(EmitDefaultValue = false)]
-        public ulong AgentId { get; set; }
+        public int AgentId { get; set; }
 
         [DataMember(EmitDefaultValue = false)]
         public string AgentName { get; set; }
@@ -50,15 +51,6 @@ namespace GitHub.Runner.Common
         [DataMember(EmitDefaultValue = false)]
         public string MonitorSocketAddress { get; set; }
 
-        [DataMember(EmitDefaultValue = false)]
-        public bool UseV2Flow { get; set; }
-
-        [DataMember(EmitDefaultValue = false)]
-        public bool UseRunnerAdminFlow { get; set; }
-
-        [DataMember(EmitDefaultValue = false)]
-        public string ServerUrlV2 { get; set; }
-
         [IgnoreDataMember]
         public bool IsHostedServer
         {
@@ -83,18 +75,17 @@ namespace GitHub.Runner.Common
         {
             get
             {
-                Uri accountUri = new(this.ServerUrl);
+                Uri accountUri = new Uri(this.ServerUrl);
                 string repoOrOrgName = string.Empty;
 
-                if (accountUri.Host.EndsWith(".githubusercontent.com", StringComparison.OrdinalIgnoreCase) && !string.IsNullOrEmpty(this.GitHubUrl))
+                if (accountUri.Host.EndsWith(".githubusercontent.com", StringComparison.OrdinalIgnoreCase))
                 {
-                    Uri gitHubUrl = new(this.GitHubUrl);
+                    Uri gitHubUrl = new Uri(this.GitHubUrl);
 
                     // Use the "NWO part" from the GitHub URL path
                     repoOrOrgName = gitHubUrl.AbsolutePath.Trim('/');
                 }
-
-                if (string.IsNullOrEmpty(repoOrOrgName))
+                else
                 {
                     repoOrOrgName = accountUri.AbsolutePath.Split('/', StringSplitOptions.RemoveEmptyEntries).FirstOrDefault();
                 }
@@ -119,15 +110,11 @@ namespace GitHub.Runner.Common
         bool IsConfigured();
         bool IsServiceConfigured();
         bool HasCredentials();
-        bool IsMigratedConfigured();
         CredentialData GetCredentials();
         CredentialData GetMigratedCredentials();
         RunnerSettings GetSettings();
-        RunnerSettings GetMigratedSettings();
         void SaveCredential(CredentialData credential);
-        void SaveMigratedCredential(CredentialData credential);
         void SaveSettings(RunnerSettings settings);
-        void SaveMigratedSettings(RunnerSettings settings);
         void DeleteCredential();
         void DeleteMigratedCredential();
         void DeleteSettings();
@@ -137,7 +124,6 @@ namespace GitHub.Runner.Common
     {
         private string _binPath;
         private string _configFilePath;
-        private string _migratedConfigFilePath;
         private string _credFilePath;
         private string _migratedCredFilePath;
         private string _serviceConfigFilePath;
@@ -145,7 +131,6 @@ namespace GitHub.Runner.Common
         private CredentialData _creds;
         private CredentialData _migratedCreds;
         private RunnerSettings _settings;
-        private RunnerSettings _migratedSettings;
 
         public override void Initialize(IHostContext hostContext)
         {
@@ -163,9 +148,6 @@ namespace GitHub.Runner.Common
             _configFilePath = hostContext.GetConfigFile(WellKnownConfigFile.Runner);
             Trace.Info("ConfigFilePath: {0}", _configFilePath);
 
-            _migratedConfigFilePath = hostContext.GetConfigFile(WellKnownConfigFile.MigratedRunner);
-            Trace.Info("MigratedConfigFilePath: {0}", _migratedConfigFilePath);
-
             _credFilePath = hostContext.GetConfigFile(WellKnownConfigFile.Credentials);
             Trace.Info("CredFilePath: {0}", _credFilePath);
 
