Update ldd check with dotnet 5.

From February 2021, in order to provide feedback on pull requests, Code Scanning workflows must be configured with both `push` and `pull_request` triggers. This is because Code Scanning compares the results from a pull request against the results for the base branch to tell you only what has changed between the two.

Early in the beta period we supported displaying results on pull requests for workflows with only `push` triggers, but have discontinued support as this proved to be less robust.

See https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#scanning-pull-requests for more information on how best to configure your Code Scanning workflows.

.github/workflows/codeql.yml

@@ -2,6 +2,7 @@ name: "Code Scanning - Action"
 
 on:
   push:
+  pull_request:
   schedule:
     - cron: '0 0 * * 0'
 

.github/workflows/e2etest.yml

@@ -0,0 +1,335 @@
+name: Runner E2E Test
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+    - main
+    - releases/*
+
+jobs:
+  init:
+    name: Initialize workflow ☕
+    runs-on: ubuntu-latest
+    outputs:
+      unique_runner_label: ${{steps.generator.outputs.runner_label}}
+    steps:
+    - name: Delete all runners
+      uses: actions/github-script@v3
+      with:
+        debug: true
+        script: |
+          var runnersResp = await github.actions.listSelfHostedRunnersForRepo({
+              owner: 'actions',
+              repo: 'runner',
+              per_page: '100'
+          });
+          for(var i=0; i<runnersResp.data.total_count; i++){
+            core.debug(JSON.stringify(runnersResp.data.runners[i]))
+            await github.actions.deleteSelfHostedRunnerFromRepo({
+              owner: 'actions',
+              repo: 'runner',
+              runner_id: runnersResp.data.runners[i].id
+            });
+          }
+        github-token: ${{secrets.PAT}}
+    - name: Generate Unique Runner label
+      id: generator
+      run: |
+        label=$(openssl rand -hex 16)
+        echo ::set-output name=runner_label::$label
+
+  build:
+    name: Build runner packages 🏗 📦
+    strategy:
+      matrix:
+        runtime: [ linux-x64, linux-arm64, linux-arm, win-x64, osx-x64 ]
+        include:
+        - runtime: linux-x64
+          os: ubuntu-latest
+          devScript: ./dev.sh
+
+        - runtime: linux-arm64
+          os: ubuntu-latest
+          devScript: ./dev.sh
+
+        - runtime: linux-arm
+          os: ubuntu-latest
+          devScript: ./dev.sh
+
+        - runtime: osx-x64
+          os: macOS-latest
+          devScript: ./dev.sh
+
+        - runtime: win-x64
+          os: windows-latest
+          devScript: ./dev
+
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v1
+
+    # Build runner layout
+    - name: Build & Layout Release
+      run: |
+        ${{ matrix.devScript }} layout Release ${{ matrix.runtime }}
+      working-directory: src
+    
+    # Create runner package tar.gz/zip
+    - name: Package Release
+      run: |
+         ${{ matrix.devScript }} package Release ${{ matrix.runtime }}
+      working-directory: src
+
+    # Upload runner package tar.gz/zip as artifact
+    - name: Publish Artifact
+      uses: actions/upload-artifact@v1
+      with:
+        name: runner-package-${{ matrix.runtime }}
+        path: _package
+
+  dispatch_workflow:
+    name: Dispatch workflow to runners 🚨
+    needs: [init, build]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Dispatch workflow
+      timeout-minutes: 10
+      uses: actions/github-script@v3
+      with:
+        debug: true
+        script: |
+          function sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); }
+          async function dispatchWorkflow(runner) {
+            await github.actions.createWorkflowDispatch({
+              owner: 'actions',
+              repo: 'runner',
+              workflow_id: 'runner-basic-e2e-test-case.yml',
+              ref: 'main',
+              inputs: {target_runner: runner}
+            });
+          }
+          var runWin64 = false, runLinux64 = false, runOsx64 = false, runLinuxARM64 = false;
+          while (true) {
+            core.info(`------------- Waiting for runners to be configured --------------`)
+            await sleep(10000);
+            var runnersResp = await github.actions.listSelfHostedRunnersForRepo({owner: 'actions', repo: 'runner', per_page: '100'});
+            for (var i = 0; i < runnersResp.data.total_count; i++) {
+              core.debug(JSON.stringify(runnersResp.data.runners[i]))
+              var labels = runnersResp.data.runners[i].labels;
+              for (var j = 0; j < labels.length; j++) {
+                core.debug(`Comparing: ${labels[j].name} to win-x64/linux-x64/osx-x64/linux-arm64-${{ needs.init.outputs.unique_runner_label }}`)
+                if (labels[j].name == 'win-x64-${{needs.init.outputs.unique_runner_label}}' && runWin64 == false) {
+                  core.info(`------------------- Windows runner is configured, queue Windows Run -------------------------`)
+                  runWin64 = true;
+                  await dispatchWorkflow('win-x64-${{needs.init.outputs.unique_runner_label}}');
+                  break;
+                } else if (labels[j].name == 'linux-x64-${{needs.init.outputs.unique_runner_label}}' && runLinux64 == false) {
+                  core.info(`------------------- Linux runner is configured, queue Linux Run -------------------------`)
+                  runLinux64 = true;
+                  await dispatchWorkflow('linux-x64-${{needs.init.outputs.unique_runner_label}}');
+                  break;
+                } else if (labels[j].name == 'osx-x64-${{needs.init.outputs.unique_runner_label}}' && runOsx64 == false) {
+                  core.info(`------------------- macOS runner is configured, queue macOS Run -------------------------`)
+                  runOsx64 = true;
+                  await dispatchWorkflow('osx-x64-${{needs.init.outputs.unique_runner_label}}');
+                  break;
+                } else if (labels[j].name == 'linux-arm64-${{needs.init.outputs.unique_runner_label}}' && runLinuxARM64 == false) {
+                  core.info(`------------------- Linux ARM64 runner is configured, queue Linux ARM64 Run-------------------------`)
+                  runLinuxARM64 = true;
+                  await dispatchWorkflow('linux-arm64-${{needs.init.outputs.unique_runner_label}}');
+                  break;
+                }
+              }
+            }
+            if (runWin64 && runLinux64 && runOsx64 && runLinuxARM64) {
+              core.info(`--------------------- ALL runner are running jobs --------------------------`)
+              break;
+            } else {
+              core.info(`---------- Windows running: ${runWin64} -- Linux running: ${runLinux64} -- macOS running: ${runOsx64} -- Linux ARM64 running: ${runLinuxARM64} -----------`)
+            }
+          }
+        github-token: ${{secrets.PAT}}
+
+  LinuxE2E:
+    needs: [build, init]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Runner
+        uses: actions/download-artifact@v2
+        with:
+          name: runner-package-linux-x64
+      - name: Unzip Runner Package
+        run: |
+          tar -xzf *.tar.gz
+      - name: Configure Runner
+        env:
+          unique_runner_name: linux-x64-${{needs.init.outputs.unique_runner_label}}
+        run: |
+          ./config.sh --url ${{github.event.repository.html_url}} --unattended --name $unique_runner_name --pat ${{secrets.PAT}} --labels $unique_runner_name --replace
+      - name: Start Runner and Wait for Job
+        timeout-minutes: 5
+        run: |
+          ./run.sh --once
+      - name: Remove Runner
+        if: always()
+        continue-on-error: true
+        run: |
+          ./config.sh remove --pat ${{secrets.PAT}}
+      - name: Upload Runner Logs
+        if: always()
+        uses: actions/upload-artifact@v2
+        with:
+          name: linux_x64_logs
+          path: _diag
+  macOSE2E:
+    needs: [build, init]
+    runs-on: macos-latest
+    steps:
+      - name: Download Runner
+        uses: actions/download-artifact@v2
+        with:
+          name: runner-package-osx-x64
+      - name: Unzip Runner Package
+        run: |
+          tar -xzf *.tar.gz
+      - name: Configure Runner
+        env:
+          unique_runner_name: osx-x64-${{needs.init.outputs.unique_runner_label}}
+        run: |
+          ./config.sh --url ${{github.event.repository.html_url}} --unattended --name $unique_runner_name --pat ${{secrets.PAT}} --labels $unique_runner_name --replace
+      - name: Start Runner and Wait for Job
+        timeout-minutes: 5
+        run: |
+          ./run.sh --once
+      - name: Remove Runner
+        if: always()
+        continue-on-error: true
+        run: |
+          ./config.sh remove --pat ${{secrets.PAT}}
+      - name: Upload Runner Logs
+        if: always()
+        uses: actions/upload-artifact@v2
+        with:
+          name: osx_x64_logs
+          path: _diag
+
+  ARM64E2E:
+    needs: [build, init]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Runner
+        uses: actions/download-artifact@v2
+        with:
+          name: runner-package-linux-arm64
+      - name: Unzip Runner Package
+        run: |
+          tar -xzf *.tar.gz
+      - name: Prepare QEMU
+        run: |
+          docker run --rm --privileged multiarch/qemu-user-static:register --reset
+      - name: Configure Runner
+        uses: docker://multiarch/ubuntu-core:arm64-bionic
+        with:
+          args: 'bash -c "apt-get update && apt-get install -y curl && ./bin/installdependencies.sh && ./config.sh --unattended --name $unique_runner_name --url ${{github.event.repository.html_url}} --pat ${{secrets.PAT}} --labels $unique_runner_name  --replace"'
+        env:
+          RUNNER_ALLOW_RUNASROOT: 1
+          unique_runner_name: linux-arm64-${{needs.init.outputs.unique_runner_label}}
+
+      - name: Start Runner and Wait for Job
+        timeout-minutes: 5
+        uses: docker://multiarch/ubuntu-core:arm64-bionic
+        with:
+          args: 'bash -c "apt-get update && apt-get install -y curl git && ./bin/installdependencies.sh && ./run.sh --once"'
+        env:
+          RUNNER_ALLOW_RUNASROOT: 1
+
+      - name: Remove Runner
+        if: always()
+        continue-on-error: true
+        uses: docker://multiarch/ubuntu-core:arm64-bionic
+        with:
+          args: 'bash -c "apt-get update && apt-get install -y curl && ./bin/installdependencies.sh && ./config.sh remove --pat ${{secrets.PAT}}"'
+        env:
+          RUNNER_ALLOW_RUNASROOT: 1
+
+      - name: Upload Runner Logs
+        if: always()
+        uses: actions/upload-artifact@v2
+        with:
+          name: linux_arm64_logs
+          path: _diag
+
+  WindowsE2E:
+    needs: [build, init]
+    runs-on: windows-latest
+    steps:
+      - name: Download Runner
+        uses: actions/download-artifact@v2
+        with:
+          name: runner-package-win-x64
+      - name: Unzip Runner Package
+        run: |
+          Get-ChildItem *.zip | Expand-Archive -DestinationPath $PWD
+      - name: Configure Runner
+        shell: cmd
+        run: |
+          config.cmd --unattended --url ${{github.event.repository.html_url}} --name %unique_runner_name% --pat ${{secrets.PAT}} --labels %unique_runner_name% --replace
+        env:
+          unique_runner_name: win-x64-${{needs.init.outputs.unique_runner_label}}
+
+      - name: Start Runner and Wait for Job
+        shell: cmd
+        timeout-minutes: 5
+        run: |
+          run.cmd --once
+      - name: Remove Runner
+        shell: cmd
+        if: always()
+        continue-on-error: true
+        run: |
+          config.cmd remove --pat ${{secrets.PAT}}
+      - name: Upload Runner Logs
+        if: always()
+        uses: actions/upload-artifact@v2
+        with:
+          name: win_x64_logs
+          path: _diag
+  
+  check:
+    name: Check runner logs 🕵️‍♂️
+    needs: [WindowsE2E, LinuxE2E, macOSE2E, ARM64E2E]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Download Linux Runner Logs
+      uses: actions/download-artifact@v2
+      with:
+        name: linux_x64_logs
+        path: linux_x64_logs
+    - name: Download macOS Runner Logs
+      uses: actions/download-artifact@v2
+      with:
+        name: osx_x64_logs
+        path: osx_x64_logs
+    - name: Download Linux ARM64 Runner Logs
+      uses: actions/download-artifact@v2
+      with:
+        name: linux_arm64_logs
+        path: linux_arm64_logs
+    - name: Download Windows Runner Logs
+      uses: actions/download-artifact@v2
+      with:
+        name: win_x64_logs
+        path: win_x64_logs
+    - name: Check Runner Logs
+      run: |
+        function failed()
+        {
+            local error=${1:-Undefined error}
+            echo "Failed: $error" >&2
+            exit 1
+        }
+        grep -R "completed with result: Succeeded" ./win_x64_logs || failed "Windows Runner fail to run the job, please check logs"
+        grep -R "completed with result: Succeeded" ./linux_x64_logs || failed "Linux Runner fail to run the job, please check logs"
+        grep -R "completed with result: Succeeded" ./osx_x64_logs || failed "macOS Runner fail to run the job, please check logs"
+        grep -R "completed with result: Succeeded" ./linux_arm64_logs || failed "Linux ARM64 Runner fail to run the job, please check logs"

