Release 2.273.5

* notify on unsecure commands

releaseNote.md

@@ -1,13 +1,12 @@
 ## Features
-  - Continued improvements to Composite Actions code and documentation (#616, #625, #626, #641, #645, #657, #658)
+  - Expose retention days in env for toolkit/artifacts package (#714)
+  - Notify on unsecure commands (#731)
 
 ## Bugs
-  - Fix feature flag check; omit context for generated context names (#638)
-  - Fix endgroup maker (#640)
+  - N/A
 
 ## Misc
-  - Adding help text for the new runnergroup feature (#626)
-  - Updating virtual environment terminology in readme.md (#651)
+  - N/A
 
 ## Windows x64
 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.

releaseVersion

@@ -1 +1 @@
-2.273.0
+2.273.5

src/Runner.Common/Constants.cs

@@ -140,6 +140,9 @@ namespace GitHub.Runner.Common
 
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";
             public static readonly string WorkerCrash = "WORKER_CRASH";
+            public static readonly string UnsupportedCommand = "UNSUPPORTED_COMMAND";
+            public static readonly string UnsupportedCommandMessage = "The `{0}` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/";
+            public static readonly string UnsupportedCommandMessageDisabled = "The `{0}` command is disabled. Please upgrade to using Environment Files or opt into unsecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/";
         }
 
         public static class RunnerEvent
@@ -198,6 +201,7 @@ namespace GitHub.Runner.Common
                 //
                 // Keep alphabetical
                 //
+                public static readonly string AllowUnsupportedCommands = "ACTIONS_ALLOW_UNSECURE_COMMANDS";
                 public static readonly string RunnerDebug = "ACTIONS_RUNNER_DEBUG";
                 public static readonly string StepDebug = "ACTIONS_STEP_DEBUG";
             }

src/Runner.Common/ExtensionManager.cs

@@ -56,6 +56,10 @@ namespace GitHub.Runner.Common
                     Add<T>(extensions, "GitHub.Runner.Worker.EndGroupCommandExtension, Runner.Worker");
                     Add<T>(extensions, "GitHub.Runner.Worker.EchoCommandExtension, Runner.Worker");
                     break;
+                case "GitHub.Runner.Worker.IFileCommandExtension":
+                    Add<T>(extensions, "GitHub.Runner.Worker.AddPathFileCommand, Runner.Worker");
+                    Add<T>(extensions, "GitHub.Runner.Worker.SetEnvFileCommand, Runner.Worker");
+                    break;
                 default:
                     // This should never happen.
                     throw new NotSupportedException($"Unexpected extension type: '{typeof(T).FullName}'");

src/Runner.Common/JobServer.cs

@@ -16,6 +16,7 @@ namespace GitHub.Runner.Common
         // logging and console
         Task<TaskLog> AppendLogContentAsync(Guid scopeIdentifier, string hubName, Guid planId, int logId, Stream uploadStream, CancellationToken cancellationToken);
         Task AppendTimelineRecordFeedAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, Guid stepId, IList<string> lines, CancellationToken cancellationToken);
+        Task AppendTimelineRecordFeedAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, Guid stepId, IList<string> lines, long startLine, CancellationToken cancellationToken);
         Task<TaskAttachment> CreateAttachmentAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, String type, String name, Stream uploadStream, CancellationToken cancellationToken);
         Task<TaskLog> CreateLogAsync(Guid scopeIdentifier, string hubName, Guid planId, TaskLog log, CancellationToken cancellationToken);
         Task<Timeline> CreateTimelineAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, CancellationToken cancellationToken);
@@ -79,6 +80,12 @@ namespace GitHub.Runner.Common
             return _taskClient.AppendTimelineRecordFeedAsync(scopeIdentifier, hubName, planId, timelineId, timelineRecordId, stepId, lines, cancellationToken: cancellationToken);
         }
 
+        public Task AppendTimelineRecordFeedAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, Guid stepId, IList<string> lines, long startLine, CancellationToken cancellationToken)
+        {
+            CheckConnection();
+            return _taskClient.AppendTimelineRecordFeedAsync(scopeIdentifier, hubName, planId, timelineId, timelineRecordId, stepId, lines, startLine, cancellationToken: cancellationToken);
+        }
+
         public Task<TaskAttachment> CreateAttachmentAsync(Guid scopeIdentifier, string hubName, Guid planId, Guid timelineId, Guid timelineRecordId, string type, string name, Stream uploadStream, CancellationToken cancellationToken)
         {
             CheckConnection();

src/Runner.Common/JobServerQueue.cs

@@ -18,7 +18,7 @@ namespace GitHub.Runner.Common
         event EventHandler<ThrottlingEventArgs> JobServerQueueThrottling;
         Task ShutdownAsync();
         void Start(Pipelines.AgentJobRequestMessage jobRequest);
-        void QueueWebConsoleLine(Guid stepRecordId, string line);
+        void QueueWebConsoleLine(Guid stepRecordId, string line, long? lineNumber = null);
         void QueueFileUpload(Guid timelineId, Guid timelineRecordId, string type, string name, string path, bool deleteSource);
         void QueueTimelineRecordUpdate(Guid timelineId, TimelineRecord timelineRecord);
     }
@@ -155,10 +155,10 @@ namespace GitHub.Runner.Common
             Trace.Info("All queue process tasks have been stopped, and all queues are drained.");
         }
 
-        public void QueueWebConsoleLine(Guid stepRecordId, string line)
+        public void QueueWebConsoleLine(Guid stepRecordId, string line, long? lineNumber)
         {
             Trace.Verbose("Enqueue web console line queue: {0}", line);
-            _webConsoleLineQueue.Enqueue(new ConsoleLineInfo(stepRecordId, line));
+            _webConsoleLineQueue.Enqueue(new ConsoleLineInfo(stepRecordId, line, lineNumber));
         }
 
         public void QueueFileUpload(Guid timelineId, Guid timelineRecordId, string type, string name, string path, bool deleteSource)
@@ -214,7 +214,7 @@ namespace GitHub.Runner.Common
                 }
 
                 // Group consolelines by timeline record of each step
-                Dictionary<Guid, List<string>> stepsConsoleLines = new Dictionary<Guid, List<string>>();
+                Dictionary<Guid, List<TimelineRecordLogLine>> stepsConsoleLines = new Dictionary<Guid, List<TimelineRecordLogLine>>();
                 List<Guid> stepRecordIds = new List<Guid>(); // We need to keep lines in order
                 int linesCounter = 0;
                 ConsoleLineInfo lineInfo;
@@ -222,7 +222,7 @@ namespace GitHub.Runner.Common
                 {
                     if (!stepsConsoleLines.ContainsKey(lineInfo.StepRecordId))
                     {
-                        stepsConsoleLines[lineInfo.StepRecordId] = new List<string>();
+                        stepsConsoleLines[lineInfo.StepRecordId] = new List<TimelineRecordLogLine>();
                         stepRecordIds.Add(lineInfo.StepRecordId);
                     }
 
@@ -232,7 +232,7 @@ namespace GitHub.Runner.Common
                         lineInfo.Line = $"{lineInfo.Line.Substring(0, 1024)}...";
                     }
 
-                    stepsConsoleLines[lineInfo.StepRecordId].Add(lineInfo.Line);
+                    stepsConsoleLines[lineInfo.StepRecordId].Add(new TimelineRecordLogLine(lineInfo.Line, lineInfo.LineNumber));
                     linesCounter++;
 