@@ -181,7 +163,7 @@ namespace GitHub.Runner.Common
         public bool HasCredentials()
         {
             Trace.Info("HasCredentials()");
-            bool credsStored = new FileInfo(_credFilePath).Exists || new FileInfo(_migratedCredFilePath).Exists;
+            bool credsStored = (new FileInfo(_credFilePath)).Exists || (new FileInfo(_migratedCredFilePath)).Exists;
             Trace.Info("stored {0}", credsStored);
             return credsStored;
         }
@@ -189,7 +171,7 @@ namespace GitHub.Runner.Common
         public bool IsConfigured()
         {
             Trace.Info("IsConfigured()");
-            bool configured = new FileInfo(_configFilePath).Exists || new FileInfo(_migratedConfigFilePath).Exists;
+            bool configured = new FileInfo(_configFilePath).Exists;
             Trace.Info("IsConfigured: {0}", configured);
             return configured;
         }
@@ -197,19 +179,11 @@ namespace GitHub.Runner.Common
         public bool IsServiceConfigured()
         {
             Trace.Info("IsServiceConfigured()");
-            bool serviceConfigured = new FileInfo(_serviceConfigFilePath).Exists;
+            bool serviceConfigured = (new FileInfo(_serviceConfigFilePath)).Exists;
             Trace.Info($"IsServiceConfigured: {serviceConfigured}");
             return serviceConfigured;
         }
 
-        public bool IsMigratedConfigured()
-        {
-            Trace.Info("IsMigratedConfigured()");
-            bool configured = new FileInfo(_migratedConfigFilePath).Exists;
-            Trace.Info("IsMigratedConfigured: {0}", configured);
-            return configured;
-        }
-
         public CredentialData GetCredentials()
         {
             if (_creds == null)
@@ -249,25 +223,6 @@ namespace GitHub.Runner.Common
             return _settings;
         }
 
-        public RunnerSettings GetMigratedSettings()
-        {
-            if (_migratedSettings == null)
-            {
-                RunnerSettings configuredSettings = null;
-                if (File.Exists(_migratedConfigFilePath))
-                {
-                    string json = File.ReadAllText(_migratedConfigFilePath, Encoding.UTF8);
-                    Trace.Info($"Read migrated setting file: {json.Length} chars");
-                    configuredSettings = StringUtil.ConvertFromJson<RunnerSettings>(json);
-                }
-
-                ArgUtil.NotNull(configuredSettings, nameof(configuredSettings));
-                _migratedSettings = configuredSettings;
-            }
-
-            return _migratedSettings;
-        }
-
         public void SaveCredential(CredentialData credential)
         {
             Trace.Info("Saving {0} credential @ {1}", credential.Scheme, _credFilePath);
@@ -283,21 +238,6 @@ namespace GitHub.Runner.Common
             File.SetAttributes(_credFilePath, File.GetAttributes(_credFilePath) | FileAttributes.Hidden);
         }
 
-        public void SaveMigratedCredential(CredentialData credential)
-        {
-            Trace.Info("Saving {0} migrated credential @ {1}", credential.Scheme, _migratedCredFilePath);
-            if (File.Exists(_migratedCredFilePath))
-            {
-                // Delete existing credential file first, since the file is hidden and not able to overwrite.
-                Trace.Info("Delete exist runner migrated credential file.");
-                IOUtil.DeleteFile(_migratedCredFilePath);
-            }
-
-            IOUtil.SaveObject(credential, _migratedCredFilePath);
-            Trace.Info("Migrated Credentials Saved.");
-            File.SetAttributes(_migratedCredFilePath, File.GetAttributes(_migratedCredFilePath) | FileAttributes.Hidden);
-        }
-
         public void SaveSettings(RunnerSettings settings)
         {
             Trace.Info("Saving runner settings.");
@@ -313,21 +253,6 @@ namespace GitHub.Runner.Common
             File.SetAttributes(_configFilePath, File.GetAttributes(_configFilePath) | FileAttributes.Hidden);
         }
 
-        public void SaveMigratedSettings(RunnerSettings settings)
-        {
-            Trace.Info("Saving runner migrated settings");
-            if (File.Exists(_migratedConfigFilePath))
-            {
-                // Delete existing settings file first, since the file is hidden and not able to overwrite.
-                Trace.Info("Delete exist runner migrated settings file.");
-                IOUtil.DeleteFile(_migratedConfigFilePath);
-            }
-
-            IOUtil.SaveObject(settings, _migratedConfigFilePath);
-            Trace.Info("Migrated Settings Saved.");
-            File.SetAttributes(_migratedConfigFilePath, File.GetAttributes(_migratedConfigFilePath) | FileAttributes.Hidden);
-        }
-
         public void DeleteCredential()
         {
             IOUtil.Delete(_credFilePath, default(CancellationToken));
@@ -342,12 +267,6 @@ namespace GitHub.Runner.Common
         public void DeleteSettings()
         {
             IOUtil.Delete(_configFilePath, default(CancellationToken));
-            IOUtil.Delete(_migratedConfigFilePath, default(CancellationToken));
-        }
-
-        public void DeleteMigratedSettings()
-        {
-            IOUtil.Delete(_migratedConfigFilePath, default(CancellationToken));
         }
     }
 }