.github/workflows/runner-basic-e2e-test-case.yml

@@ -0,0 +1,31 @@
+name: Runner Basics Test Case
+
+on:
+  workflow_dispatch:
+    inputs: 
+      target_runner:
+        description: 'Self-hosted runner will run the job'
+        required: true
+
+jobs:
+  test:
+    runs-on:
+    - self-hosted
+    - ${{github.event.inputs.target_runner}}
+
+    name: Runner Basic Test 🛠
+    steps:
+    - uses: actions/checkout@v2
+    - name: Run a one-line script
+      run: echo Hello, world!
+    - name: Run a multi-line script
+      shell: bash
+      run: |
+        printenv|sort
+        cat $GITHUB_EVENT_PATH
+    - name: Validate GitHub Context
+      shell: bash
+      run: |
+        declare -a context_vars=("GITHUB_ACTION" "GITHUB_ACTIONS" "GITHUB_REPOSITORY" "GITHUB_WORKSPACE" "GITHUB_SHA" "GITHUB_RUN_ID" "GITHUB_RUN_NUMBER")
+        for var in ${context_vars[@]};
+        do [ -z "${!var}" ] && echo "##[error]$var not found" && exit 1 || echo "$var: ${!var}"; done

CODEOWNERS

@@ -0,0 +1 @@
+* @actions/actions-runtime

README.md

@@ -5,6 +5,7 @@
 # GitHub Actions Runner
 
 [![Actions Status](https://github.com/actions/runner/workflows/Runner%20CI/badge.svg)](https://github.com/actions/runner/actions)
+[![Runner E2E Test](https://github.com/actions/runner/workflows/Runner%20E2E%20Test/badge.svg)](https://github.com/actions/runner/actions)
 
 The runner is the application that runs a job from a GitHub Actions workflow. It is used by GitHub Actions in the [hosted virtual environments](https://github.com/actions/virtual-environments), or you can [self-host the runner](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/about-self-hosted-runners) in your own environment.
 

docs/adrs/0263-proxy-support.md

@@ -22,7 +22,7 @@ These are described in detail below:
   - http://proxy.com
   - http://127.0.0.1:8080
   - http://user:password@proxy.com
-- `no_proxy` a comma seperated list of hosts that should not use the proxy. An optional port may be specified
+- `no_proxy` a comma separated list of hosts that should not use the proxy. An optional port may be specified
   - `google.com`
   - `yahoo.com:443`
   - `google.com,bing.com`
@@ -31,9 +31,9 @@ We won't use `http_proxy` for https traffic when `https_proxy` is not set, this
 Otherwise action authors and workflow users need to adjust to differences between the runner proxy convention, and tools used by their actions and scripts.  
 
 Example:  
-  Customer set `http_proxy=http://127.0.0.1:8888` and configure the runner against `https://github.com/owner/repo`, with the `https_proxy` -> `http_proxy` fallback, the runner will connect to server without any problem. However, if user runs `git push` to `https://github.com/owner/repo`, `git` won't use the proxy since it require `https_proxy` to be set for any https traffic.
+  Customer set `http_proxy=http://127.0.0.1:8888` and configure the runner against `https://github.com/owner/repo`, with the `https_proxy` -> `http_proxy` fallback, the runner will connect to the server without any problem. However, if a user runs `git push` to `https://github.com/owner/repo`, `git` won't use the proxy since it requires `https_proxy` to be set for any https traffic.
 
-> `golang`, `node.js` and other dev tools from the linux community use `http_proxy` for both http and https traffic base on my research.
+> `golang`, `node.js` and other dev tools from the linux community use `http_proxy` for both http and https traffic based on my research.
 
 A majority of our users are using Linux where these variables are commonly required to be set by various programs. By reading these values, we simplify the process for self hosted runners to set up proxy, and expose it in a way users are already familiar with.
 
@@ -43,7 +43,7 @@ We will support the lowercase and uppercase variants, with lowercase taking prio
 
 ### No Proxy Format
 
-While exact implementations are different per application on handle `no_proxy` env, most applications accept a comma separated list of hosts. Some accept wildcard characters (*). We are going to do exact case-insentive matches, and not support wildcards at this time.
+While exact implementations are different per application on handle `no_proxy` env, most applications accept a comma separated list of hosts. Some accept wildcard characters (*). We are going to do exact case-insensitive matches, and not support wildcards at this time.
 For example:
 - example.com will match example.com, foo.example.com, foo.bar.example.com
 - foo.example.com will match bar.foo.example.com and foo.example.com
@@ -57,5 +57,5 @@ We will not support IP addresses for `no_proxy`, only hostnames.
 3. The runner will read from the environmental variables during config and runtime and use the provided proxy if it exists
 4. Users may need to pass these environmental variables into other applications if they do not natively take these variables
 5. Action authors may need to update their workflows to react to the these environment variables
-6. We will document the way of setting environmental variables for runners using the environmental variables and how the runner uses them
+6. We will document the way of setting environmental variables for runners using the environment variables and how the runner uses them
 7. Like all other secrets, users will be able to relatively easily figure out proxy password if they can modify a workflow file running on a self hosted machine

docs/adrs/0276-problem-matchers.md

@@ -34,7 +34,7 @@ A way out for rare cases where scoping is a problem.
 
 `##[remove-matcher]owner`
 
-For the this to be usable, the `owner` needs to be discoverable. Therefore, debug print the owner on registration.
+For this to be usable, the `owner` needs to be discoverable. Therefore, debug print the owner on registration.
 
 ### Single line matcher
 
@@ -184,7 +184,7 @@ Solving this problem means:
   - Use the `github.workspace` (where the repo is cloned on disk)
 - Match against a repository to determine the relative path within the repo
 
-This is a place where we diverge from VSCode. VSCode task configuration are specific to the local workspace (workspace root is known or can be specified). We're solving a more generic problem, so we need more information - specifically the `fromPath` property - in order to accurately root the path.
+This is a place where we diverge from VSCode. VSCode task configurations are specific to the local workspace (workspace root is known or can be specified). We're solving a more generic problem, so we need more information - specifically the `fromPath` property - in order to accurately root the path.
 
 In order to avoid creating inaccurate hyperlinks on the error issues, the agent will verify the file exists and is in the main repository. Otherwise omit the file property from the error issue and debug trace what happened.
 
@@ -203,7 +203,7 @@ Problem matchers are unable to interpret severity strings other than `warning` a
 
 However some tools indicate error/warning in different ways. For example `flake8` uses codes like `E100`, `W200`, and `F300` (error, warning, fatal, respectively).
 
-Therefore, allow a property `severity`, sibling to `owner`, which identifies the default severity for the problem matcher. This allows two problem matchers are registered - one for warnings and one for errors.
+Therefore, allow a property `severity`, sibling to `owner`, which identifies the default severity for the problem matcher. This allows two problem matchers to be registered - one for warnings and one for errors.
 
 For example, given the following `flake8` output:
 

docs/adrs/0277-run-action-shell-options.md

@@ -84,7 +84,7 @@ powershell/pwsh
 - Users can always opt out by not using the builtins, and providing a shell option like: `pwsh -File {0}`, or `powershell -Command "& '{0}'"`, depending on need
 
 cmd
-- There doesnt seem to be a way to fully opt in to fail-fast behavior other than writing your script to check each error code and respond accordingly, so we cant actually provide that behavior by default, it will be completely up to the user to write this behavior into their script
+- There doesn't seem to be a way to fully opt in to fail-fast behavior other than writing your script to check each error code and respond accordingly, so we can't actually provide that behavior by default, it will be completely up to the user to write this behavior into their script
 - cmd.exe will exit (return the error code to the runner) with the errorlevel of the last program it executed. This is internally consistent with the previous default behavior (sh, pwsh) and is the cmd.exe default, so we keep that behavior
 
 ## Consequences

docs/checks/actions.md

@@ -0,0 +1,44 @@
+
+# Actions Connection Check
+
+## What is this check for?
+
+Make sure the runner has access to actions service for GitHub.com or GitHub Enterprise Server
+
+- For GitHub.com
+  - The runner needs to access https://api.github.com for downloading actions.
+  - The runner needs to access https://vstoken.actions.githubusercontent.com/_apis/.../ for requesting an access token.
+  - The runner needs to access https://pipelines.actions.githubusercontent.com/_apis/.../ for receiving workflow jobs.
+- For GitHub Enterprise Server
+  - The runner needs to access https://myGHES.com/api/v3 for downloading actions.
+  - The runner needs to access https://myGHES.com/_services/vstoken/_apis/.../ for requesting an access token.
+  - The runner needs to access https://myGHES.com/_services/pipelines/_apis/.../ for receiving workflow jobs.
+
+## What is checked?
+
+- DNS lookup for api.github.com or myGHES.com using dotnet
+- Ping api.github.com or myGHES.com using dotnet
+- Make HTTP GET to https://api.github.com or https://myGHES.com/api/v3 using dotnet, check response headers contains `X-GitHub-Request-Id` 
+---
+- DNS lookup for vstoken.actions.githubusercontent.com using dotnet
+- Ping vstoken.actions.githubusercontent.com using dotnet
+- Make HTTP GET to https://vstoken.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/vstoken/_apis/health using dotnet, check response headers contains `x-vss-e2eid` 
+---
+- DNS lookup for pipelines.actions.githubusercontent.com using dotnet
+- Ping pipelines.actions.githubusercontent.com using dotnet
+- Make HTTP GET to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid` 
+
+## How to fix the issue?
+
+### 1. Check the common network issue
+  
+  > Please check the [network doc](./network.md)
+
+### 2. SSL certificate related issue
+
+  If you are seeing `System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.` in the log, it means the runner can't connect to Actions service due to SSL handshake failure.
+  > Please check the [SSL cert doc](./sslcert.md)
+  
+## Still not working?
+
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.

docs/checks/git.md

@@ -0,0 +1,34 @@
+# Git Connection Check
+
+## What is this check for?
+
+Make sure `git` can access GitHub.com or your GitHub Enterprise Server.
+
+
+## What is checked?
+
+The test is done by executing
+```bash
+# For GitHub.com
+git ls-remote --exit-code https://github.com/actions/checkout HEAD
+
+# For GitHub Enterprise Server
+git ls-remote --exit-code https://ghes.me/actions/checkout HEAD
+```
+
+The test also set environment variable `GIT_TRACE=1` and `GIT_CURL_VERBOSE=1` before running `git ls-remote`, this will make `git` to produce debug log for better debug any potential issues.
+
+## How to fix the issue?
+
+### 1. Check the common network issue
+  
+    > Please check the [network doc](./network.md)
+
+### 2. SSL certificate related issue
+
+  If you are seeing `SSL Certificate problem:` in the log, it means the `git` can't connect to the GitHub server due to SSL handshake failure.
+  > Please check the [SSL cert doc](./sslcert.md)
+  
+## Still not working?
+
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.

docs/checks/internet.md

@@ -0,0 +1,26 @@
+# Internet Connection Check
+
+## What is this check for?
+
+Make sure the runner has access to https://api.github.com
+
+The runner needs to access https://api.github.com to download any actions from the marketplace.
+
+Even the runner is configured to GitHub Enterprise Server, the runner can still download actions from GitHub.com with [GitHub Connect](https://docs.github.com/en/enterprise-server@2.22/admin/github-actions/enabling-automatic-access-to-githubcom-actions-using-github-connect)
+
+
+## What is checked?
+
+- DNS lookup for api.github.com using dotnet
+- Ping api.github.com using dotnet
+- Make HTTP GET to https://api.github.com using dotnet, check response headers contains `X-GitHub-Request-Id` 
+
+## How to fix the issue?
+
+### 1. Check the common network issue
+  
+  > Please check the [network doc](./network.md)
+
+## Still not working?
+
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.

docs/checks/network.md

@@ -0,0 +1,29 @@
+## Common Network Related Issues
+
+### Common things that can cause the runner to not working properly
+
+- Bug in the runner or the dotnet framework that causes actions runner can't make Http request in a certain network environment.
+
+- Proxy/Firewall block certain HTTP method, like it block all POST and PUT calls which the runner will use to upload logs.
+
+- Proxy/Firewall only allows requests with certain user-agent to pass through and the actions runner user-agent is not in the allow list.
+
+- Proxy try to decrypt and exam HTTPS traffic for security purpose but cause the actions-runner to fail to finish SSL handshake due to the lack of trusting proxy's CA.
+
+- Firewall rules that block action runner from accessing certain hosts, ex: `*.github.com`, `*.actions.githubusercontent.com`, etc.
+
+
+### Identify and solve these problems
+
+The key is to figure out where is the problem, the network environment, or the actions runner?
+
+Use a 3rd party tool to make the same requests as the runner did would be a good start point.
+
+- Use `nslookup` to check DNS
+- Use `ping` to check Ping
+- Use `curl -v` to check the network stack, good for verifying default certificate/proxy settings.
+- Use `Invoke-WebRequest` from `pwsh` (`PowerShell Core`) to check the dotnet network stack, good for verifying bugs in the dotnet framework.
+
+If the 3rd party tool is also experiencing the same error as the runner does, then you might want to contact your network administrator for help.
+
+Otherwise, contact GitHub customer support or log an issue at https://github.com/actions/runner

docs/checks/nodejs.md

@@ -0,0 +1,30 @@
+# Node.js Connection Check
+
+## What is this check for?
+
+Make sure the built-in node.js has access to GitHub.com or GitHub Enterprise Server.
+
+The runner carries it's own copy of node.js executable under `<runner_root>/externals/node12/`.
+
+All javascript base Actions will get executed by the built-in `node` at `<runner_root>/externals/node12/`.
+
+> Not the `node` from `$PATH`
+
+## What is checked?
+
+- Make HTTPS GET to https://api.github.com or https://myGHES.com/api/v3 using node.js, make sure it gets 200 response code.
+
+## How to fix the issue?
+
+### 1. Check the common network issue
+  
+  > Please check the [network doc](./network.md)
+
+### 2. SSL certificate related issue
+
+  If you are seeing `Https request failed due to SSL cert issue` in the log, it means the `node.js` can't connect to the GitHub server due to SSL handshake failure.
+  > Please check the [SSL cert doc](./sslcert.md)
+  
+## Still not working?
+
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.