                     // process at most about 500 lines of web console line during regular timer dequeue task.
@@ -247,13 +247,13 @@ namespace GitHub.Runner.Common
                 {
                     // Split consolelines into batch, each batch will container at most 100 lines.
                     int batchCounter = 0;
-                    List<List<string>> batchedLines = new List<List<string>>();
+                    List<List<TimelineRecordLogLine>> batchedLines = new List<List<TimelineRecordLogLine>>();
                     foreach (var line in stepsConsoleLines[stepRecordId])
                     {
                         var currentBatch = batchedLines.ElementAtOrDefault(batchCounter);
                         if (currentBatch == null)
                         {
-                            batchedLines.Add(new List<string>());
+                            batchedLines.Add(new List<TimelineRecordLogLine>());
                             currentBatch = batchedLines.ElementAt(batchCounter);
                         }
 
@@ -275,7 +275,6 @@ namespace GitHub.Runner.Common
                         {
                             Trace.Info($"Skip {batchedLines.Count - 2} batches web console lines for last run");
                             batchedLines = batchedLines.TakeLast(2).ToList();
-                            batchedLines[0].Insert(0, "...");
                         }
 
                         int errorCount = 0;
@@ -284,7 +283,15 @@ namespace GitHub.Runner.Common
                             try
                             {
                                 // we will not requeue failed batch, since the web console lines are time sensitive.
-                                await _jobServer.AppendTimelineRecordFeedAsync(_scopeIdentifier, _hubName, _planId, _jobTimelineId, _jobTimelineRecordId, stepRecordId, batch, default(CancellationToken));
+                                if (batch[0].LineNumber.HasValue)
+                                {
+                                    await _jobServer.AppendTimelineRecordFeedAsync(_scopeIdentifier, _hubName, _planId, _jobTimelineId, _jobTimelineRecordId, stepRecordId, batch.Select(logLine => logLine.Line).ToList(), batch[0].LineNumber.Value, default(CancellationToken));
+                                }
+                                else 
+                                {
+                                    await _jobServer.AppendTimelineRecordFeedAsync(_scopeIdentifier, _hubName, _planId, _jobTimelineId, _jobTimelineRecordId, stepRecordId, batch.Select(logLine => logLine.Line).ToList(), default(CancellationToken));
+                                }
+                                
                                 if (_firstConsoleOutputs)
                                 {
                                     HostContext.WritePerfCounter($"WorkerJobServerQueueAppendFirstConsoleOutput_{_planId.ToString()}");
@@ -653,13 +660,15 @@ namespace GitHub.Runner.Common
 
     internal class ConsoleLineInfo
     {
-        public ConsoleLineInfo(Guid recordId, string line)
+        public ConsoleLineInfo(Guid recordId, string line, long? lineNumber)
         {
             this.StepRecordId = recordId;
             this.Line = line;
+            this.LineNumber = lineNumber;
         }
 
         public Guid StepRecordId { get; set; }
         public string Line { get; set; }
+        public long? LineNumber { get; set; }
     }
 }

src/Runner.Worker/ActionCommandManager.cs

@@ -1,4 +1,5 @@
 using GitHub.DistributedTask.Pipelines;
+using GitHub.DistributedTask.Pipelines.ContextData;
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Worker.Container;
@@ -183,6 +184,40 @@ namespace GitHub.Runner.Worker
 
         public void ProcessCommand(IExecutionContext context, string line, ActionCommand command, ContainerInfo container)
         {
+            var configurationStore = HostContext.GetService<IConfigurationStore>();
+            var isHostedServer = configurationStore.GetSettings().IsHostedServer;
+            
+            var allowUnsecureCommands = false;
+            bool.TryParse(Environment.GetEnvironmentVariable(Constants.Variables.Actions.AllowUnsupportedCommands), out allowUnsecureCommands);
+
+            // Apply environment from env context, env context contains job level env and action's env block
+#if OS_WINDOWS
+            var envContext = context.ExpressionValues["env"] as DictionaryContextData;
+#else
+            var envContext = context.ExpressionValues["env"] as CaseSensitiveDictionaryContextData;
+#endif
+            if (!allowUnsecureCommands && envContext.ContainsKey(Constants.Variables.Actions.AllowUnsupportedCommands))
+            {
+                bool.TryParse(envContext[Constants.Variables.Actions.AllowUnsupportedCommands].ToString(), out allowUnsecureCommands);
+            }
+
+            // TODO: Eventually remove isHostedServer and apply this to dotcom customers as well
+            if (!isHostedServer && !allowUnsecureCommands)
+            {
+                throw new Exception(String.Format(Constants.Runner.UnsupportedCommandMessageDisabled, this.Command));
+            }
+            else if (!allowUnsecureCommands)
+            {
+                // Log Telemetry and let user know they shouldn't do this
+                var issue = new Issue() 
+                { 
+                    Type = IssueType.Warning, 
+                    Message = String.Format(Constants.Runner.UnsupportedCommandMessage, this.Command)
+                };
+                issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.UnsupportedCommand;
+                context.AddIssue(issue);
+            }
+
             if (!command.Properties.TryGetValue(SetEnvCommandProperties.Name, out string envName) || string.IsNullOrEmpty(envName))
             {
                 throw new Exception("Required field 'name' is missing in ##[set-env] command.");
@@ -282,6 +317,40 @@ namespace GitHub.Runner.Worker
 
         public void ProcessCommand(IExecutionContext context, string line, ActionCommand command, ContainerInfo container)
         {
+            var configurationStore = HostContext.GetService<IConfigurationStore>();
+            var isHostedServer = configurationStore.GetSettings().IsHostedServer;
+            
+            var allowUnsecureCommands = false;
+            bool.TryParse(Environment.GetEnvironmentVariable(Constants.Variables.Actions.AllowUnsupportedCommands), out allowUnsecureCommands);
+
+            // Apply environment from env context, env context contains job level env and action's env block
+#if OS_WINDOWS
+            var envContext = context.ExpressionValues["env"] as DictionaryContextData;
+#else
+            var envContext = context.ExpressionValues["env"] as CaseSensitiveDictionaryContextData;
+#endif
+            if (!allowUnsecureCommands && envContext.ContainsKey(Constants.Variables.Actions.AllowUnsupportedCommands))
+            {
+                bool.TryParse(envContext[Constants.Variables.Actions.AllowUnsupportedCommands].ToString(), out allowUnsecureCommands);
+            }
+
+            // TODO: Eventually remove isHostedServer and apply this to dotcom customers as well
+            if (!isHostedServer && !allowUnsecureCommands)
+            {
+                throw new Exception(String.Format(Constants.Runner.UnsupportedCommandMessageDisabled, this.Command));
+            }
+            else if (!allowUnsecureCommands)
+            {
+                // Log Telemetry and let user know they shouldn't do this
+                var issue = new Issue() 
+                { 
+                    Type = IssueType.Warning, 
+                    Message = String.Format(Constants.Runner.UnsupportedCommandMessage, this.Command)
+                };
+                issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.UnsupportedCommand;
+                context.AddIssue(issue);
+            }
+
             ArgUtil.NotNullOrEmpty(command.Data, "path");
             context.Global.PrependPath.RemoveAll(x => string.Equals(x, command.Data, StringComparison.CurrentCulture));
             context.Global.PrependPath.Add(command.Data);

src/Runner.Worker/ActionRunner.cs

@@ -145,6 +145,10 @@ namespace GitHub.Runner.Worker
                 stepHost = containerStepHost;
             }
 
+            // Setup File Command Manager
+            var fileCommandManager = HostContext.CreateService<IFileCommandManager>();
+            fileCommandManager.InitializeFiles(ExecutionContext, null);
+
             // Load the inputs.
             ExecutionContext.Debug("Loading inputs");
             var templateEvaluator = ExecutionContext.ToPipelineTemplateEvaluator();
@@ -238,7 +242,15 @@ namespace GitHub.Runner.Worker
             handler.PrintActionDetails(Stage);
 