src/Runner.Common/Constants.cs

@@ -18,7 +18,6 @@ namespace GitHub.Runner.Common
     public enum WellKnownConfigFile
     {
         Runner,
-        MigratedRunner,
         Credentials,
         MigratedCredentials,
         RSACredentials,
@@ -70,8 +69,6 @@ namespace GitHub.Runner.Common
             public static readonly OSPlatform Platform = OSPlatform.OSX;
 #elif OS_WINDOWS
             public static readonly OSPlatform Platform = OSPlatform.Windows;
-#else
-            public static readonly OSPlatform Platform = OSPlatform.Linux;
 #endif
 
 #if X86
@@ -80,10 +77,8 @@ namespace GitHub.Runner.Common
             public static readonly Architecture PlatformArchitecture = Architecture.X64;
 #elif ARM
             public static readonly Architecture PlatformArchitecture = Architecture.Arm;
-#elif ARM64
+#elif ARM64            
             public static readonly Architecture PlatformArchitecture = Architecture.Arm64;
-#else
-            public static readonly Architecture PlatformArchitecture = Architecture.X64;
 #endif
 
             public static readonly TimeSpan ExitOnUnloadTimeout = TimeSpan.FromSeconds(30);
@@ -109,13 +104,11 @@ namespace GitHub.Runner.Common
                     public static readonly string Token = "token";
                     public static readonly string PAT = "pat";
                     public static readonly string WindowsLogonPassword = "windowslogonpassword";
-                    public static readonly string JitConfig = "jitconfig";
                     public static string[] Secrets => new[]
                     {
                         PAT,
                         Token,
                         WindowsLogonPassword,
-                        JitConfig,
                     };
                 }
 
@@ -134,10 +127,7 @@ namespace GitHub.Runner.Common
                     public static readonly string Check = "check";
                     public static readonly string Commit = "commit";
                     public static readonly string Ephemeral = "ephemeral";
-                    public static readonly string GenerateServiceConfig = "generateServiceConfig";
                     public static readonly string Help = "help";
-                    public static readonly string Local = "local";
-                    public static readonly string NoDefaultLabels = "no-default-labels";
                     public static readonly string Replace = "replace";
                     public static readonly string DisableUpdate = "disableupdate";
                     public static readonly string Once = "once"; // Keep this around since customers still relies on it
@@ -154,51 +144,23 @@ namespace GitHub.Runner.Common
                 public const int RetryableError = 2;
                 public const int RunnerUpdating = 3;
                 public const int RunOnceRunnerUpdating = 4;
-                public const int SessionConflict = 5;
-                // Temporary error code to indicate that the runner configuration has been refreshed
-                // and the runner should be restarted. This is a temporary code and will be removed in the future after
-                // the runner is migrated to runner admin.
-                public const int RunnerConfigurationRefreshed = 6;
             }
 
             public static class Features
             {
                 public static readonly string DiskSpaceWarning = "runner.diskspace.warning";
-                public static readonly string LogTemplateErrorsAsDebugMessages = "DistributedTask.LogTemplateErrorsAsDebugMessages";
+                public static readonly string Node12Warning = "DistributedTask.AddWarningToNode12Action";
                 public static readonly string UseContainerPathForTemplate = "DistributedTask.UseContainerPathForTemplate";
-                public static readonly string AllowRunnerContainerHooks = "DistributedTask.AllowRunnerContainerHooks";
-                public static readonly string AddCheckRunIdToJobContext = "actions_add_check_run_id_to_job_context";
-                public static readonly string DisplayHelpfulActionsDownloadErrors = "actions_display_helpful_actions_download_errors";
-                public static readonly string ContainerActionRunnerTemp = "actions_container_action_runner_temp";
-            }
-            
-            // Node version migration related constants
-            public static class NodeMigration
-            {
-                // Node versions
-                public static readonly string Node20 = "node20";
-                public static readonly string Node24 = "node24";
-                
-                // Environment variables for controlling node version selection
-                public static readonly string ForceNode24Variable = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24";
-                public static readonly string AllowUnsecureNodeVersionVariable = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
-                
-                // Feature flags for controlling the migration phases
-                public static readonly string UseNode24ByDefaultFlag = "actions.runner.usenode24bydefault";
-                public static readonly string RequireNode24Flag = "actions.runner.requirenode24";
             }
 