docs/checks/sslcert.md

@@ -0,0 +1,89 @@
+## SSL Certificate Related Issues
+
+You might run into an SSL certificate error when your GitHub Enterprise Server is using a self-signed SSL server certificate or a web proxy within your network is decrypting HTTPS traffic for a security audit.
+
+As long as your certificate is generated properly, most of the issues should be fixed after your trust the certificate properly on the runner machine.
+
+> Different OS might have extra requirements on SSL certificate,
+> Ex: macOS requires `ExtendedKeyUsage` https://support.apple.com/en-us/HT210176
+
+### Don't skip SSL cert validation
+
+> !!! DO NOT SKIP SSL CERT VALIDATION !!!  
+> !!! IT IS A BAD SECURITY PRACTICE !!!  
+
+### Download SSL certificate chain 
+
+Depends on how your SSL server certificate gets configured, you might need to download the whole certificate chain from a machine that has trusted the SSL certificate's CA.
+
+- Approach 1: Download certificate chain using a browser (Chrome, Firefox, IT), you can google for more example, [here is what I found](https://medium.com/@menakajain/export-download-ssl-certificate-from-server-site-url-bcfc41ea46a2)
+
+- Approach 2: Download certificate chain using OpenSSL, you can google for more example, [here is what I found](https://superuser.com/a/176721)
+
+- Approach 3: Ask your network administrator or the owner of the CA certificate to send you a copy of it
+
+### Trust CA certificate for the Runner
+
+The actions runner is a dotnet core application which will follow how dotnet load SSL CA certificates on each OS.
+
+You can get full details documentation at [here](https://docs.microsoft.com/en-us/dotnet/standard/security/cross-platform-cryptography#x509store)
+
+In short: 
+- Windows: Load from Windows certificate store.
+- Linux: Load from OpenSSL CA cert bundle.
+- macOS: Load from macOS KeyChain.
+
+To let the runner trusts your CA certificate, you will need to:
+1. Save your SSL certificate chain which includes the root CA and all intermediate CAs into a `.pem` file.
+2. Use `OpenSSL` to convert `.pem` file to a proper format for different OS, here is some [doc with sample commands](https://www.sslshopper.com/ssl-converter.html)
+3. Trust CA on different OS:
+    - Windows: https://docs.microsoft.com/en-us/skype-sdk/sdn/articles/installing-the-trusted-root-certificate
+    - macOS: ![trust ca cert](./../res/macOStrustCA.gif)
+    - Linux: Refer to the distribution documentation
+      1. RedHat: https://www.redhat.com/sysadmin/ca-certificates-cli
+      2. Ubuntu: http://manpages.ubuntu.com/manpages/focal/man8/update-ca-certificates.8.html
+      3. Google search: "trust ca certificate on [linux distribution]"
+      4. If all approaches failed, set environment variable `SSL_CERT_FILE` to the CA bundle `.pem` file we get. 
+    > To verity cert gets installed properly on Linux, you can try use `curl -v https://sitewithsslissue.com` and `pwsh -Command \"Invoke-WebRequest -Uri https://sitewithsslissue.com\"`
+
+### Trust CA certificate for Git CLI
+
+Git uses various CA bundle file depends on your operation system.
+- Git packaged the CA bundle file within the Git installation on Windows 
+- Git use OpenSSL certificate CA bundle file on Linux and macOS
+
+You can check where Git check CA file by running:
+```bash
+export GIT_CURL_VERBOSE=1
+git ls-remote https://github.com/actions/runner HEAD
+```
+
+You should see something like:
+```
+* Couldn't find host github.com in the .netrc file; using defaults
+*   Trying 140.82.114.4...
+* TCP_NODELAY set
+* Connected to github.com (140.82.114.4) port 443 (#0)
+* ALPN, offering h2
+* ALPN, offering http/1.1
+* successfully set certificate verify locations:
+*   CAfile: /etc/ssl/cert.pem
+  CApath: none
+* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
+```
+This tells me `/etc/ssl/cert.pem` is where it read trusted CA certificates.
+
+To let Git trusts your CA certificate, you will need to:
+1. Save your SSL certificate chain which includes the root CA and all intermediate CAs into a `.pem` file.
+2. Set `http.sslCAInfo` Git config or `GIT_SSL_CAINFO` environment variable to the full path of the `.pem` file [Git Doc](https://git-scm.com/docs/git-config#Documentation/git-config.txt-httpsslCAInfo)
+> I would recommend using `http.sslCAInfo` since it can be scope to certain hosts that need the extra trusted CA.  
+> Ex: `git config --global http.https://myghes.com/.sslCAInfo /extra/ca/cert.pem`  
+> This will make Git use the `/extra/ca/cert.pem` only when communicates with `https://myghes.com` and keep using the default CA bundle with others.
+
+### Trust CA certificate for Node.js
+
+Node.js has compiled a snapshot of the Mozilla CA store that is fixed at each version of Node.js' release time.
+
+To let Node.js trusts your CA certificate, you will need to:
+1. Save your SSL certificate chain which includes the root CA and all intermediate CAs into a `.pem` file.
+2. Set environment variable `NODE_EXTRA_CA_CERTS` which point to the file. ex: `export NODE_EXTRA_CA_CERTS=/full/path/to/cacert.pem` or `set NODE_EXTRA_CA_CERTS=C:\full\path\to\cacert.pem`

docs/contribute.md

@@ -14,7 +14,7 @@ Issues in this repository should be for the runner application.  Note that the V
 
 We ask that before significant effort is put into code changes, that we have agreement on taking the change before time is invested in code changes. 
 
-1. Create a feature request.  Once agreed we will take the enhancment
+1. Create a feature request.  Once agreed we will take the enhancement
 2. Create an ADR to agree on the details of the change.
 
 An ADR is an Architectural Decision Record.  This allows consensus on the direction forward and also serves as a record of the change and motivation.  [Read more here](adrs/README.md)

docs/start/envlinux.md

@@ -15,16 +15,16 @@ x64
   - openSUSE 15+
   - SUSE Enterprise Linux (SLES) 12 SP2+
 
-## Install .Net Core 3.x Linux Dependencies
+## Install .Net Core 5 Linux Dependencies
 
-The `./config.sh` will check .Net Core 3.x dependencies during runner configuration.  
+The `./config.sh` will check .Net Core 5 dependencies during runner configuration.  
 You might see something like this which indicate a dependency's missing.
 ```bash
 ./config.sh
     libunwind.so.8 => not found
     libunwind-x86_64.so.8 => not found
-Dependencies is missing for Dotnet Core 3.0
-Execute ./bin/installdependencies.sh to install any missing Dotnet Core 3.0 dependencies.
+Dependencies is missing for Dotnet 5
+Execute ./bin/installdependencies.sh to install any missing Dotnet 5 dependencies.
 ```
 You can easily correct the problem by executing `./bin/installdependencies.sh`.  
 The `installdependencies.sh` script should install all required dependencies on all supported Linux versions   

releaseNote.md

@@ -1,11 +1,17 @@
 ## Features
-  - Allow registry credentials for job/service containers (#694) 
+  - Support config runner via GitHub PAT. (#874)
+  - Update runner to .NET 5 (#799)
+  - Add new ANDROID_SDK_ROOT environment variable (#892)
+  - Add warning when running out of disk. (#873)
+  - Always use FIPS Cryptography (#896)
+  - Add `--check` to run a serials network test against GitHub or GHES. (#900)
 
 ## Bugs
-  - N/A
+  - Ignore certain scenarios so they are not counted as infra failures (#889)
 
 ## Misc
-  - N/A
+  - Add runner e2e test workflow (#885)
+  - Add on: pull_request trigger to CodeQL workflow (#907)
 
 ## Windows x64
 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.

releaseVersion

@@ -1 +1 @@
-<Update to ./src/runnerversion when creating release>
+2.276.0

scripts/create-latest-svc.sh

@@ -12,12 +12,13 @@ set -e
 #
 # Usage:
 #     export RUNNER_CFG_PAT=<yourPAT>
-#     ./create-latest-svc scope [ghe_domain] [name] [user]
+#     ./create-latest-svc scope [ghe_domain] [name] [user] [labels]
 #
 #      scope       required  repo (:owner/:repo) or org (:organization)
 #      ghe_domain  optional  the fully qualified domain name of your GitHub Enterprise Server deployment
 #      name        optional  defaults to hostname
 #      user        optional  user svc will run as. defaults to current
+#      labels      optional  list of labels (split by comma) applied on the runner
 #
 # Notes:
 # PATS over envvars are more secure
@@ -30,6 +31,7 @@ runner_scope=${1}
 ghe_hostname=${2}
 runner_name=${3:-$(hostname)}
 svc_user=${4:-$USER}
+labels=${5}
 
 echo "Configuring runner @ ${runner_scope}"
 sudo echo
@@ -130,8 +132,8 @@ fi
 
 echo
 echo "Configuring ${runner_name} @ $runner_url"
-echo "./config.sh --unattended --url $runner_url --token *** --name $runner_name"
-sudo -E -u ${svc_user} ./config.sh --unattended --url $runner_url --token $RUNNER_TOKEN --name $runner_name
+echo "./config.sh --unattended --url $runner_url --token *** --name $runner_name --labels $labels"
+sudo -E -u ${svc_user} ./config.sh --unattended --url $runner_url --token $RUNNER_TOKEN --name $runner_name --labels $labels
 
 #---------------------------------------
 # Configuring as a service

src/.editorconfig

@@ -0,0 +1,10 @@
+[*.cs]
+charset = utf-8
+insert_final_newline = true
+
+csharp_new_line_before_else = true
+csharp_new_line_before_catch = true
+csharp_new_line_before_finally = true
+csharp_new_line_before_open_brace = all
+
+csharp_space_after_keywords_in_control_flow_statements = true

src/ActionsRunner.sln

@@ -1,4 +1,4 @@
-
+
 Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 16
 VisualStudioVersion = 16.0.29411.138
@@ -21,6 +21,11 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Sdk", "Sdk\Sdk.csproj", "{D
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Test", "Test\Test.csproj", "{C932061F-F6A1-4F1E-B854-A6C6B30DC3EF}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{EFB254FC-7927-445E-BA64-6676ADB309E9}"
+	ProjectSection(SolutionItems) = preProject
+		.editorconfig = .editorconfig
+	EndProjectSection
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU

src/Misc/dotnet-install.ps1

@@ -195,7 +195,7 @@ function Get-CLIArchitecture-From-Architecture([string]$Architecture) {
         { $_ -eq "x86" } { return "x86" }
         { $_ -eq "arm" } { return "arm" }
         { $_ -eq "arm64" } { return "arm64" }
-        default { throw "Architecture not supported. If you think this is a bug, report it at https://github.com/dotnet/sdk/issues" }
+        default { throw "Architecture '$Architecture' not supported. If you think this is a bug, report it at https://github.com/dotnet/install-scripts/issues" }
     }
 }
 
@@ -395,17 +395,20 @@ function Get-Specific-Version-From-Version([string]$AzureFeed, [string]$Channel,
 function Get-Download-Link([string]$AzureFeed, [string]$SpecificVersion, [string]$CLIArchitecture) {
     Say-Invocation $MyInvocation
 