             // Run the task.
-            await handler.RunAsync(Stage);
+            try 
+            {
+                await handler.RunAsync(Stage);
+            }
+            finally 
+            {
+                fileCommandManager.ProcessFiles(ExecutionContext, ExecutionContext.Global.Container);
+            }
+
         }
 
         public bool TryEvaluateDisplayName(DictionaryContextData contextData, IExecutionContext context)

src/Runner.Worker/Container/ContainerInfo.cs

@@ -34,6 +34,9 @@ namespace GitHub.Runner.Worker.Container
             _environmentVariables = container.Environment;
             this.IsJobContainer = isJobContainer;
             this.ContainerNetworkAlias = networkAlias;
+            this.RegistryAuthUsername = container.Credentials?.Username;
+            this.RegistryAuthPassword = container.Credentials?.Password;
+            this.RegistryServer = DockerUtil.ParseRegistryHostnameFromImageName(this.ContainerImage);
 
 #if OS_WINDOWS
             _pathMappings.Add(new PathMapping(hostContext.GetDirectory(WellKnownDirectory.Work), "C:\\__w"));
@@ -79,6 +82,9 @@ namespace GitHub.Runner.Worker.Container
         public string ContainerWorkDirectory { get; set; }
         public string ContainerCreateOptions { get; private set; }
         public string ContainerRuntimePath { get; set; }
+        public string RegistryServer { get; set; }
+        public string RegistryAuthUsername { get; set; }
+        public string RegistryAuthPassword { get; set; }
         public bool IsJobContainer { get; set; }
 
         public IDictionary<string, string> ContainerEnvironmentVariables

src/Runner.Worker/Container/DockerCommandManager.cs

@@ -4,6 +4,7 @@ using System.IO;
 using System.Linq;
 using System.Text.RegularExpressions;
 using System.Threading;
+using System.Threading.Channels;
 using System.Threading.Tasks;
 using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;
@@ -17,6 +18,7 @@ namespace GitHub.Runner.Worker.Container
         string DockerInstanceLabel { get; }
         Task<DockerVersion> DockerVersion(IExecutionContext context);
         Task<int> DockerPull(IExecutionContext context, string image);
+        Task<int> DockerPull(IExecutionContext context, string image, string configFileDirectory);
         Task<int> DockerBuild(IExecutionContext context, string workingDirectory, string dockerFile, string dockerContext, string tag);
         Task<string> DockerCreate(IExecutionContext context, ContainerInfo container);
         Task<int> DockerRun(IExecutionContext context, ContainerInfo container, EventHandler<ProcessDataReceivedEventArgs> stdoutDataReceived, EventHandler<ProcessDataReceivedEventArgs> stderrDataReceived);
@@ -31,6 +33,7 @@ namespace GitHub.Runner.Worker.Container
         Task<int> DockerExec(IExecutionContext context, string containerId, string options, string command, List<string> outputs);
         Task<List<string>> DockerInspect(IExecutionContext context, string dockerObject, string options);
         Task<List<PortMapping>> DockerPort(IExecutionContext context, string containerId);
+        Task<int> DockerLogin(IExecutionContext context, string configFileDirectory, string registry, string username, string password);
     }
 
     public class DockerCommandManager : RunnerService, IDockerCommandManager
@@ -82,9 +85,18 @@ namespace GitHub.Runner.Worker.Container
             return new DockerVersion(serverVersion, clientVersion);
         }
 
-        public async Task<int> DockerPull(IExecutionContext context, string image)
+        public Task<int> DockerPull(IExecutionContext context, string image)
         {
-            return await ExecuteDockerCommandAsync(context, "pull", image, context.CancellationToken);
+            return DockerPull(context, image, null);
+        }
+
+        public async Task<int> DockerPull(IExecutionContext context, string image, string configFileDirectory)
+        {
+            if (string.IsNullOrEmpty(configFileDirectory))
+            {
+                return await ExecuteDockerCommandAsync(context, $"pull", image, context.CancellationToken);
+            }
+            return await ExecuteDockerCommandAsync(context, $"--config {configFileDirectory} pull", image, context.CancellationToken);
         }
 
         public async Task<int> DockerBuild(IExecutionContext context, string workingDirectory, string dockerFile, string dockerContext, string tag)
@@ -346,6 +358,28 @@ namespace GitHub.Runner.Worker.Container
             return DockerUtil.ParseDockerPort(portMappingLines);
         }
 
+        public Task<int> DockerLogin(IExecutionContext context, string configFileDirectory, string registry, string username, string password)
+        {
+            string args = $"--config {configFileDirectory} login {registry} -u {username} --password-stdin";
+            context.Command($"{DockerPath} {args}");
+
+            var input = Channel.CreateBounded<string>(new BoundedChannelOptions(1) { SingleReader = true, SingleWriter = true });
+            input.Writer.TryWrite(password);
+
+            var processInvoker = HostContext.CreateService<IProcessInvoker>();
+
+            return processInvoker.ExecuteAsync(
+                workingDirectory: context.GetGitHubContext("workspace"),
+                fileName: DockerPath,
+                arguments: args,
+                environment: null,
+                requireExitCodeZero: false,
+                outputEncoding: null,
+                killProcessOnCancel: false,
+                redirectStandardIn: input,
+                cancellationToken: context.CancellationToken);
+        }
+
         private Task<int> ExecuteDockerCommandAsync(IExecutionContext context, string command, string options, CancellationToken cancellationToken = default(CancellationToken))
         {
             return ExecuteDockerCommandAsync(context, command, options, null, cancellationToken);

src/Runner.Worker/Container/DockerUtil.cs

@@ -45,5 +45,21 @@ namespace GitHub.Runner.Worker.Container
             }
             return "";
         }
+
+        public static string ParseRegistryHostnameFromImageName(string name)
+        {
+            var nameSplit = name.Split('/');
+            // Single slash is implictly from Dockerhub, unless first part has .tld or :port
+            if (nameSplit.Length == 2 && (nameSplit[0].Contains(":") || nameSplit[0].Contains(".")))
+            {
+                return nameSplit[0];
+            }
+            // All other non Dockerhub registries
+            else if (nameSplit.Length > 2)
+            {
+                return nameSplit[0];
+            }
+            return "";
+        }
     }
 }

src/Runner.Worker/ContainerOperationProvider.cs

@@ -198,12 +198,18 @@ namespace GitHub.Runner.Worker
                 }
             }
 
+            // TODO: Add at a later date. This currently no local package registry to test with
+            // UpdateRegistryAuthForGitHubToken(executionContext, container);
+
+            // Before pulling, generate client authentication if required
+            var configLocation = await ContainerRegistryLogin(executionContext, container);
+
             // Pull down docker image with retry up to 3 times
             int retryCount = 0;
             int pullExitCode = 0;
             while (retryCount < 3)
             {
-                pullExitCode = await _dockerManger.DockerPull(executionContext, container.ContainerImage);
+                pullExitCode = await _dockerManger.DockerPull(executionContext, container.ContainerImage, configLocation);
                 if (pullExitCode == 0)
                 {
                     break;
@@ -220,6 +226,9 @@ namespace GitHub.Runner.Worker
                 }
             }
 