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";
-            public static readonly Guid TelemetryRecordId = new Guid("11111111-1111-1111-1111-111111111111");
             public static readonly string WorkerCrash = "WORKER_CRASH";
             public static readonly string LowDiskSpace = "LOW_DISK_SPACE";
             public static readonly string UnsupportedCommand = "UNSUPPORTED_COMMAND";
-            public static readonly string ResultsUploadFailure = "RESULTS_UPLOAD_FAILURE";
-            public static readonly string UnsupportedCommandMessage = "The `{0}` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/";
             public static readonly string UnsupportedCommandMessageDisabled = "The `{0}` command is disabled. Please upgrade to using Environment Files or opt into unsecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/";
             public static readonly string UnsupportedStopCommandTokenDisabled = "You cannot use a endToken that is an empty string, the string 'pause-logging', or another workflow command. For more information see: https://docs.github.com/actions/learn-github-actions/workflow-commands-for-github-actions#example-stopping-and-starting-workflow-commands or opt into insecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_STOPCOMMAND_TOKENS` environment variable to `true`.";
             public static readonly string UnsupportedSummarySize = "$GITHUB_STEP_SUMMARY upload aborted, supports content up to a size of {0}k, got {1}k. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
-            public static readonly string SummaryUploadError = "$GITHUB_STEP_SUMMARY upload aborted, an error occurred when uploading the summary. For more information see: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#adding-a-markdown-summary";
+            public static readonly string Node12DetectedAfterEndOfLife = "Node.js 12 actions are deprecated. Please update the following actions to use Node.js 16: {0}";
         }
 
         public static class RunnerEvent
@@ -234,7 +196,6 @@ namespace GitHub.Runner.Common
         {
             public static readonly string JobStartedStepName = "Set up runner";
             public static readonly string JobCompletedStepName = "Complete runner";
-            public static readonly string ContainerHooksPath = "ACTIONS_RUNNER_CONTAINER_HOOKS";
         }
 
         public static class Path
@@ -266,20 +227,17 @@ namespace GitHub.Runner.Common
                 //
                 public static readonly string AllowUnsupportedCommands = "ACTIONS_ALLOW_UNSECURE_COMMANDS";
                 public static readonly string AllowUnsupportedStopCommandTokens = "ACTIONS_ALLOW_UNSECURE_STOPCOMMAND_TOKENS";
-                public static readonly string RequireJobContainer = "ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER";
                 public static readonly string RunnerDebug = "ACTIONS_RUNNER_DEBUG";
                 public static readonly string StepDebug = "ACTIONS_STEP_DEBUG";
+                public static readonly string AllowActionsUseUnsecureNodeVersion = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
             }
 
             public static class Agent
             {
                 public static readonly string ToolsDirectory = "agent.ToolsDirectory";
 
-                // Set this env var to "nodeXY" to downgrade the node version for internal functions (e.g hashfiles). This does NOT affect the version of node actions.
-                public static readonly string ForcedInternalNodeVersion = "ACTIONS_RUNNER_FORCED_INTERNAL_NODE_VERSION";
-                public static readonly string ForcedActionsNodeVersion = "ACTIONS_RUNNER_FORCE_ACTIONS_NODE_VERSION";
-                public static readonly string PrintLogToStdout = "ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT";
-                public static readonly string ActionArchiveCacheDirectory = "ACTIONS_RUNNER_ACTION_ARCHIVE_CACHE";
+                // Set this env var to "node12" to downgrade the node version for internal functions (e.g hashfiles). This does NOT affect the version of node actions.
+                public static readonly string ForcedInternalNodeVersion = "ACTIONS_RUNNER_FORCED_INTERNAL_NODE_VERSION"; 
             }
 
             public static class System
@@ -290,16 +248,7 @@ namespace GitHub.Runner.Common
                 public static readonly string AccessToken = "system.accessToken";
                 public static readonly string Culture = "system.culture";
                 public static readonly string PhaseDisplayName = "system.phaseDisplayName";
-                public static readonly string JobRequestType = "system.jobRequestType";
-                public static readonly string OrchestrationId = "system.orchestrationId";
             }
         }
-
-        public static class OperatingSystem
-        {
-            public static readonly int Windows11BuildVersion = 22000;
-            // Both windows 10 and windows 11 share the same Major Version 10, need to use the build version to differentiate
-            public static readonly int Windows11MajorVersion = 10;
-        }
     }
 }