+    # If anything fails in this lookup it will default to $SpecificVersion
+    $SpecificProductVersion = Get-Product-Version -AzureFeed $AzureFeed -SpecificVersion $SpecificVersion
+
     if ($Runtime -eq "dotnet") {
-        $PayloadURL = "$AzureFeed/Runtime/$SpecificVersion/dotnet-runtime-$SpecificVersion-win-$CLIArchitecture.zip"
+        $PayloadURL = "$AzureFeed/Runtime/$SpecificVersion/dotnet-runtime-$SpecificProductVersion-win-$CLIArchitecture.zip"
     }
     elseif ($Runtime -eq "aspnetcore") {
-        $PayloadURL = "$AzureFeed/aspnetcore/Runtime/$SpecificVersion/aspnetcore-runtime-$SpecificVersion-win-$CLIArchitecture.zip"
+        $PayloadURL = "$AzureFeed/aspnetcore/Runtime/$SpecificVersion/aspnetcore-runtime-$SpecificProductVersion-win-$CLIArchitecture.zip"
     }
     elseif ($Runtime -eq "windowsdesktop") {
-        $PayloadURL = "$AzureFeed/Runtime/$SpecificVersion/windowsdesktop-runtime-$SpecificVersion-win-$CLIArchitecture.zip"
+        $PayloadURL = "$AzureFeed/Runtime/$SpecificVersion/windowsdesktop-runtime-$SpecificProductVersion-win-$CLIArchitecture.zip"
     }
     elseif (-not $Runtime) {
-        $PayloadURL = "$AzureFeed/Sdk/$SpecificVersion/dotnet-sdk-$SpecificVersion-win-$CLIArchitecture.zip"
+        $PayloadURL = "$AzureFeed/Sdk/$SpecificVersion/dotnet-sdk-$SpecificProductVersion-win-$CLIArchitecture.zip"
     }
     else {
         throw "Invalid value for `$Runtime"
@@ -413,7 +416,7 @@ function Get-Download-Link([string]$AzureFeed, [string]$SpecificVersion, [string
 
     Say-Verbose "Constructed primary named payload URL: $PayloadURL"
 
-    return $PayloadURL
+    return $PayloadURL, $SpecificProductVersion
 }
 
 function Get-LegacyDownload-Link([string]$AzureFeed, [string]$SpecificVersion, [string]$CLIArchitecture) {
@@ -434,6 +437,51 @@ function Get-LegacyDownload-Link([string]$AzureFeed, [string]$SpecificVersion, [
     return $PayloadURL
 }
 
+function Get-Product-Version([string]$AzureFeed, [string]$SpecificVersion) {
+    Say-Invocation $MyInvocation
+
+    if ($Runtime -eq "dotnet") {
+        $ProductVersionTxtURL = "$AzureFeed/Runtime/$SpecificVersion/productVersion.txt"
+    }
+    elseif ($Runtime -eq "aspnetcore") {
+        $ProductVersionTxtURL = "$AzureFeed/aspnetcore/Runtime/$SpecificVersion/productVersion.txt"
+    }
+    elseif ($Runtime -eq "windowsdesktop") {
+        $ProductVersionTxtURL = "$AzureFeed/Runtime/$SpecificVersion/productVersion.txt"
+    }
+    elseif (-not $Runtime) {
+        $ProductVersionTxtURL = "$AzureFeed/Sdk/$SpecificVersion/productVersion.txt"
+    }
+    else {
+        throw "Invalid value '$Runtime' specified for `$Runtime"
+    }
+
+    Say-Verbose "Checking for existence of $ProductVersionTxtURL"
+
+    try {
+        $productVersionResponse = GetHTTPResponse($productVersionTxtUrl)
+
+        if ($productVersionResponse.StatusCode -eq 200) {
+            $productVersion = $productVersionResponse.Content.ReadAsStringAsync().Result.Trim()
+            if ($productVersion -ne $SpecificVersion)
+            {
+                Say "Using alternate version $productVersion found in $ProductVersionTxtURL"
+            }
+
+            return $productVersion
+        }
+        else {
+            Say-Verbose "Got StatusCode $($productVersionResponse.StatusCode) trying to get productVersion.txt at $productVersionTxtUrl, so using default value of $SpecificVersion"
+            $productVersion = $SpecificVersion
+        }
+    } catch {
+        Say-Verbose "Could not read productVersion.txt at $productVersionTxtUrl, so using default value of $SpecificVersion (Exception: '$($_.Exception.Message)' )"
+        $productVersion = $SpecificVersion
+    }
+
+    return $productVersion
+}
+
 function Get-User-Share-Path() {
     Say-Invocation $MyInvocation
 
@@ -587,9 +635,14 @@ function Prepend-Sdk-InstallRoot-To-Path([string]$InstallRoot, [string]$BinFolde
     }
 }
 
+Say "Note that the intended use of this script is for Continuous Integration (CI) scenarios, where:"
+Say "- The SDK needs to be installed without user interaction and without admin rights."
+Say "- The SDK installation doesn't need to persist across multiple CI runs."
+Say "To set up a development environment or to run apps, use installers rather than this script. Visit https://dotnet.microsoft.com/download to get the installer.`r`n"
+
 $CLIArchitecture = Get-CLIArchitecture-From-Architecture $Architecture
 $SpecificVersion = Get-Specific-Version-From-Version -AzureFeed $AzureFeed -Channel $Channel -Version $Version -JSonFile $JSonFile
-$DownloadLink = Get-Download-Link -AzureFeed $AzureFeed -SpecificVersion $SpecificVersion -CLIArchitecture $CLIArchitecture
+$DownloadLink, $EffectiveVersion = Get-Download-Link -AzureFeed $AzureFeed -SpecificVersion $SpecificVersion -CLIArchitecture $CLIArchitecture
 $LegacyDownloadLink = Get-LegacyDownload-Link -AzureFeed $AzureFeed -SpecificVersion $SpecificVersion -CLIArchitecture $CLIArchitecture
 
 $InstallRoot = Resolve-Installation-Path $InstallDir
@@ -615,6 +668,11 @@ if ($DryRun) {
         }
     }
     Say "Repeatable invocation: $RepeatableCommand"
+    if ($SpecificVersion -ne $EffectiveVersion)
+    {
+        Say "NOTE: Due to finding a version manifest with this runtime, it would actually install with version '$EffectiveVersion'"
+    }
+
     exit 0
 }
 
@@ -638,6 +696,12 @@ else {
     throw "Invalid value for `$Runtime"
 }
 
+if ($SpecificVersion -ne $EffectiveVersion)
+{
+   Say "Performing installation checks for effective version: $EffectiveVersion"
+   $SpecificVersion = $EffectiveVersion
+}
+
 #  Check if the SDK version is already installed.
 $isAssetInstalled = Is-Dotnet-Package-Installed -InstallRoot $InstallRoot -RelativePathToPackage $dotnetPackageRelativePath -SpecificVersion $SpecificVersion
 if ($isAssetInstalled) {
@@ -714,14 +778,15 @@ Remove-Item $ZipPath
 
 Prepend-Sdk-InstallRoot-To-Path -InstallRoot $InstallRoot -BinFolderRelativePath $BinFolderRelativePath
 