+            // Remove credentials after pulling
+            ContainerRegistryLogout(configLocation);
+
             if (retryCount == 3 && pullExitCode != 0)
             {
                 throw new InvalidOperationException($"Docker pull failed with exit code {pullExitCode}");
@@ -437,5 +446,83 @@ namespace GitHub.Runner.Worker
                 throw new InvalidOperationException($"Failed to initialize, {container.ContainerNetworkAlias} service is {serviceHealth}.");
             }
         }
+
+        private async Task<string> ContainerRegistryLogin(IExecutionContext executionContext, ContainerInfo container)
+        {
+            if (string.IsNullOrEmpty(container.RegistryAuthUsername) || string.IsNullOrEmpty(container.RegistryAuthPassword))
+            {
+                // No valid client config can be generated
+                return "";
+            }
+            var configLocation = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Temp), $".docker_{Guid.NewGuid()}");
+            try
+            {
+                var dirInfo = Directory.CreateDirectory(configLocation);
+            }
+            catch (Exception e)
+            {
+                throw new InvalidOperationException($"Failed to create directory to store registry client credentials: {e.Message}");
+            }
+            var loginExitCode = await _dockerManger.DockerLogin(
+                executionContext,
+                configLocation,
+                container.RegistryServer,
+                container.RegistryAuthUsername,
+                container.RegistryAuthPassword);
+
+            if (loginExitCode != 0)
+            {
+                throw new InvalidOperationException($"Docker login for '{container.RegistryServer}' failed with exit code {loginExitCode}");
+            }
+            return configLocation;
+        }
+
+        private void ContainerRegistryLogout(string configLocation)
+        {
+            try
+            {
+                if (!string.IsNullOrEmpty(configLocation) && Directory.Exists(configLocation))
+                {
+                    Directory.Delete(configLocation, recursive: true);
+                }
+            }
+            catch (Exception e)
+            {
+                throw new InvalidOperationException($"Failed to remove directory containing Docker client credentials: {e.Message}");
+            }
+        }
+
+        private void UpdateRegistryAuthForGitHubToken(IExecutionContext executionContext, ContainerInfo container)
+        {
+            var registryIsTokenCompatible = container.RegistryServer.Equals("docker.pkg.github.com", StringComparison.OrdinalIgnoreCase);
+            if (!registryIsTokenCompatible)
+            {
+                return;
+            }
+
+            var registryMatchesWorkflow = false;
+
+            // REGISTRY/OWNER/REPO/IMAGE[:TAG]
+            var imageParts = container.ContainerImage.Split('/');
+            if (imageParts.Length != 4)
+            {
+                executionContext.Warning($"Could not identify owner and repo for container image {container.ContainerImage}. Skipping automatic token auth");
+                return;
+            }
+            var owner = imageParts[1];
+            var repo = imageParts[2];
+            var nwo = $"{owner}/{repo}";
+            if (nwo.Equals(executionContext.GetGitHubContext("repository"), StringComparison.OrdinalIgnoreCase))
+            {
+                registryMatchesWorkflow = true;
+            }
+
+            var registryCredentialsNotSupplied = string.IsNullOrEmpty(container.RegistryAuthUsername) && string.IsNullOrEmpty(container.RegistryAuthPassword);
+            if (registryCredentialsNotSupplied && registryMatchesWorkflow)
+            {
+                container.RegistryAuthUsername = executionContext.GetGitHubContext("actor");
+                container.RegistryAuthPassword = executionContext.GetGitHubContext("token");
+            }
+        }
     }
 }

src/Runner.Worker/ExecutionContext.cs

@@ -717,7 +717,8 @@ namespace GitHub.Runner.Worker
                 }
             }
 
-            _jobServerQueue.QueueWebConsoleLine(_record.Id, msg);
+            _jobServerQueue.QueueWebConsoleLine(_record.Id, msg, totalLines);
+            
             return totalLines;
         }
 

src/Runner.Worker/FileCommandManager.cs

@@ -0,0 +1,262 @@
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Worker.Container;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using System.Text;
+
+namespace GitHub.Runner.Worker
+{
+    [ServiceLocator(Default = typeof(FileCommandManager))]
+    public interface IFileCommandManager : IRunnerService
+    {
+        void InitializeFiles(IExecutionContext context, ContainerInfo container);
+        void ProcessFiles(IExecutionContext context, ContainerInfo container);
+    
+    }
+
+    public sealed class FileCommandManager : RunnerService, IFileCommandManager
+    {
+        private const string _folderName = "_runner_file_commands";
+        private List<IFileCommandExtension> _commandExtensions;
+        private string _fileSuffix = String.Empty;
+        private string _fileCommandDirectory;
+        private Tracing _trace;
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _trace = HostContext.GetTrace(nameof(FileCommandManager));
+
+            _fileCommandDirectory = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Temp), _folderName);
+            if (!Directory.Exists(_fileCommandDirectory))
+            {
+                Directory.CreateDirectory(_fileCommandDirectory);
+            }
+
+            var extensionManager = hostContext.GetService<IExtensionManager>();
+            _commandExtensions = extensionManager.GetExtensions<IFileCommandExtension>() ?? new List<IFileCommandExtension>();
+        }
+
+        public void InitializeFiles(IExecutionContext context, ContainerInfo container)
+        {
+            var oldSuffix = _fileSuffix;
+            _fileSuffix = Guid.NewGuid().ToString();
+            foreach (var fileCommand in _commandExtensions)
+            {
+                var oldPath = Path.Combine(_fileCommandDirectory, fileCommand.FilePrefix + oldSuffix);
+                if (oldSuffix != String.Empty && File.Exists(oldPath))
+                {
+                    TryDeleteFile(oldPath);
+                }
+
+                var newPath = Path.Combine(_fileCommandDirectory, fileCommand.FilePrefix + _fileSuffix);
+                TryDeleteFile(newPath);
+                File.Create(newPath).Dispose();
+
+                var pathToSet = container != null ? container.TranslateToContainerPath(newPath) : newPath; 
+                context.SetGitHubContext(fileCommand.ContextName, pathToSet);
+            }
+        }
+
+        public void ProcessFiles(IExecutionContext context, ContainerInfo container)
+        {
+            foreach (var fileCommand in _commandExtensions)
+            {
+                try 
+                {
+                    fileCommand.ProcessCommand(context, Path.Combine(_fileCommandDirectory, fileCommand.FilePrefix + _fileSuffix),container);
+                }
+                catch (Exception ex)
+                {
+                    context.Error($"Unable to process file command '{fileCommand.ContextName}' successfully.");
+                    context.Error(ex);
+                    context.CommandResult = TaskResult.Failed;
+                }
+            }
+        }
+
+        private bool TryDeleteFile(string path)
+        {
+            if (!File.Exists(path))
+            {
+                return true;
+            }
+            try
+            {
+                File.Delete(path);
+            }
+            catch (Exception e)
+            {
+                _trace.Warning($"Unable to delete file {path} for reason: {e.ToString()}");
+                return false;
+            }
+            return true;
+        }
+    }
+
+    public interface IFileCommandExtension : IExtension
+    {
+        string ContextName { get; }
+        string FilePrefix { get; }
+
+        void ProcessCommand(IExecutionContext context, string filePath, ContainerInfo container);
+    }
+
+    public sealed class AddPathFileCommand : RunnerService, IFileCommandExtension
+    {
+        public string ContextName => "path";
+        public string FilePrefix => "add_path_";
+
+        public Type ExtensionType => typeof(IFileCommandExtension);
+
+        public void ProcessCommand(IExecutionContext context, string filePath, ContainerInfo container)
+        {
+            if (File.Exists(filePath))
+            {
+                var lines = File.ReadAllLines(filePath, Encoding.UTF8);
+                foreach(var line in lines)
+                {
+                    if (line == string.Empty)
+                    {
+                        continue;
+                    }
+                    context.Global.PrependPath.RemoveAll(x => string.Equals(x, line, StringComparison.CurrentCulture));
+                    context.Global.PrependPath.Add(line);
+                }
+            }
+        }
+    }
+
+    public sealed class SetEnvFileCommand : RunnerService, IFileCommandExtension
+    {
+        public string ContextName => "env";
+        public string FilePrefix => "set_env_";
+
+        public Type ExtensionType => typeof(IFileCommandExtension);
+
+        public void ProcessCommand(IExecutionContext context, string filePath, ContainerInfo container)
+        {
+            try
+            {
+                var text = File.ReadAllText(filePath) ?? string.Empty;
+                var index = 0;
+                var line = ReadLine(text, ref index);
+                while (line != null)
+                {
+                    if (!string.IsNullOrEmpty(line))
+                    {
+                        var equalsIndex = line.IndexOf("=", StringComparison.Ordinal);
+                        var heredocIndex = line.IndexOf("<<", StringComparison.Ordinal);
+
+                        // Normal style NAME=VALUE
+                        if (equalsIndex >= 0 && (heredocIndex < 0 || equalsIndex < heredocIndex))
+                        {
+                            var split = line.Split(new[] { '=' }, 2, StringSplitOptions.None);
+                            if (string.IsNullOrEmpty(line))
+                            {
+                                throw new Exception($"Invalid environment variable format '{line}'. Environment variable name must not be empty");
+                            }
+                            SetEnvironmentVariable(context, split[0], split[1]);
+                        }
+                        // Heredoc style NAME<<EOF
+                        else if (heredocIndex >= 0 && (equalsIndex < 0 || heredocIndex < equalsIndex))
+                        {
+                            var split = line.Split(new[] { "<<" }, 2, StringSplitOptions.None);
+                            if (string.IsNullOrEmpty(split[0]) || string.IsNullOrEmpty(split[1]))
+                            {
+                                throw new Exception($"Invalid environment variable format '{line}'. Environment variable name must not be empty and delimiter must not be empty");
+                            }
+                            var name = split[0];
+                            var delimiter = split[1];
+                            var startIndex = index; // Start index of the value (inclusive)
+                            var endIndex = index;   // End index of the value (exclusive)
+                            var tempLine = ReadLine(text, ref index, out var newline);
+                            while (!string.Equals(tempLine, delimiter, StringComparison.Ordinal))
+                            {
+                                if (tempLine == null)
+                                {
+                                    throw new Exception($"Invalid environment variable value. Matching delimiter not found '{delimiter}'");
+                                }
+                                endIndex = index - newline.Length;
+                                tempLine = ReadLine(text, ref index, out newline);
+                            }
+
+                            var value = endIndex > startIndex ? text.Substring(startIndex, endIndex - startIndex) : string.Empty;
+                            SetEnvironmentVariable(context, name, value);
+                        }
+                        else
+                        {
+                            throw new Exception($"Invalid environment variable format '{line}'");
+                        }
+                    }
+
+                    line = ReadLine(text, ref index);
+                }
+            }
+            catch (DirectoryNotFoundException)
+            {
+                context.Debug($"Environment variables file does not exist '{filePath}'");
+            }
+            catch (FileNotFoundException)
+            {
+                context.Debug($"Environment variables file does not exist '{filePath}'");
+            }
+        }
+
+        private static void SetEnvironmentVariable(
+            IExecutionContext context,
+            string name,
+            string value)
+        {
+            context.Global.EnvironmentVariables[name] = value;
+            context.SetEnvContext(name, value);
+            context.Debug($"{name}='{value}'");
+        }
+
+        private static string ReadLine(
+            string text,
+            ref int index)
+        {
+            return ReadLine(text, ref index, out _);
+        }
+
+        private static string ReadLine(
+            string text,
+            ref int index,
+            out string newline)
+        {
+            if (index >= text.Length)
+            {
+                newline = null;
+                return null;
+            }
+
+            var originalIndex = index;
+            var lfIndex = text.IndexOf("\n", index, StringComparison.Ordinal);
+            if (lfIndex < 0)
+            {
+                index = text.Length;
+                newline = null;
+                return text.Substring(originalIndex);
+            }
+
+#if OS_WINDOWS
+            var crLFIndex = text.IndexOf("\r\n", index, StringComparison.Ordinal);
+            if (crLFIndex >= 0 && crLFIndex < lfIndex)
+            {
+                index = crLFIndex + 2; // Skip over CRLF
+                newline = "\r\n";
+                return text.Substring(originalIndex, crLFIndex - originalIndex);
+            }
+#endif
+
+            index = lfIndex + 1; // Skip over LF
+            newline = "\n";
+            return text.Substring(originalIndex, lfIndex - originalIndex);
+        }
+    }
+}