+Say "Note that the script does not resolve dependencies during installation."
+Say "To check the list of dependencies, go to https://docs.microsoft.com/dotnet/core/install/windows#dependencies"
 Say "Installation finished"
 exit 0
-
 # SIG # Begin signature block
 # MIIjlgYJKoZIhvcNAQcCoIIjhzCCI4MCAQExDzANBglghkgBZQMEAgEFADB5Bgor
 # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
-# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCXdb9pJ+MI1iFd
-# 2hUVOaNmZYt6e48+bQNJm9/Rbj3u3qCCDYUwggYDMIID66ADAgECAhMzAAABiK9S
+# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCA+isugNMwZSGLd
+# kfBd0C2Ud//U2Nbj31s1jg3Yf9gh4KCCDYUwggYDMIID66ADAgECAhMzAAABiK9S
 # 1rmSbej5AAAAAAGIMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
 # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
 # b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
@@ -798,50 +863,50 @@ exit 0
 # b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p
 # Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAAGIr1LWuZJt6PkAAAAA
 # AYgwDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw
-# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIM9C
-# NU8DMdIjlVSldghA1uP8Jf60AlCYNoHBHHW3pscjMEIGCisGAQQBgjcCAQwxNDAy
+# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIK4I
+# CDH7/r/eeMqTtDETJ67ogfneVRo0/P6ogV2vy4tXMEIGCisGAQQBgjcCAQwxNDAy
 # oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
-# b20wDQYJKoZIhvcNAQEBBQAEggEAFwdPmnUSAnwqMM8b4QthX44z3UnhPYm1EtjC
-# /PnpTA5xkFMaoOUhGdiR5tpGPWNgiNRqD5ZSL1JVUqUOpNfybZZqZPz/LnZdS1XB
-# +aj4Orh1Lkbaqq74PQxgRrUR3eyOVHcNTcohPNIb/ZYHqr6cwhqZitGuNEHNtqCk
-# lSRCrfiNlW8PNrpPvUWwIC1Fd+OpgRdGhKFIHTx31if1BH8omViGm4iFdlb5dGz3
-# ibeOm6FfXWwmKJVqVb/vhhemMel8tYNONTl2e+UjPOCy4f7myLiD61irA5T1a0vn
-# vcIV0dRSwh8U5h8JYOEJxn4nydVKlJ5UGMS8eQiKdd42CGs93KGCEvEwghLtBgor
+# b20wDQYJKoZIhvcNAQEBBQAEggEAOnmVmILEjI6ZiuuSOvvTvijidkBez61Vz97A
+# jV3AOsfmUvLpVaTVa1Mt2iPDuq1QLqRPaT7BD8PAUwr91pYllVgEd8NqivCIaCZg
+# QyIRiTmHQxbozWsLcjxMvX2VxSmNKDw7IOHzUbXtmiEGhygyZpdh/uiCj7ziSxp3
+# lQBR8mUE1NL9dxaxKWLhGeORqAepw6nId9oO+mHRh4JRK7uqZOFAES7/21M9vPZi
+# XYilJLgIoyMkvqYSdoouzn6+m74kgzkNkyK9GYz2mmO2BCMnai9Njze2d0+kY+37
+# kt10BmJDw3FHaZ+/fH/TMTgo0ZcAOicP9ccdIh/CzzpU52o+Q6GCEvEwghLtBgor
 # BgEEAYI3AwMBMYIS3TCCEtkGCSqGSIb3DQEHAqCCEsowghLGAgEDMQ8wDQYJYIZI
 # AWUDBAIBBQAwggFVBgsqhkiG9w0BCRABBKCCAUQEggFAMIIBPAIBAQYKKwYBBAGE
-# WQoDATAxMA0GCWCGSAFlAwQCAQUABCCVM7LRYercP7cfHmTrb7lPfKaZCdVbtga7
-# UOM/oLAsHgIGXxb9UghEGBMyMDIwMDgxMzEyMjIwNS40NjZaMASAAgH0oIHUpIHR
+# WQoDATAxMA0GCWCGSAFlAwQCAQUABCBSbhMJwNER+BICn3iLUnPrP8dptyUphcFC
+# A/NsIgnPLwIGX4hEzP6WGBMyMDIwMTEwOTE0NDY1Mi4yMzNaMASAAgH0oIHUpIHR
 # MIHOMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
 # UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQL
 # EyBNaWNyb3NvZnQgT3BlcmF0aW9ucyBQdWVydG8gUmljbzEmMCQGA1UECxMdVGhh
-# bGVzIFRTUyBFU046RjdBNi1FMjUxLTE1MEExJTAjBgNVBAMTHE1pY3Jvc29mdCBU
-# aW1lLVN0YW1wIFNlcnZpY2Wggg5EMIIE9TCCA92gAwIBAgITMwAAASWL3otsciYx
-# 3QAAAAABJTANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
+# bGVzIFRTUyBFU046MEE1Ni1FMzI5LTRENEQxJTAjBgNVBAMTHE1pY3Jvc29mdCBU
+# aW1lLVN0YW1wIFNlcnZpY2Wggg5EMIIE9TCCA92gAwIBAgITMwAAAScvbqPvkagZ
+# qAAAAAABJzANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMK
 # V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0
 # IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0Eg
-# MjAxMDAeFw0xOTEyMTkwMTE0NThaFw0yMTAzMTcwMTE0NThaMIHOMQswCQYDVQQG
+# MjAxMDAeFw0xOTEyMTkwMTE0NTlaFw0yMTAzMTcwMTE0NTlaMIHOMQswCQYDVQQG
 # EwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwG
 # A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQLEyBNaWNyb3NvZnQg
 # T3BlcmF0aW9ucyBQdWVydG8gUmljbzEmMCQGA1UECxMdVGhhbGVzIFRTUyBFU046
-# RjdBNi1FMjUxLTE1MEExJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNl
-# cnZpY2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQex9jdmBb7OHJ
-# wSYmMUorZNwAcv8Vy36TlJuzcVx7G+lFqt2zjWOMlSOMkm1XoAuJ8VZ5ShBedADX
-# DGDKxHNZhLu3EW8x5ot/IOk6izLTlAFtvIXOgzXs/HaOM72XHKykMZHAdL/fpZtA
-# SM5PalmsXX4Ol8lXkm9jR55K56C7q9+hDU+2tjGHaE1ZWlablNUXBhaZgtCJCd60
-# UyZvgI7/uNzcafj0/Vw2bait9nDAVd24yt/XCZnHY3yX7ZsHjIuHpsl+PpDXai1D
-# we9p0ryCZsl9SOMHextIHe9qlTbtWYJ8WtWLoH9dEMQxVLnmPPDOVmBj7LZhSji3
-# 8N9Vpz/FAgMBAAGjggEbMIIBFzAdBgNVHQ4EFgQU86rK5Qcm+QE5NBXGCPIiCBdD
-# JPgwHwYDVR0jBBgwFoAU1WM6XIoxkPNDe3xGG8UzaFqFbVUwVgYDVR0fBE8wTTBL
+# MEE1Ni1FMzI5LTRENEQxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNl
+# cnZpY2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQD4Ad5xEZ5On0uN
+# L71ng9xwoDPRKeMUyEIj5yVxPRPh5GVbU7D3pqDsoXzQMhfeRP61L1zlU1HCRS+1
+# 29eo0yj1zjbAlmPAwosUgyIonesWt9E4hFlXCGUcIg5XMdvQ+Ouzk2r+awNRuk8A
+# BGOa0I4VBy6zqCYHyX2pGauiB43frJSNP6pcrO0CBmpBZNjgepof5Z/50vBuJDUS
+# ug6OIMQ7ZwUhSzX4bEmZUUjAycBb62dhQpGqHsXe6ypVDTgAEnGONdSBKkHiNT8H
+# 0Zt2lm0vCLwHyTwtgIdi67T/LCp+X2mlPHqXsY3u72X3GYn/3G8YFCkrSc6m3b0w
+# TXPd5/2fAgMBAAGjggEbMIIBFzAdBgNVHQ4EFgQU5fSWVYBfOTEkW2JTiV24WNNt
+# lfIwHwYDVR0jBBgwFoAU1WM6XIoxkPNDe3xGG8UzaFqFbVUwVgYDVR0fBE8wTTBL
 # oEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv
 # TWljVGltU3RhUENBXzIwMTAtMDctMDEuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggr
 # BgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNU
 # aW1TdGFQQ0FfMjAxMC0wNy0wMS5jcnQwDAYDVR0TAQH/BAIwADATBgNVHSUEDDAK
-# BggrBgEFBQcDCDANBgkqhkiG9w0BAQsFAAOCAQEAkxxZPGEgIgAhsqZNTZk58V1v
-# QiJ5ja2xHl5TqGA6Hwj5SioLg3FSLiTmGV+BtFlpYUtkneB4jrZsuNpMtfbTMdG7
-# p/xAyIVtwvXnTXqKlCD1T9Lcr94pVedzHGJzL1TYNQyZJBouCfzkgkzccOuFOfeW
-# PfnMTiI5UBW5OdmoyHPQWDSGHoboW1dTKqXeJtuVDTYbHTKs4zjfCBMFjmylRu52
-# Zpiz+9MBeRj4iAeou0F/3xvIzepoIKgUWCZ9mmViWEkVwCtTGbV8eK73KeEE0tfM
-# U/YY2UmoGPc8YwburDEfelegLW+YHkfrcGAGlftCmqtOdOLeghLoG0Ubx/B7sTCC
+# BggrBgEFBQcDCDANBgkqhkiG9w0BAQsFAAOCAQEACsqNfNFVxwalZ42cEMuzZc12
+# 6Nvluanx8UewDVeUQZEZHRmppMFHAzS/g6RzmxTyR2tKE3mChNGW5dTL730vEbRh
+# nYRmBgiX/gT3f4AQrOPnZGXY7zszcrlbgzxpakOX+x0u4rkP3Ashh3B2CdJ11XsB
+# di5PiZa1spB6U5S8D15gqTUfoIniLT4v1DBdkWExsKI1vsiFcDcjGJ4xRlMRF+fw
+# 7SY0WZoOzwRzKxDTdg4DusAXpaeKbch9iithLFk/vIxQrqCr/niW8tEA+eSzeX/E
+# q1D0ZyvOn4e2lTnwoJUKH6OQAWSBogyK4OCbFeJOqdKAUiBTgHKkQIYh/tbKQjCC
 # BnEwggRZoAMCAQICCmEJgSoAAAAAAAIwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNV
 # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w
 # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29m
@@ -880,32 +945,32 @@ exit 0
 # VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe
 # MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSkwJwYDVQQLEyBNaWNyb3Nv
 # ZnQgT3BlcmF0aW9ucyBQdWVydG8gUmljbzEmMCQGA1UECxMdVGhhbGVzIFRTUyBF
-# U046RjdBNi1FMjUxLTE1MEExJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1w
-# IFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVAEXTL+FQbc2G+3MXXvIRKVr2oXCnoIGD
+# U046MEE1Ni1FMzI5LTRENEQxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1w
+# IFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVALOVuE5sgxzETO4s+poBqI6r1x8zoIGD
 # MIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV
 # BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQG
 # A1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwDQYJKoZIhvcNAQEF
-# BQACBQDi3yR1MCIYDzIwMjAwODEzMDYzMTE3WhgPMjAyMDA4MTQwNjMxMTdaMHcw
-# PQYKKwYBBAGEWQoEATEvMC0wCgIFAOLfJHUCAQAwCgIBAAICKbYCAf8wBwIBAAIC
-# EkQwCgIFAOLgdfUCAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAK
-# MAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQBI2hPSmSPK
-# XurK36pE46s0uBEW23aGxotfubZR3iQCxDZ+dcZEN83t2JE4wh4a9HGpzXta/1Yz
-# fgoIxgsI5wogRQF20sCD7x7ZTbpMweqxFCQSGRE8Z2B0FmntXXrEvQtS1ee0PC/1
-# +eD7oAsVwmsSWdQHKfOVBqz51g2S+ImuzTGCAw0wggMJAgEBMIGTMHwxCzAJBgNV
+# BQACBQDjU7byMCIYDzIwMjAxMTA5MTYzOTE0WhgPMjAyMDExMTAxNjM5MTRaMHcw
+# PQYKKwYBBAGEWQoEATEvMC0wCgIFAONTtvICAQAwCgIBAAICIt0CAf8wBwIBAAIC
+# EcQwCgIFAONVCHICAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYBBAGEWQoDAqAK
+# MAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOBgQAQhyIIAC/A
+# P+VJdbhL9IQgm8WTa1DmPPE+BQSuRbBy2MmzC1KostixdEkr2OaNSjcYuZBNIJgv
+# vE8CWhVDD+sbBpVcOdoSfoBwHXKfvqSTiWvovoexkF0X5aon7yr3PkJ/kEqoLyUM
+# xRvdWKJdHOL1sT0/aWHn048c6aGin/zc8DGCAw0wggMJAgEBMIGTMHwxCzAJBgNV
 # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w
 # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m
-# dCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABJYvei2xyJjHdAAAAAAElMA0GCWCG
+# dCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABJy9uo++RqBmoAAAAAAEnMA0GCWCG
 # SAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwLwYJKoZI
-# hvcNAQkEMSIEIJICFqJn2Gtkce4xbJqSJCqpNLdz4fjym2OW0Ac8zI+nMIH6Bgsq
-# hkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgXd/Gsi5vMF/6iX2CDh+VfmL5RvqaFkFw
-# luiyje9B9w4wgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu
+# hvcNAQkEMSIEIJZkrbvF4R8oqYYpN6ZPGOj+QEZTQriEi/Yw9gW6zMqRMIH6Bgsq
+# hkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgG5LoSxKGHWoW/wVMlbMztlQ4upAdzEmq
+# H//vLu0jPiIwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGlu
 # Z3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv
 # cmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAIT
-# MwAAASWL3otsciYx3QAAAAABJTAiBCBSjc2CBOdr7iaTswYVN8f7KwiN5s4uBEO+
-# JVI8WLhgFzANBgkqhkiG9w0BAQsFAASCAQCfsvzXMzAN1kylt4eAKSH4ryFIJqBH
-# O7jcx7iIA9X6OPTuUmBniZGf2fmFG61V4HlmRgGOXuisJdpU3kiC7EZyFX6ZJoIj
-# kgvCQf4BPu/cLtn2w6odZ68OrTHs7BfBKBr6eQKKcZ/kgRSsjMNinh8tHPlrxE63
-# Zha3mUFfsnX5bi+F4VPhluGvRuA7q3IqMzfA/dTxON9WH5L+t3TwW61VebBaSPkT
-# YevYlj0TTlCw1B3zk0ztU37uulqDi4rFr67VaoR3qrhL/xZ/DsaNXg1V/RXqQRrw
-# eCag1OFRASAQOUOlWSi0QtYgUDl5FKKzxaJTEd946+6mJIkNXZB3nmA1
+# MwAAAScvbqPvkagZqAAAAAABJzAiBCDwhEViCRvqKwQV3MxociF2iGYrDP4p1BK+
+# s4tStO4vSDANBgkqhkiG9w0BAQsFAASCAQAkgmDo8lVmar0ZIqTG1it3skG8PZC9
+# iqEEC1vxcz8OSfsjl2QSkQ5T2+3xWpxWA4uy2+Byv0bi8EsfQEnnn4vtdthS6/kb
+# vB/LLQiqoMhJ0rasf3/y/4KnQZEtztpg1+cCaNwFUgI6o+E8YEFt1frhLwFs/0WH
+# 5pyBFx9ECEs0M22SLIpW13gexv9fgk6ZboIfSreAI28DLveeJpkgwggxHRpuVOVD
+# 4D7QQJAvJ0VU6p+yJlbvQXR9iltwb1REhlsJ5mADJ/FkzPVX/swMSUIoyE2inlxK
+# LEiPkkZYwiFYCifFYUTnQjWU1Ls0EV+ysosL+jhzCxO8S6oRdp5TAi4F
 # SIG # End signature block

src/Misc/dotnet-install.sh

@@ -241,42 +241,6 @@ check_min_reqs() {
     return 0
 }
 
-check_pre_reqs() {
-    eval $invocation
-
-    if [ "${DOTNET_INSTALL_SKIP_PREREQS:-}" = "1" ]; then
-        return 0
-    fi
-
-    if [ "$(uname)" = "Linux" ]; then
-        if is_musl_based_distro; then
-            if ! command -v scanelf > /dev/null; then
-                say_warning "scanelf not found, please install pax-utils package."
-                return 0
-            fi
-            LDCONFIG_COMMAND="scanelf --ldpath -BF '%f'"
-            [ -z "$($LDCONFIG_COMMAND 2>/dev/null | grep libintl)" ] && say_warning "Unable to locate libintl. Probable prerequisite missing; install libintl (or gettext)."
-        else
-            if [ ! -x "$(command -v ldconfig)" ]; then
-                say_verbose "ldconfig is not in PATH, trying /sbin/ldconfig."
-                LDCONFIG_COMMAND="/sbin/ldconfig"
-            else
-                LDCONFIG_COMMAND="ldconfig"
-            fi
-            local librarypath=${LD_LIBRARY_PATH:-}
-            LDCONFIG_COMMAND="$LDCONFIG_COMMAND -NXv ${librarypath//:/ }"
-        fi
-
-        [ -z "$($LDCONFIG_COMMAND 2>/dev/null | grep zlib)" ] && say_warning "Unable to locate zlib. Probable prerequisite missing; install zlib."
-        [ -z "$($LDCONFIG_COMMAND 2>/dev/null | grep ssl)" ] && say_warning "Unable to locate libssl. Probable prerequisite missing; install libssl."
-        [ -z "$($LDCONFIG_COMMAND 2>/dev/null | grep libicu)" ] && say_warning "Unable to locate libicu. Probable prerequisite missing; install libicu."
-        [ -z "$($LDCONFIG_COMMAND 2>/dev/null | grep lttng)" ] && say_warning "Unable to locate liblttng. Probable prerequisite missing; install libcurl."
-        [ -z "$($LDCONFIG_COMMAND 2>/dev/null | grep libcurl)" ] && say_warning "Unable to locate libcurl. Probable prerequisite missing; install libcurl."
-    fi
-
-    return 0
-}
-
 # args:
 # input - $1
 to_lowercase() {
@@ -373,7 +337,7 @@ get_normalized_architecture_from_architecture() {
             ;;
     esac
 
-    say_err "Architecture \`$architecture\` not supported. If you think this is a bug, report it at https://github.com/dotnet/sdk/issues"
+    say_err "Architecture \`$architecture\` not supported. If you think this is a bug, report it at https://github.com/dotnet/install-scripts/issues"
     return 1
 }
 
@@ -468,7 +432,6 @@ parse_jsonfile_for_version() {
     sdk_list=$(echo $sdk_section | awk -F"[{}]" '{print $2}')
     sdk_list=${sdk_list//[\" ]/}
     sdk_list=${sdk_list//,/$'\n'}
-    sdk_list="$(echo -e "${sdk_list}" | tr -d '[[:space:]]')"
 
     local version_info=""
     while read -r line; do
@@ -545,17 +508,18 @@ construct_download_link() {
     local channel="$2"
     local normalized_architecture="$3"
     local specific_version="${4//[$'\t\r\n']}"
+    local specific_product_version="$(get_specific_product_version "$1" "$4")"
 
     local osname
     osname="$(get_current_os_name)" || return 1
 
     local download_link=null
     if [[ "$runtime" == "dotnet" ]]; then
-        download_link="$azure_feed/Runtime/$specific_version/dotnet-runtime-$specific_version-$osname-$normalized_architecture.tar.gz"
+        download_link="$azure_feed/Runtime/$specific_version/dotnet-runtime-$specific_product_version-$osname-$normalized_architecture.tar.gz"
     elif [[ "$runtime" == "aspnetcore" ]]; then
-        download_link="$azure_feed/aspnetcore/Runtime/$specific_version/aspnetcore-runtime-$specific_version-$osname-$normalized_architecture.tar.gz"
+        download_link="$azure_feed/aspnetcore/Runtime/$specific_version/aspnetcore-runtime-$specific_product_version-$osname-$normalized_architecture.tar.gz"
     elif [ -z "$runtime" ]; then
-        download_link="$azure_feed/Sdk/$specific_version/dotnet-sdk-$specific_version-$osname-$normalized_architecture.tar.gz"
+        download_link="$azure_feed/Sdk/$specific_version/dotnet-sdk-$specific_product_version-$osname-$normalized_architecture.tar.gz"
     else
         return 1
     fi
@@ -564,6 +528,50 @@ construct_download_link() {
     return 0
 }
 
+# args:
+# azure_feed - $1
+# specific_version - $2
+get_specific_product_version() {
+    # If we find a 'productVersion.txt' at the root of any folder, we'll use its contents 
+    # to resolve the version of what's in the folder, superseding the specified version.
+    eval $invocation
+
+    local azure_feed="$1"
+    local specific_version="${2//[$'\t\r\n']}"
+    local specific_product_version=$specific_version
+
+    local download_link=null
+    if [[ "$runtime" == "dotnet" ]]; then
+        download_link="$azure_feed/Runtime/$specific_version/productVersion.txt${feed_credential}"
+    elif [[ "$runtime" == "aspnetcore" ]]; then
+        download_link="$azure_feed/aspnetcore/Runtime/$specific_version/productVersion.txt${feed_credential}"
+    elif [ -z "$runtime" ]; then
+        download_link="$azure_feed/Sdk/$specific_version/productVersion.txt${feed_credential}"
+    else
+        return 1
+    fi
+
+    if machine_has "curl"
+    then
+        specific_product_version=$(curl -s --fail "$download_link")
+        if [ $? -ne 0 ]
+        then
+            specific_product_version=$specific_version
+        fi
+    elif machine_has "wget"
+    then
+        specific_product_version=$(wget -qO- "$download_link")
+        if [ $? -ne 0 ]
+        then
+            specific_product_version=$specific_version
+        fi
+    fi
+    specific_product_version="${specific_product_version//[$'\t\r\n']}"
+
+    echo "$specific_product_version"
+    return 0
+}
+
 # args:
 # azure_feed - $1
 # channel - $2
@@ -771,6 +779,7 @@ calculate_vars() {
     say_verbose "normalized_architecture=$normalized_architecture"
 
     specific_version="$(get_specific_version_from_version "$azure_feed" "$channel" "$normalized_architecture" "$version" "$json_file")"
+    specific_product_version="$(get_specific_product_version "$azure_feed" "$specific_version")"
     say_verbose "specific_version=$specific_version"
     if [ -z "$specific_version" ]; then
         say_err "Could not resolve version information."
@@ -869,12 +878,12 @@ install_dotnet() {
     fi
 
     #  Check if the standard SDK version is installed.
-    say_verbose "Checking installation: version = $specific_version"
-    if is_dotnet_package_installed "$install_root" "$asset_relative_path" "$specific_version"; then
+    say_verbose "Checking installation: version = $specific_product_version"
+    if is_dotnet_package_installed "$install_root" "$asset_relative_path" "$specific_product_version"; then
         return 0
     fi
 
-    say_err "\`$asset_name\` with version = $specific_version failed to install with an unknown error."
+    say_err "\`$asset_name\` with version = $specific_product_version failed to install with an unknown error."
     return 1
 }
 
@@ -1058,6 +1067,11 @@ if [ "$no_cdn" = true ]; then
     azure_feed="$uncached_feed"
 fi
 
+say "Note that the intended use of this script is for Continuous Integration (CI) scenarios, where:"
+say "- The SDK needs to be installed without user interaction and without admin rights."
+say "- The SDK installation doesn't need to persist across multiple CI runs."
+say "To set up a development environment or to run apps, use installers rather than this script. Visit https://dotnet.microsoft.com/download to get the installer.\n"
+
 check_min_reqs
 calculate_vars
 script_name=$(basename "$0")
@@ -1079,7 +1093,6 @@ if [ "$dry_run" = true ]; then
     exit 0
 fi
 
-check_pre_reqs
 install_dotnet
 
 bin_path="$(get_absolute_path "$(combine_paths "$install_root" "$bin_folder_relative_path")")"
@@ -1090,4 +1103,6 @@ else
     say "Binaries of dotnet can be found in $bin_path"
 fi
 
+say "Note that the script does not resolve dependencies during installation."
+say "To check the list of dependencies, go to https://docs.microsoft.com/dotnet/core/install, select your operating system and check the \"Dependencies\" section."
 say "Installation finished successfully."

src/Misc/expressionFunc/hashFiles/package-lock.json

@@ -5,9 +5,9 @@
   "requires": true,
   "dependencies": {
     "@actions/core": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.0.tgz",
-      "integrity": "sha512-ZKdyhlSlyz38S6YFfPnyNgCDZuAF2T0Qv5eHflNWytPS8Qjvz39bZFMry9Bb/dpSnqWcNeav5yM2CTYpJeY+Dw=="
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
+      "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
     },
     "@actions/glob": {
       "version": "0.1.0",

src/Misc/layoutbin/checkScripts/downloadCert.js

@@ -0,0 +1,115 @@
+const https = require('https')
+const fs = require('fs')
+const http = require('http')
+const hostname = process.env['HOSTNAME'] || ''
+const port = process.env['PORT'] || ''
+const path = process.env['PATH'] || ''
+const pat = process.env['PAT'] || ''
+const proxyHost = process.env['PROXYHOST'] || ''
+const proxyPort = process.env['PROXYPORT'] || ''
+const proxyUsername = process.env['PROXYUSERNAME'] || ''
+const proxyPassword = process.env['PROXYPASSWORD'] || ''
+
+process.env['NODE_TLS_REJECT_UNAUTHORIZED'] = '0'
+
+if (proxyHost === '') {
+    const options = {
+        hostname: hostname,
+        port: port,
+        path: path,
+        method: 'GET',
+        headers: {
+            'User-Agent': 'GitHubActionsRunnerCheck/1.0',
+            'Authorization': `token ${pat}`
+        },
+    }
+    const req = https.request(options, res => {
+        console.log(`statusCode: ${res.statusCode}`)
+        console.log(`headers: ${JSON.stringify(res.headers)}`)
+        let cert = socket.getPeerCertificate(true)
+        let certPEM = ''
+        let fingerprints = {}
+        while (cert != null && fingerprints[cert.fingerprint] != '1') {
+            fingerprints[cert.fingerprint] = '1'
+            certPEM = certPEM + '-----BEGIN CERTIFICATE-----\n'
+            let certEncoded = cert.raw.toString('base64')
+            for (let i = 0; i < certEncoded.length; i++) {
+                certPEM = certPEM + certEncoded[i]
+                if (i != certEncoded.length - 1 && (i + 1) % 64 == 0) {
+                    certPEM = certPEM + '\n'
+                }
+            }
+            certPEM = certPEM + '\n-----END CERTIFICATE-----\n'
+            cert = cert.issuerCertificate
+        }
+        console.log(certPEM)
+        fs.writeFileSync('./download_ca_cert.pem', certPEM)
+        res.on('data', d => {
+            process.stdout.write(d)
+        })
+    })
+    req.on('error', error => {
+        console.error(error)
+    })
+    req.end()
+}
+else {
+    const auth = 'Basic ' + Buffer.from(proxyUsername + ':' + proxyPassword).toString('base64')
+
+    const options = {
+        host: proxyHost,
+        port: proxyPort,
+        method: 'CONNECT',
+        path: `${hostname}:${port}`,
+    }
+
+    if (proxyUsername != '' || proxyPassword != '') {
+        options.headers = {
+            'Proxy-Authorization': auth,
+        }
+    }
+
+    http.request(options).on('connect', (res, socket) => {
+        if (res.statusCode != 200) {
+            throw new Error(`Proxy returns code: ${res.statusCode}`)
+        }
+
+        https.get({
+            host: hostname,
+            port: port,
+            socket: socket,
+            agent: false,
+            path: '/',
+            headers: {
+                'User-Agent': 'GitHubActionsRunnerCheck/1.0',
+                'Authorization': `token ${pat}`
+            }
+        }, (res) => {
+            let cert = res.socket.getPeerCertificate(true)
+            let certPEM = ''
+            let fingerprints = {}
+            while (cert != null && fingerprints[cert.fingerprint] != '1') {
+                fingerprints[cert.fingerprint] = '1'
+                certPEM = certPEM + '-----BEGIN CERTIFICATE-----\n'
+                let certEncoded = cert.raw.toString('base64')
+                for (let i = 0; i < certEncoded.length; i++) {
+                    certPEM = certPEM + certEncoded[i]
+                    if (i != certEncoded.length - 1 && (i + 1) % 64 == 0) {
+                        certPEM = certPEM + '\n'
+                    }
+                }
+                certPEM = certPEM + '\n-----END CERTIFICATE-----\n'
+                cert = cert.issuerCertificate
+            }
+            console.log(certPEM)
+            fs.writeFileSync('./download_ca_cert.pem', certPEM)
+            console.log(`statusCode: ${res.statusCode}`)
+            console.log(`headers: ${JSON.stringify(res.headers)}`)
+            res.on('data', d => {
+                process.stdout.write(d)
+            })
+        })
+    }).on('error', (err) => {
+        console.error('error', err)
+    }).end()
+}

src/Misc/layoutbin/checkScripts/makeWebRequest.js

@@ -0,0 +1,75 @@
+const https = require('https')
+const http = require('http')
+const hostname = process.env['HOSTNAME'] || ''
+const port = process.env['PORT'] || ''
+const path = process.env['PATH'] || ''
+const pat = process.env['PAT'] || ''
+const proxyHost = process.env['PROXYHOST'] || ''
+const proxyPort = process.env['PROXYPORT'] || ''
+const proxyUsername = process.env['PROXYUSERNAME'] || ''
+const proxyPassword = process.env['PROXYPASSWORD'] || ''
+
+if (proxyHost === '') {
+    const options = {
+        hostname: hostname,
+        port: port,
+        path: path,
+        method: 'GET',
+        headers: {
+            'User-Agent': 'GitHubActionsRunnerCheck/1.0',
+            'Authorization': `token ${pat}`,
+        }
+    }
+    const req = https.request(options, res => {
+        console.log(`statusCode: ${res.statusCode}`)
+        console.log(`headers: ${JSON.stringify(res.headers)}`)
+
+        res.on('data', d => {
+            process.stdout.write(d)
+        })
+    })
+    req.on('error', error => {
+        console.error(error)
+    })
+    req.end()
+}
+else {
+    const proxyAuth = 'Basic ' + Buffer.from(proxyUsername + ':' + proxyPassword).toString('base64')
+    const options = {
+        hostname: proxyHost,
+        port: proxyPort,
+        method: 'CONNECT',
+        path: `${hostname}:${port}`
+    }
+
+    if (proxyUsername != '' || proxyPassword != '') {
+        options.headers = {
+            'Proxy-Authorization': proxyAuth,
+        }
+    }
+    http.request(options).on('connect', (res, socket) => {
+        if (res.statusCode != 200) {
+            throw new Error(`Proxy returns code: ${res.statusCode}`)
+        }
+        https.get({
+            host: hostname,
+            port: port,
+            socket: socket,
+            agent: false,
+            path: path,
+            headers: {
+                'User-Agent': 'GitHubActionsRunnerCheck/1.0',
+                'Authorization': `token ${pat}`,
+            }
+        }, (res) => {
+            console.log(`statusCode: ${res.statusCode}`)
+            console.log(`headers: ${JSON.stringify(res.headers)}`)
+
+            res.on('data', d => {
+                process.stdout.write(d)
+            })
+        })
+    }).on('error', (err) => {
+        console.error('error', err)
+    }).end()
+}

src/Misc/layoutbin/installdependencies.sh

@@ -14,14 +14,14 @@ fi
 
 function print_errormessage() 
 {
-    echo "Can't install dotnet core dependencies."
+    echo "Can't install dotnet 5 dependencies."
     echo "You can manually install all required dependencies based on following documentation"
     echo "https://docs.microsoft.com/en-us/dotnet/core/linux-prerequisites?tabs=netcore2x"
 }
 
 function print_rhel6message() 
 {
-    echo "We did our best effort to install dotnet core dependencies"
+    echo "We did our best effort to install dotnet 5 dependencies"
     echo "However, there are some dependencies which require manual installation" 
     echo "You can install all remaining required dependencies based on the following documentation"
     echo "https://github.com/dotnet/core/blob/master/Documentation/build-and-install-rhel6-prerequisites.md"
@@ -29,7 +29,7 @@ function print_rhel6message()
 
 function print_rhel6errormessage() 
 {
-    echo "We couldn't install dotnet core dependencies"
+    echo "We couldn't install dotnet 5 dependencies"
     echo "You can manually install all required dependencies based on following documentation"
     echo "https://docs.microsoft.com/en-us/dotnet/core/linux-prerequisites?tabs=netcore2x"
     echo "In addition, there are some dependencies which require manual installation. Please follow this documentation" 
@@ -49,70 +49,68 @@ then
         cat /etc/debian_version
         echo "------------------------------"
         