src/Runner.Worker/GitHubContext.cs

@@ -6,21 +6,24 @@ namespace GitHub.Runner.Worker
 {
     public sealed class GitHubContext : DictionaryContextData, IEnvironmentContextData
     {
-        private readonly HashSet<string> _contextEnvWhitelist = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
+        private readonly HashSet<string> _contextEnvAllowlist = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
         {
             "action",
             "action_path",
             "actor",
             "api_url",
             "base_ref",
+            "env",
             "event_name",
             "event_path",
             "graphql_url",
             "head_ref",
             "job",
+            "path",
             "ref",
             "repository",
             "repository_owner",
+            "retention_days",
             "run_id",
             "run_number",
             "server_url",
@@ -33,11 +36,23 @@ namespace GitHub.Runner.Worker
         {
             foreach (var data in this)
             {
-                if (_contextEnvWhitelist.Contains(data.Key) && data.Value is StringContextData value)
+                if (_contextEnvAllowlist.Contains(data.Key) && data.Value is StringContextData value)
                 {
                     yield return new KeyValuePair<string, string>($"GITHUB_{data.Key.ToUpperInvariant()}", value);
                 }
             }
         }
+
+        public GitHubContext ShallowCopy()
+        {
+            var copy = new GitHubContext();
+
+            foreach (var pair in this)
+            {
+                copy[pair.Key] = pair.Value;
+            }
+
+            return copy;
+        }
     }
 }

src/Runner.Worker/Handlers/CompositeActionHandler.cs

@@ -32,9 +32,6 @@ namespace GitHub.Runner.Worker.Handlers
             ArgUtil.NotNull(Inputs, nameof(Inputs));
             ArgUtil.NotNull(Data.Steps, nameof(Data.Steps));
 
-            var githubContext = ExecutionContext.ExpressionValues["github"] as GitHubContext;
-            ArgUtil.NotNull(githubContext, nameof(githubContext));
-
             // Resolve action steps
             var actionSteps = Data.Steps;
 
@@ -56,14 +53,6 @@ namespace GitHub.Runner.Worker.Handlers
                 childScopeName = $"__{Guid.NewGuid()}";
             }
 
-            // Copy the github context so that we don't modify the original pointer
-            // We can't use PipelineContextData.Clone() since that creates a null pointer exception for copying a GitHubContext
-            var compositeGitHubContext = new GitHubContext();
-            foreach (var pair in githubContext)
-            {
-                compositeGitHubContext[pair.Key] = pair.Value;
-            }
-
             foreach (Pipelines.ActionStep actionStep in actionSteps)
             {
                 var actionRunner = HostContext.CreateService<IActionRunner>();
@@ -73,8 +62,13 @@ namespace GitHub.Runner.Worker.Handlers
 
                 var step = ExecutionContext.CreateCompositeStep(childScopeName, actionRunner, inputsData, Environment);
 
+                // Shallow copy github context
+                var gitHubContext = step.ExecutionContext.ExpressionValues["github"] as GitHubContext;
+                ArgUtil.NotNull(gitHubContext, nameof(gitHubContext));
+                gitHubContext = gitHubContext.ShallowCopy();
+                step.ExecutionContext.ExpressionValues["github"] = gitHubContext;
+
                 // Set GITHUB_ACTION_PATH
-                step.ExecutionContext.ExpressionValues["github"] = compositeGitHubContext;
                 step.ExecutionContext.SetGitHubContext("action_path", ActionDirectory);
 
                 compositeSteps.Add(step);

src/Runner.Worker/Handlers/ContainerActionHandler.cs

@@ -161,16 +161,21 @@ namespace GitHub.Runner.Worker.Handlers
             Directory.CreateDirectory(tempHomeDirectory);
             this.Environment["HOME"] = tempHomeDirectory;
 