-        # prefer apt over apt-get        
-        command -v apt
-        if [ $? -eq 0 ]
-        then
-            apt update && apt install -y liblttng-ust0 libkrb5-3 zlib1g
-            if [ $? -ne 0 ]
-            then
-                echo "'apt' failed with exit code '$?'"
-                print_errormessage
-                exit 1
-            fi
-
-            # libissl version prefer: libssl1.1 -> libssl1.0.2 -> libssl1.0.0
-            apt install -y libssl1.1$ || apt install -y libssl1.0.2$ || apt install -y libssl1.0.0$
-            if [ $? -ne 0 ]
-            then
-                echo "'apt' failed with exit code '$?'"
-                print_errormessage
-                exit 1
-            fi
-
-            # libicu version prefer: libicu66 -> libicu63 -> libicu60 -> libicu57 -> libicu55 -> libicu52
-            apt install -y libicu66 || apt install -y libicu63 || apt install -y libicu60 || apt install -y libicu57 || apt install -y libicu55 || apt install -y libicu52
-            if [ $? -ne 0 ]
-            then
-                echo "'apt' failed with exit code '$?'"
-                print_errormessage
-                exit 1
-            fi
-        else
+        # prefer apt-get over apt
         command -v apt-get
         if [ $? -eq 0 ]
         then
-                apt-get update && apt-get install -y liblttng-ust0 libkrb5-3 zlib1g
+            apt_get=apt-get
+        else
+            command -v apt
+            if [ $? -eq 0 ]
+            then
+                apt_get=apt
+            else
+                echo "Found neither 'apt-get' nor 'apt'"
+                print_errormessage
+                exit 1
+            fi
+        fi
+
+        $apt_get update && $apt_get install -y liblttng-ust0 libkrb5-3 zlib1g
         if [ $? -ne 0 ]
         then
-                    echo "'apt-get' failed with exit code '$?'"
+            echo "'$apt_get' failed with exit code '$?'"
             print_errormessage
             exit 1
         fi
 
-                # libissl version prefer: libssl1.1 -> libssl1.0.2 -> libssl1.0.0
-                apt-get install -y libssl1.1$ || apt-get install -y libssl1.0.2$ || apt install -y libssl1.0.0$
+        apt_get_with_fallbacks() {
+            $apt_get install -y $1
+            fail=$?
+            if [ $fail -eq 0 ]
+            then
+                if [ "${1#"${1%?}"}" = '$' ]; then
+                    dpkg -l "${1%?}" > /dev/null 2> /dev/null
+                    fail=$?
+                fi
+            fi
+            if [ $fail -ne 0 ]
+            then
+                shift
+                if [ -n "$1" ]
+                then
+                    apt_get_with_fallbacks "$@"
+                fi
+            fi
+        }
+
+        # libssl version prefer: libssl1.1 -> libssl1.0.2 -> libssl1.0.0
+        apt_get_with_fallbacks libssl1.1$ libssl1.0.2$ libssl1.0.0$
         if [ $? -ne 0 ]
         then
-                    echo "'apt-get' failed with exit code '$?'"
+            echo "'$apt_get' failed with exit code '$?'"
             print_errormessage
             exit 1
         fi
 
         # libicu version prefer: libicu66 -> libicu63 -> libicu60 -> libicu57 -> libicu55 -> libicu52
-                apt-get install -y libicu66 || apt-get install -y libicu63 || apt-get install -y libicu60 || apt install -y libicu57 || apt install -y libicu55 || apt install -y libicu52
+        apt_get_with_fallbacks libicu66 libicu63 libicu60 libicu57 libicu55 libicu52
         if [ $? -ne 0 ]
         then
-                    echo "'apt-get' failed with exit code '$?'"
+            echo "'$apt_get' failed with exit code '$?'"
             print_errormessage
             exit 1
         fi
-            else
-                echo "Can not find 'apt' or 'apt-get'"
-                print_errormessage
-                exit 1
-            fi
-        fi
     elif [ -e /etc/redhat-release ]
     then
         echo "The current OS is Fedora based"

src/Misc/layoutbin/update.sh.template

@@ -28,13 +28,13 @@ date "+[%F %T-%4N] Waiting for $runnerprocessname ($runnerpid) to complete" >> "
 while [ -e /proc/$runnerpid ]
 do
     date "+[%F %T-%4N] Process $runnerpid still running" >> "$logfile" 2>&1
-    ping -c 2 127.0.0.1 >nul
+    sleep 2
 done
 date "+[%F %T-%4N] Process $runnerpid finished running" >> "$logfile" 2>&1
 
 # start re-organize folders
 date "+[%F %T-%4N] Sleep 1 more second to make sure process exited" >> "$logfile" 2>&1
-ping -c 2 127.0.0.1 >nul
+sleep 1
 
 # the folder structure under runner root will be
 # ./bin -> bin.2.100.0 (junction folder)

src/Misc/layoutroot/config.sh

@@ -8,7 +8,7 @@ if [ $user_id -eq 0 -a -z "$RUNNER_ALLOW_RUNASROOT" ]; then
     exit 1
 fi
 
-# Check dotnet core 3.0 dependencies for Linux
+# Check dotnet 5 dependencies for Linux
 if [[ (`uname` == "Linux") ]]
 then
     command -v ldd > /dev/null
@@ -18,24 +18,26 @@ then
         exit 1
     fi
 
+    message="Execute sudo ./bin/installdependencies.sh to install any missing Dotnet 5 dependencies."
+
     ldd ./bin/libcoreclr.so | grep 'not found'
     if [ $? -eq 0 ]; then
-        echo "Dependencies is missing for Dotnet Core 3.0"
-        echo "Execute ./bin/installdependencies.sh to install any missing Dotnet Core 3.0 dependencies."
+        echo "Dependencies is missing for Dotnet 5"
+        echo $message
         exit 1
     fi
 
-    ldd ./bin/System.Security.Cryptography.Native.OpenSsl.so | grep 'not found'
+    ldd ./bin/libSystem.Security.Cryptography.Native.OpenSsl.so | grep 'not found'
     if [ $? -eq 0 ]; then
-        echo "Dependencies is missing for Dotnet Core 3.0"
-        echo "Execute ./bin/installdependencies.sh to install any missing Dotnet Core 3.0 dependencies."
+        echo "Dependencies is missing for Dotnet 5"
+        echo $message
         exit 1
     fi
 
-    ldd ./bin/System.IO.Compression.Native.so | grep 'not found'
+    ldd ./bin/libSystem.IO.Compression.Native.so | grep 'not found'
     if [ $? -eq 0 ]; then
-        echo "Dependencies is missing for Dotnet Core 3.0"
-        echo "Execute ./bin/installdependencies.sh to install any missing Dotnet Core 3.0 dependencies."
+        echo "Dependencies is missing for Dotnet 5"
+        echo $message
         exit 1
     fi
 
@@ -50,10 +52,10 @@ then
     fi
 
     libpath=${LD_LIBRARY_PATH:-}
-    $LDCONFIG_COMMAND -NXv ${libpath//:/} 2>&1 | grep libicu >/dev/null 2>&1
+    $LDCONFIG_COMMAND -NXv ${libpath//:/ } 2>&1 | grep libicu >/dev/null 2>&1
     if [ $? -ne 0 ]; then
-        echo "Libicu's dependencies is missing for Dotnet Core 3.0"
-        echo "Execute ./bin/installdependencies.sh to install any missing Dotnet Core 3.0 dependencies."
+        echo "Libicu's dependencies is missing for Dotnet 5"
+        echo $message
         exit 1
     fi
 fi

src/Misc/layoutroot/env.sh

@@ -6,6 +6,7 @@ varCheckList=(
     'ANT_HOME' 
     'M2_HOME' 
     'ANDROID_HOME' 
+    'ANDROID_SDK_ROOT'
     'GRADLE_HOME' 
     'NVM_BIN' 
     'NVM_PATH'

src/Runner.Common/Constants.cs

@@ -99,9 +99,11 @@ namespace GitHub.Runner.Common
 
                     // Secret args. Must be added to the "Secrets" getter as well.
                     public static readonly string Token = "token";
+                    public static readonly string PAT = "pat";
                     public static readonly string WindowsLogonPassword = "windowslogonpassword";
                     public static string[] Secrets => new[]
                     {
+                        PAT,
                         Token,
                         WindowsLogonPassword,
                     };
@@ -119,6 +121,7 @@ namespace GitHub.Runner.Common
                 //validFlags array as well present in the CommandSettings.cs
                 public static class Flags
                 {
+                    public static readonly string Check = "check";
                     public static readonly string Commit = "commit";
                     public static readonly string Help = "help";
                     public static readonly string Replace = "replace";
@@ -138,8 +141,16 @@ namespace GitHub.Runner.Common
                 public const int RunOnceRunnerUpdating = 4;
             }
 
+            public static class Features
+            {
+                public static readonly string DiskSpaceWarning = "runner.diskspace.warning";
+            }
+
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";
             public static readonly string WorkerCrash = "WORKER_CRASH";
+            public static readonly string LowDiskSpace = "LOW_DISK_SPACE";
+            public static readonly string UnsupportedCommand = "UNSUPPORTED_COMMAND";
+            public static readonly string UnsupportedCommandMessageDisabled = "The `{0}` command is disabled. Please upgrade to using Environment Files or opt into unsecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/";
         }
 
         public static class RunnerEvent
@@ -198,6 +209,7 @@ namespace GitHub.Runner.Common
                 //
                 // Keep alphabetical
                 //
+                public static readonly string AllowUnsupportedCommands = "ACTIONS_ALLOW_UNSECURE_COMMANDS";
                 public static readonly string RunnerDebug = "ACTIONS_RUNNER_DEBUG";
                 public static readonly string StepDebug = "ACTIONS_STEP_DEBUG";
             }

src/Runner.Common/ExtensionManager.cs

@@ -60,6 +60,12 @@ namespace GitHub.Runner.Common
                     Add<T>(extensions, "GitHub.Runner.Worker.AddPathFileCommand, Runner.Worker");
                     Add<T>(extensions, "GitHub.Runner.Worker.SetEnvFileCommand, Runner.Worker");
                     break;
+                case "GitHub.Runner.Listener.Check.ICheckExtension":
+                    Add<T>(extensions, "GitHub.Runner.Listener.Check.InternetCheck, Runner.Listener");
+                    Add<T>(extensions, "GitHub.Runner.Listener.Check.ActionsCheck, Runner.Listener");
+                    Add<T>(extensions, "GitHub.Runner.Listener.Check.GitCheck, Runner.Listener");
+                    Add<T>(extensions, "GitHub.Runner.Listener.Check.NodeJsCheck, Runner.Listener");
+                    break;
                 default:
                     // This should never happen.
                     throw new NotSupportedException($"Unexpected extension type: '{typeof(T).FullName}'");

src/Runner.Common/Runner.Common.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Library</OutputType>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
     <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Runner.Listener/Checks/ActionsCheck.cs