+            var tempFileCommandDirectory = Path.Combine(tempDirectory, "_runner_file_commands");
+            ArgUtil.Directory(tempFileCommandDirectory, nameof(tempFileCommandDirectory));
+
             var tempWorkflowDirectory = Path.Combine(tempDirectory, "_github_workflow");
             ArgUtil.Directory(tempWorkflowDirectory, nameof(tempWorkflowDirectory));
 
             container.MountVolumes.Add(new MountVolume("/var/run/docker.sock", "/var/run/docker.sock"));
             container.MountVolumes.Add(new MountVolume(tempHomeDirectory, "/github/home"));
             container.MountVolumes.Add(new MountVolume(tempWorkflowDirectory, "/github/workflow"));
+            container.MountVolumes.Add(new MountVolume(tempFileCommandDirectory, "/github/file_commands"));
             container.MountVolumes.Add(new MountVolume(defaultWorkingDirectory, "/github/workspace"));
 
             container.AddPathTranslateMapping(tempHomeDirectory, "/github/home");
             container.AddPathTranslateMapping(tempWorkflowDirectory, "/github/workflow");
+            container.AddPathTranslateMapping(tempFileCommandDirectory, "/github/file_commands");
             container.AddPathTranslateMapping(defaultWorkingDirectory, "/github/workspace");
 
             container.ContainerWorkDirectory = "/github/workspace";

src/Sdk/DTPipelines/Pipelines/JobContainer.cs

@@ -56,5 +56,36 @@ namespace GitHub.DistributedTask.Pipelines
             get;
             set;
         }
+
+        /// <summary>
+        /// Gets or sets the credentials used for pulling the container iamge.
+        /// </summary>
+        public ContainerRegistryCredentials Credentials
+        {
+            get;
+            set;
+        }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public sealed class ContainerRegistryCredentials
+    {
+        /// <summary>
+        /// Gets or sets the user to authenticate to a registry with
+        /// </summary>
+        public String Username
+        {
+            get;
+            set;
+        }
+
+        /// <summary>
+        /// Gets or sets the password to authenticate to a registry with
+        /// </summary>
+        public String Password
+        {
+            get;
+            set;
+        }
     }
 }

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConstants.cs

@@ -14,6 +14,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         public const String Clean= "clean";
         public const String Container = "container";
         public const String ContinueOnError = "continue-on-error";
+        public const String Credentials = "credentials";
         public const String Defaults = "defaults";
         public const String Env = "env";
         public const String Event = "event";
@@ -45,6 +46,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         public const String Options = "options";
         public const String Outputs = "outputs";
         public const String OutputsPattern = "needs.*.outputs";
+        public const String Password = "password";
         public const String Path = "path";
         public const String Pool = "pool";
         public const String Ports = "ports";
@@ -68,6 +70,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         public const String Success = "success";
         public const String Template = "template";
         public const String TimeoutMinutes = "timeout-minutes";
+        public const String Username = "username";
         public const String Uses = "uses";
         public const String VmImage = "vmImage";
         public const String Volumes = "volumes";

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConverter.cs

@@ -209,6 +209,30 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
             return (Int32)numberToken.Value;
         }
 
+        internal static ContainerRegistryCredentials ConvertToContainerCredentials(TemplateToken token)
+        {
+            var credentials = token.AssertMapping(PipelineTemplateConstants.Credentials);
+            var result = new ContainerRegistryCredentials();
+            foreach (var credentialProperty in credentials)
+            {
+                var propertyName = credentialProperty.Key.AssertString($"{PipelineTemplateConstants.Credentials} key");
+                switch (propertyName.Value)
+                {
+                    case PipelineTemplateConstants.Username:
+                        result.Username = credentialProperty.Value.AssertString(PipelineTemplateConstants.Username).Value;
+                        break;
+                    case PipelineTemplateConstants.Password:
+                        result.Password = credentialProperty.Value.AssertString(PipelineTemplateConstants.Password).Value;
+                        break;
+                    default:
+                        propertyName.AssertUnexpectedValue($"{PipelineTemplateConstants.Credentials} key {propertyName}");
+                        break;
+                }
+            }
+
+            return result;
+        }
+
         internal static JobContainer ConvertToJobContainer(
             TemplateContext context,
             TemplateToken value,
@@ -275,6 +299,9 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
                             }
                             result.Volumes = volumeList;
                             break;
+                        case PipelineTemplateConstants.Credentials:
+                            result.Credentials = ConvertToContainerCredentials(containerPropertyPair.Value);
+                            break;
                         default:
                             propertyName.AssertUnexpectedValue($"{PipelineTemplateConstants.Container} key");
                             break;

src/Sdk/DTPipelines/workflow-v1.0.json

@@ -373,7 +373,8 @@
           "options": "non-empty-string",
           "env": "container-env",
           "ports": "sequence-of-non-empty-string",
-          "volumes": "sequence-of-non-empty-string"
+          "volumes": "sequence-of-non-empty-string",
+          "credentials": "container-registry-credentials"
         }
       }
     },
@@ -404,6 +405,20 @@
       ]
     },
 
+    "container-registry-credentials": {
+      "context": [
+        "secrets",
+        "env",
+        "github"
+      ],
+      "mapping": {
+        "properties": {
+          "username": "non-empty-string",
+          "password": "non-empty-string"
+        }
+      }
+    },
+
     "container-env": {
       "mapping": {
         "loose-key-type": "non-empty-string",

src/Sdk/DTWebApi/WebApi/TaskHttpClient.cs

@@ -50,7 +50,7 @@ namespace GitHub.DistributedTask.WebApi
             : base(baseUrl, pipeline, disposeHandler)
         {
         }
-
+        
         public Task AppendTimelineRecordFeedAsync(
             Guid scopeIdentifier,
             String planType,
@@ -91,6 +91,28 @@ namespace GitHub.DistributedTask.WebApi
                                                  userState,
                                                  cancellationToken);
         }
+        
+        public Task AppendTimelineRecordFeedAsync(
+            Guid scopeIdentifier,
+            String planType,
+            Guid planId,
+            Guid timelineId,
+            Guid recordId,
+            Guid stepId,
+            IList<String> lines,
+            long startLine,
+            CancellationToken cancellationToken = default(CancellationToken),
+            Object userState = null)
+        {
+            return AppendTimelineRecordFeedAsync(scopeIdentifier,
+                                                 planType,
+                                                 planId,
+                                                 timelineId,
+                                                 recordId,
+                                                 new TimelineRecordFeedLinesWrapper(stepId, lines, startLine),
+                                                 userState,
+                                                 cancellationToken);
+        }
 
         public async Task RaisePlanEventAsync<T>(
             Guid scopeIdentifier,

src/Sdk/DTWebApi/WebApi/TimelineRecordFeedLinesWrapper.cs

@@ -20,6 +20,12 @@ namespace GitHub.DistributedTask.WebApi
             this.Count = lines.Count;
         }
 
+        public TimelineRecordFeedLinesWrapper(Guid stepId, IList<string> lines, Int64 startLine)
+            : this(stepId, lines)
+        {
+            this.StartLine = startLine;
+        }
+
         [DataMember(Order = 0)]
         public Int32 Count { get; private set; }
 
@@ -31,5 +37,8 @@ namespace GitHub.DistributedTask.WebApi
 
         [DataMember(EmitDefaultValue = false)]
         public Guid StepId { get; set; }
+
+        [DataMember (EmitDefaultValue = false)]
+        public Int64? StartLine { get; private set; }
     }
 }

src/Sdk/DTWebApi/WebApi/TimelineRecordLogLine.cs

@@ -0,0 +1,29 @@
+using System;
+using System.Runtime.Serialization;
+
+namespace GitHub.DistributedTask.WebApi
+{
+    [DataContract]
+    public sealed class TimelineRecordLogLine
+    {
+        public TimelineRecordLogLine(String line, long? lineNumber)
+        {
+            this.Line = line;
+            this.LineNumber = lineNumber;
+        }
+
+        [DataMember]
+        public String Line
+        {
+            get;
+            set;
+        }
+
+        [DataMember (EmitDefaultValue = false)]
+        public long? LineNumber
+        {
+            get;
+            set;
+        }
+    }
+}

src/Test/L0/Container/DockerUtilL0.cs

@@ -126,5 +126,23 @@ namespace GitHub.Runner.Common.Tests.Worker.Container
             Assert.NotNull(result5);
             Assert.Equal("/foo/bar:/baz", result5);
         }
+
+        [Theory]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        [InlineData("dockerhub/repo", "")]
+        [InlineData("localhost/doesnt_work", "")]
+        [InlineData("localhost:port/works", "localhost:port")]
+        [InlineData("host.tld/works", "host.tld")]
+        [InlineData("ghcr.io/owner/image", "ghcr.io")]
+        [InlineData("gcr.io/project/image", "gcr.io")]
+        [InlineData("myregistry.azurecr.io/namespace/image", "myregistry.azurecr.io")]
+        [InlineData("account.dkr.ecr.region.amazonaws.com/image", "account.dkr.ecr.region.amazonaws.com")]
+        [InlineData("docker.pkg.github.com/owner/repo/image", "docker.pkg.github.com")]
+        public void ParseRegistryHostnameFromImageName(string input, string expected)
+        {
+            var actual = DockerUtil.ParseRegistryHostnameFromImageName(input);
+            Assert.Equal(expected, actual);
+        }
     }
 }

src/Test/L0/ServiceInterfacesL0.cs

@@ -60,6 +60,7 @@ namespace GitHub.Runner.Common.Tests
             {
                 typeof(IActionCommandExtension),
                 typeof(IExecutionContext),
+                typeof(IFileCommandExtension),
                 typeof(IHandler),
                 typeof(IJobExtension),
                 typeof(IStep),

src/Test/L0/Worker/ActionRunnerL0.cs

@@ -32,6 +32,8 @@ namespace GitHub.Runner.Common.Tests.Worker
         private TestHostContext _hc;
         private ActionRunner _actionRunner;
         private IActionManifestManager _actionManifestManager;
+        private Mock<IFileCommandManager> _fileCommandManager;
+
         private DictionaryContextData _context = new DictionaryContextData();
 
         [Fact]
@@ -362,6 +364,7 @@ namespace GitHub.Runner.Common.Tests.Worker
             _handlerFactory = new Mock<IHandlerFactory>();
             _defaultStepHost = new Mock<IDefaultStepHost>();
             _actionManifestManager = new ActionManifestManager();
+            _fileCommandManager = new Mock<IFileCommandManager>();
             _actionManifestManager.Initialize(_hc);
 
             var githubContext = new GitHubContext();
@@ -394,6 +397,8 @@ namespace GitHub.Runner.Common.Tests.Worker
 
             _hc.EnqueueInstance<IDefaultStepHost>(_defaultStepHost.Object);
 
+            _hc.EnqueueInstance(_fileCommandManager.Object);
+
             // Instance to test.
             _actionRunner = new ActionRunner();
             _actionRunner.Initialize(_hc);

src/Test/L0/Worker/ExecutionContextL0.cs

@@ -116,7 +116,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var pagingLogger = new Mock<IPagingLogger>();
                 var jobServerQueue = new Mock<IJobServerQueue>();
                 jobServerQueue.Setup(x => x.QueueTimelineRecordUpdate(It.IsAny<Guid>(), It.IsAny<TimelineRecord>()));
-                jobServerQueue.Setup(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>())).Callback((Guid id, string msg) => { hc.GetTrace().Info(msg); });
+                jobServerQueue.Setup(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>(),It.IsAny<long>())).Callback((Guid id, string msg, long? lineNumber) => { hc.GetTrace().Info(msg); });
 
                 hc.EnqueueInstance(pagingLogger.Object);
                 hc.SetSingleton(jobServerQueue.Object);
@@ -137,7 +137,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
                 ec.Complete();
 
-                jobServerQueue.Verify(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>()), Times.Exactly(10));
+                jobServerQueue.Verify(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>(), It.IsAny<long?>()), Times.Exactly(10));
             }
         }
 
@@ -171,7 +171,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var pagingLogger5 = new Mock<IPagingLogger>();
                 var jobServerQueue = new Mock<IJobServerQueue>();
                 jobServerQueue.Setup(x => x.QueueTimelineRecordUpdate(It.IsAny<Guid>(), It.IsAny<TimelineRecord>()));
-                jobServerQueue.Setup(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>())).Callback((Guid id, string msg) => { hc.GetTrace().Info(msg); });
+                jobServerQueue.Setup(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>(), It.IsAny<long?>())).Callback((Guid id, string msg, long? lineNumber) => { hc.GetTrace().Info(msg); });
 
                 var actionRunner1 = new ActionRunner();
                 actionRunner1.Initialize(hc);
@@ -269,7 +269,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var pagingLogger5 = new Mock<IPagingLogger>();
                 var jobServerQueue = new Mock<IJobServerQueue>();
                 jobServerQueue.Setup(x => x.QueueTimelineRecordUpdate(It.IsAny<Guid>(), It.IsAny<TimelineRecord>()));
-                jobServerQueue.Setup(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>())).Callback((Guid id, string msg) => { hc.GetTrace().Info(msg); });
+                jobServerQueue.Setup(x => x.QueueWebConsoleLine(It.IsAny<Guid>(), It.IsAny<string>(), It.IsAny<long?>())).Callback((Guid id, string msg, long? lineNumber) => { hc.GetTrace().Info(msg); });
 
                 var actionRunner1 = new ActionRunner();
                 actionRunner1.Initialize(hc);

src/Test/L0/Worker/SetEnvFileCommandL0.cs

@@ -0,0 +1,390 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using System.Runtime.CompilerServices;
+using GitHub.Runner.Common.Util;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker;
+using GitHub.Runner.Worker.Container;
+using GitHub.Runner.Worker.Handlers;
+using Moq;
+using Xunit;
+using DTWebApi = GitHub.DistributedTask.WebApi;
+
+namespace GitHub.Runner.Common.Tests.Worker
+{
+    public sealed class SetEnvFileCommandL0
+    {
+        private Mock<IExecutionContext> _executionContext;
+        private List<Tuple<DTWebApi.Issue, string>> _issues;
+        private string _rootDirectory;
+        private SetEnvFileCommand _setEnvFileCommand;
+        private ITraceWriter _trace;
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_DirectoryNotFound()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "directory-not-found", "env");
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(0, _executionContext.Object.Global.EnvironmentVariables.Count);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_NotFound()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "file-not-found");
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(0, _executionContext.Object.Global.EnvironmentVariables.Count);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_EmptyFile()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "empty-file");
+                var content = new List<string>();
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(0, _executionContext.Object.Global.EnvironmentVariables.Count);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Simple()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "simple");
+                var content = new List<string>
+                {
+                    "MY_ENV=MY VALUE",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(1, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal("MY VALUE", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Simple_SkipEmptyLines()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "simple");
+                var content = new List<string>
+                {
+                    string.Empty,
+                    "MY_ENV=my value",
+                    string.Empty,
+                    "MY_ENV_2=my second value",
+                    string.Empty,
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(2, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal("my value", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+                Assert.Equal("my second value", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_2"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Simple_EmptyValue()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "simple-empty-value");
+                var content = new List<string>
+                {
+                    "MY_ENV=",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(1, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal(string.Empty, _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Simple_MultipleValues()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "simple");
+                var content = new List<string>
+                {
+                    "MY_ENV=my value",
+                    "MY_ENV_2=",
+                    "MY_ENV_3=my third value",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(3, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal("my value", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+                Assert.Equal(string.Empty, _executionContext.Object.Global.EnvironmentVariables["MY_ENV_2"]);
+                Assert.Equal("my third value", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_3"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Simple_SpecialCharacters()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "simple");
+                var content = new List<string>
+                {
+                    "MY_ENV==abc",
+                    "MY_ENV_2=def=ghi",
+                    "MY_ENV_3=jkl=",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(3, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal("=abc", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+                Assert.Equal("def=ghi", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_2"]);
+                Assert.Equal("jkl=", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_3"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Heredoc()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "heredoc");
+                var content = new List<string>
+                {
+                    "MY_ENV<<EOF",
+                    "line one",
+                    "line two",
+                    "line three",
+                    "EOF",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(1, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal($"line one{Environment.NewLine}line two{Environment.NewLine}line three", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Heredoc_EmptyValue()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "heredoc");
+                var content = new List<string>
+                {
+                    "MY_ENV<<EOF",
+                    "EOF",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(1, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal(string.Empty, _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Heredoc_SkipEmptyLines()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "heredoc");
+                var content = new List<string>
+                {
+                    string.Empty,
+                    "MY_ENV<<EOF",
+                    "hello",
+                    "world",
+                    "EOF",
+                    string.Empty,
+                    "MY_ENV_2<<EOF",
+                    "HELLO",
+                    "AGAIN",
+                    "EOF",
+                    string.Empty,
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(2, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal($"hello{Environment.NewLine}world", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+                Assert.Equal($"HELLO{Environment.NewLine}AGAIN", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_2"]);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Heredoc_SpecialCharacters()
+        {
+            using (var hostContext = Setup())
+            {
+                var envFile = Path.Combine(_rootDirectory, "heredoc");
+                var content = new List<string>
+                {
+                    "MY_ENV<<=EOF",
+                    "hello",
+                    "one",
+                    "=EOF",
+                    "MY_ENV_2<<<EOF",
+                    "hello",
+                    "two",
+                    "<EOF",
+                    "MY_ENV_3<<EOF",
+                    "hello",
+                    string.Empty,
+                    "three",
+                    string.Empty,
+                    "EOF",
+                    "MY_ENV_4<<EOF",
+                    "hello=four",
+                    "EOF",
+                    "MY_ENV_5<<EOF",
+                    " EOF",
+                    "EOF",
+                };
+                WriteContent(envFile, content);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(5, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal($"hello{Environment.NewLine}one", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+                Assert.Equal($"hello{Environment.NewLine}two", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_2"]);
+                Assert.Equal($"hello{Environment.NewLine}{Environment.NewLine}three{Environment.NewLine}", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_3"]);
+                Assert.Equal($"hello=four", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_4"]);
+                Assert.Equal($" EOF", _executionContext.Object.Global.EnvironmentVariables["MY_ENV_5"]);
+            }
+        }
+
+#if OS_WINDOWS
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void SetEnvFileCommand_Heredoc_PreservesNewline()
+        {
+            using (var hostContext = Setup())
+            {
+                var newline = "\n";
+                var envFile = Path.Combine(_rootDirectory, "heredoc");
+                var content = new List<string>
+                {
+                    "MY_ENV<<EOF",
+                    "hello",
+                    "world",
+                    "EOF",
+                };
+                WriteContent(envFile, content, newline: newline);
+                _setEnvFileCommand.ProcessCommand(_executionContext.Object, envFile, null);
+                Assert.Equal(0, _issues.Count);
+                Assert.Equal(1, _executionContext.Object.Global.EnvironmentVariables.Count);
+                Assert.Equal($"hello{newline}world", _executionContext.Object.Global.EnvironmentVariables["MY_ENV"]);
+            }
+        }
+#endif
+
+        private void WriteContent(
+            string path,
+            List<string> content,
+            string newline = null)
+        {
+            if (string.IsNullOrEmpty(newline))
+            {
+                newline = Environment.NewLine;
+            }
+
+            var encoding = new UTF8Encoding(true); // Emit BOM
+            var contentStr = string.Join(newline, content);
+            File.WriteAllText(path, contentStr, encoding);
+        }
+
+        private TestHostContext Setup([CallerMemberName] string name = "")
+        {
+            _issues = new List<Tuple<DTWebApi.Issue, string>>();
+
+            var hostContext = new TestHostContext(this, name);
+
+            // Trace
+            _trace = hostContext.GetTrace();
+
+            // Directory for test data
+            var workDirectory = hostContext.GetDirectory(WellKnownDirectory.Work);
+            ArgUtil.NotNullOrEmpty(workDirectory, nameof(workDirectory));
+            Directory.CreateDirectory(workDirectory);
+            _rootDirectory = Path.Combine(workDirectory, nameof(SetEnvFileCommandL0));
+            Directory.CreateDirectory(_rootDirectory);
+
+            // Execution context
+            _executionContext = new Mock<IExecutionContext>();
+            _executionContext.Setup(x => x.Global)
+                .Returns(new GlobalContext
+                {
+                    EnvironmentVariables = new Dictionary<string, string>(VarUtil.EnvironmentVariableKeyComparer),
+                    WriteDebug = true,
+                });
+            _executionContext.Setup(x => x.AddIssue(It.IsAny<DTWebApi.Issue>(), It.IsAny<string>()))
+                .Callback((DTWebApi.Issue issue, string logMessage) =>
+                {
+                    _issues.Add(new Tuple<DTWebApi.Issue, string>(issue, logMessage));
+                    var message = !string.IsNullOrEmpty(logMessage) ? logMessage : issue.Message;
+                    _trace.Info($"Issue '{issue.Type}': {message}");
+                });
+            _executionContext.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>()))
+                .Callback((string tag, string message) =>
+                {
+                    _trace.Info($"{tag}{message}");
+                });
+
+            // SetEnvFileCommand
+            _setEnvFileCommand = new SetEnvFileCommand();
+            _setEnvFileCommand.Initialize(hostContext);
+
+            return hostContext;
+        }
+    }
+}

src/Test/L0/Worker/StepsRunnerL0.cs

@@ -44,7 +44,7 @@ namespace GitHub.Runner.Common.Tests.Worker
 
             _contexts = new DictionaryContextData();
             _jobContext = new JobContext();
-            _contexts["github"] = new DictionaryContextData();
+            _contexts["github"] = new GitHubContext();
             _contexts["runner"] = new DictionaryContextData();
             _contexts["job"] = _jobContext;
             _ec.Setup(x => x.ExpressionValues).Returns(_contexts);
@@ -602,7 +602,12 @@ namespace GitHub.Runner.Common.Tests.Worker
             var stepContext = new Mock<IExecutionContext>();
             stepContext.SetupAllProperties();
             stepContext.Setup(x => x.Global).Returns(() => _ec.Object.Global);
-            stepContext.Setup(x => x.ExpressionValues).Returns(new DictionaryContextData());
+            var expressionValues = new DictionaryContextData();
+            foreach (var pair in _ec.Object.ExpressionValues)
+            {
+                expressionValues[pair.Key] = pair.Value;
+            }
+            stepContext.Setup(x => x.ExpressionValues).Returns(expressionValues);
             stepContext.Setup(x => x.ExpressionFunctions).Returns(new List<IFunctionInfo>());
             stepContext.Setup(x => x.JobContext).Returns(_jobContext);
             stepContext.Setup(x => x.ContextName).Returns(step.Object.Action.ContextName);

src/runnerversion

@@ -1 +1 @@
-2.273.0
+2.273.5