@@ -0,0 +1,90 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+
+namespace GitHub.Runner.Listener.Check
+{
+    public sealed class ActionsCheck : RunnerService, ICheckExtension
+    {
+        private string _logFile = null;
+
+        public int Order => 2;
+
+        public string CheckName => "GitHub Actions Connection";
+
+        public string CheckDescription => "Make sure the actions runner have access to the GitHub Actions Service.";
+
+        public string CheckLog => _logFile;
+
+        public string HelpLink => "https://github.com/actions/runner/blob/main/docs/checks/actions.md";
+
+        public Type ExtensionType => typeof(ICheckExtension);
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _logFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Diag), StringUtil.Format("{0}_{1:yyyyMMdd-HHmmss}-utc.log", nameof(ActionsCheck), DateTime.UtcNow));
+        }
+
+        // runner access to actions service
+        public async Task<bool> RunCheck(string url, string pat)
+        {
+            await File.AppendAllLinesAsync(_logFile, HostContext.WarnLog());
+            await File.AppendAllLinesAsync(_logFile, HostContext.CheckProxy());
+
+            var checkTasks = new List<Task<CheckResult>>();
+            string githubApiUrl = null;
+            string actionsTokenServiceUrl = null;
+            string actionsPipelinesServiceUrl = null;
+            var urlBuilder = new UriBuilder(url);
+            if (UrlUtil.IsHostedServer(urlBuilder))
+            {
+                urlBuilder.Host = $"api.{urlBuilder.Host}";
+                urlBuilder.Path = "";
+                githubApiUrl = urlBuilder.Uri.AbsoluteUri;
+                actionsTokenServiceUrl = "https://vstoken.actions.githubusercontent.com/_apis/health";
+                actionsPipelinesServiceUrl = "https://pipelines.actions.githubusercontent.com/_apis/health";
+            }
+            else
+            {
+                urlBuilder.Path = "api/v3";
+                githubApiUrl = urlBuilder.Uri.AbsoluteUri;
+                urlBuilder.Path = "_services/vstoken/_apis/health";
+                actionsTokenServiceUrl = urlBuilder.Uri.AbsoluteUri;
+                urlBuilder.Path = "_services/pipelines/_apis/health";
+                actionsPipelinesServiceUrl = urlBuilder.Uri.AbsoluteUri;
+            }
+
+            // check github api
+            checkTasks.Add(CheckUtil.CheckDns(githubApiUrl));
+            checkTasks.Add(CheckUtil.CheckPing(githubApiUrl));
+            checkTasks.Add(HostContext.CheckHttpsRequests(githubApiUrl, pat, expectedHeader: "X-GitHub-Request-Id"));
+
+            // check actions token service
+            checkTasks.Add(CheckUtil.CheckDns(actionsTokenServiceUrl));
+            checkTasks.Add(CheckUtil.CheckPing(actionsTokenServiceUrl));
+            checkTasks.Add(HostContext.CheckHttpsRequests(actionsTokenServiceUrl, pat, expectedHeader: "x-vss-e2eid"));
+
+            // check actions pipelines service
+            checkTasks.Add(CheckUtil.CheckDns(actionsPipelinesServiceUrl));
+            checkTasks.Add(CheckUtil.CheckPing(actionsPipelinesServiceUrl));
+            checkTasks.Add(HostContext.CheckHttpsRequests(actionsPipelinesServiceUrl, pat, expectedHeader: "x-vss-e2eid"));
+
+            var result = true;
+            while (checkTasks.Count > 0)
+            {
+                var finishedCheckTask = await Task.WhenAny<CheckResult>(checkTasks);
+                var finishedCheck = await finishedCheckTask;
+                result = result && finishedCheck.Pass;
+                await File.AppendAllLinesAsync(_logFile, finishedCheck.Logs);
+                checkTasks.Remove(finishedCheckTask);
+            }
+
+            await Task.WhenAll(checkTasks);
+            return result;
+        }
+    }
+}

src/Runner.Listener/Checks/CheckUtil.cs

@@ -0,0 +1,351 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Tracing;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Net.Http.Headers;
+using System.Net.NetworkInformation;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+using GitHub.Services.Common;
+
+namespace GitHub.Runner.Listener.Check
+{
+    public static class CheckUtil
+    {
+        public static List<string> WarnLog(this IHostContext hostContext)
+        {
+            var logs = new List<string>();
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ****     !!! WARNING !!! ");
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ****     DO NOT share the log in public place! The log may contains secrets in plain text. ");
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ****     !!! WARNING !!! ");
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+            logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            return logs;
+        }
+
+        public static List<string> CheckProxy(this IHostContext hostContext)
+        {
+            var logs = new List<string>();
+            if (!string.IsNullOrEmpty(hostContext.WebProxy.HttpProxyAddress) ||
+                !string.IsNullOrEmpty(hostContext.WebProxy.HttpsProxyAddress))
+            {
+                logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Runner is behind web proxy {hostContext.WebProxy.HttpsProxyAddress ?? hostContext.WebProxy.HttpProxyAddress} ");
+                logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            }
+
+            return logs;
+        }
+
+        public static async Task<CheckResult> CheckDns(string targetUrl)
+        {
+            var result = new CheckResult();
+            var url = new Uri(targetUrl);
+            try
+            {
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Try DNS lookup for {url.Host} ");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                IPHostEntry host = await Dns.GetHostEntryAsync(url.Host);
+                foreach (var address in host.AddressList)
+                {
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Resolved DNS for {url.Host} to '{address}'");
+                }
+
+                result.Pass = true;
+            }
+            catch (Exception ex)
+            {
+                result.Pass = false;
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Resolved DNS for {url.Host} failed with error: {ex}");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            }
+
+            return result;
+        }
+
+        public static async Task<CheckResult> CheckPing(string targetUrl)
+        {
+            var result = new CheckResult();
+            var url = new Uri(targetUrl);
+            try
+            {
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Try ping {url.Host} ");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                using (var ping = new Ping())
+                {
+                    var reply = await ping.SendPingAsync(url.Host);
+                    if (reply.Status == IPStatus.Success)
+                    {
+                        result.Pass = true;
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Ping {url.Host} ({reply.Address}) succeed within to '{reply.RoundtripTime} ms'");
+                    }
+                    else
+                    {
+                        result.Pass = false;
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Ping {url.Host} ({reply.Address}) failed with '{reply.Status}'");
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                result.Pass = false;
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Ping api.github.com failed with error: {ex}");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            }
+
+            return result;
+        }
+
+        public static async Task<CheckResult> CheckHttpsRequests(this IHostContext hostContext, string url, string pat, string expectedHeader)
+        {
+            var result = new CheckResult();
+            try
+            {
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Send HTTPS Request to {url} ");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                using (var _ = new HttpEventSourceListener(result.Logs))
+                using (var httpClientHandler = hostContext.CreateHttpClientHandler())
+                using (var httpClient = new HttpClient(httpClientHandler))
+                {
+                    httpClient.DefaultRequestHeaders.UserAgent.AddRange(hostContext.UserAgents);
+                    if (!string.IsNullOrEmpty(pat))
+                    {
+                        httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("token", pat);
+                    }
+
+                    var response = await httpClient.GetAsync(url);
+
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Http status code: {response.StatusCode}");
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Http response headers: {response.Headers}");
+
+                    var responseContent = await response.Content.ReadAsStringAsync();
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Http response body: {responseContent}");
+                    if (response.IsSuccessStatusCode)
+                    {
+                        if (response.Headers.Contains(expectedHeader))
+                        {
+                            result.Pass = true;
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Http request 'GET' to {url} succeed");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ");
+                        }
+                        else
+                        {
+                            result.Pass = false;
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Http request 'GET' to {url} succeed but doesn't have expected HTTP Header.");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ");
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ");
+                        }
+                    }
+                    else
+                    {
+                        result.Pass = false;
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Http request 'GET' to {url} failed with {response.StatusCode}");
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ");
+                        result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ");
+                    }
+                }
+            }
+            catch (Exception ex)
+            {
+                result.Pass = false;
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Https request 'GET' to {url} failed with error: {ex}");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            }
+
+            return result;
+        }
+
+        public static async Task<CheckResult> DownloadExtraCA(this IHostContext hostContext, string url, string pat)
+        {
+            var result = new CheckResult();
+            try
+            {
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Download SSL Certificate from {url} ");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+
+                var uri = new Uri(url);
+                var env = new Dictionary<string, string>()
+                {
+                    { "HOSTNAME", uri.Host },
+                    { "PORT", uri.IsDefaultPort ? (uri.Scheme.ToLowerInvariant() == "https" ? "443" : "80") : uri.Port.ToString() },
+                    { "PATH", uri.AbsolutePath },
+                    { "PAT", pat }
+                };
+
+                var proxy = hostContext.WebProxy.GetProxy(uri);
+                if (proxy != null)
+                {
+                    env["PROXYHOST"] = proxy.Host;
+                    env["PROXYPORT"] = proxy.IsDefaultPort ? (proxy.Scheme.ToLowerInvariant() == "https" ? "443" : "80") : proxy.Port.ToString();
+                    if (hostContext.WebProxy.HttpProxyUsername != null ||
+                        hostContext.WebProxy.HttpsProxyUsername != null)
+                    {
+                        env["PROXYUSERNAME"] = hostContext.WebProxy.HttpProxyUsername ?? hostContext.WebProxy.HttpsProxyUsername;
+                        env["PROXYPASSWORD"] = hostContext.WebProxy.HttpProxyPassword ?? hostContext.WebProxy.HttpsProxyPassword;
+                    }
+                    else
+                    {
+                        env["PROXYUSERNAME"] = "";
+                        env["PROXYPASSWORD"] = "";
+                    }
+                }
+                else
+                {
+                    env["PROXYHOST"] = "";
+                    env["PROXYPORT"] = "";
+                    env["PROXYUSERNAME"] = "";
+                    env["PROXYPASSWORD"] = "";
+                }
+
+                using (var processInvoker = hostContext.CreateService<IProcessInvoker>())
+                {
+                    processInvoker.OutputDataReceived += new EventHandler<ProcessDataReceivedEventArgs>((sender, args) =>
+                    {
+                        if (!string.IsNullOrEmpty(args.Data))
+                        {
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} [STDOUT] {args.Data}");
+                        }
+                    });
+
+                    processInvoker.ErrorDataReceived += new EventHandler<ProcessDataReceivedEventArgs>((sender, args) =>
+                    {
+                        if (!string.IsNullOrEmpty(args.Data))
+                        {
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} [STDERR] {args.Data}");
+                        }
+                    });
+
+                    var downloadCertScript = Path.Combine(hostContext.GetDirectory(WellKnownDirectory.Bin), "checkScripts", "downloadCert");
+                    var node12 = Path.Combine(hostContext.GetDirectory(WellKnownDirectory.Externals), "node12", "bin", $"node{IOUtil.ExeExtension}");
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Run '{node12} \"{downloadCertScript}\"' ");
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} {StringUtil.ConvertToJson(env)}");
+                    await processInvoker.ExecuteAsync(
+                        hostContext.GetDirectory(WellKnownDirectory.Root),
+                        node12,
+                        $"\"{downloadCertScript}\"",
+                        env,
+                        true,
+                        CancellationToken.None);
+                }
+
+                result.Pass = true;
+            }
+            catch (Exception ex)
+            {
+                result.Pass = false;
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Download SSL Certificate from '{url}' failed with error: {ex}");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            }
+
+            return result;
+        }
+    }
+
+    // EventSource listener for dotnet debug trace for HTTP and SSL
+    public sealed class HttpEventSourceListener : EventListener
+    {
+        private readonly List<string> _logs;
+        private readonly object _lock = new object();
+        private readonly Dictionary<string, HashSet<string>> _ignoredEvent = new Dictionary<string, HashSet<string>>
+        {
+            {
+                "Private.InternalDiagnostics.System.Net.Http",
+                new HashSet<string>
+                {
+                    "Info",
+                    "Associate"
+                }
+            },
+            {
+                "Private.InternalDiagnostics.System.Net.Security",
+                new HashSet<string>
+                {
+                    "Info",
+                    "SslStreamCtor",
+                    "SecureChannelCtor",
+                    "NoDelegateNoClientCert",
+                    "CertsAfterFiltering",
+                    "UsingCachedCredential",
+                    "SspiSelectedCipherSuite"
+                }
+            }
+        };
+
+        public HttpEventSourceListener(List<string> logs)
+        {
+            _logs = logs;
+            if (Environment.GetEnvironmentVariable("ACTIONS_RUNNER_TRACE_ALL_HTTP_EVENT") == "1")
+            {
+                _ignoredEvent.Clear();
+            }
+        }
+
+        protected override void OnEventSourceCreated(EventSource eventSource)
+        {
+            base.OnEventSourceCreated(eventSource);
+
+            if (eventSource.Name == "Private.InternalDiagnostics.System.Net.Http" ||
+                eventSource.Name == "Private.InternalDiagnostics.System.Net.Security")
+            {
+                EnableEvents(eventSource, EventLevel.Verbose, EventKeywords.All);
+            }
+        }
+
+        protected override void OnEventWritten(EventWrittenEventArgs eventData)
+        {
+            base.OnEventWritten(eventData);
+            lock (_lock)
+            {
+                if (_ignoredEvent.TryGetValue(eventData.EventSource.Name, out var ignored) &&
+                    ignored.Contains(eventData.EventName))
+                {
+                    return;
+                }
+
+                _logs.Add($"{DateTime.UtcNow.ToString("O")} [START {eventData.EventSource.Name} - {eventData.EventName}]");
+                _logs.AddRange(eventData.Payload.Select(x => string.Join(Environment.NewLine, x.ToString().Split(Environment.NewLine).Select(y => $"{DateTime.UtcNow.ToString("O")} {y}"))));
+                _logs.Add($"{DateTime.UtcNow.ToString("O")} [END {eventData.EventSource.Name} - {eventData.EventName}]");
+            }
+        }
+    }
+}

src/Runner.Listener/Checks/GitCheck.cs

@@ -0,0 +1,171 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+
+namespace GitHub.Runner.Listener.Check
+{
+    public sealed class GitCheck : RunnerService, ICheckExtension
+    {
+        private string _logFile = null;
+        private string _gitPath = null;
+
+        public int Order => 3;
+
+        public string CheckName => "Git Certificate/Proxy Validation";
+
+        public string CheckDescription => "Make sure the git cli can access to GitHub.com or the GitHub Enterprise Server.";
+
+        public string CheckLog => _logFile;
+
+        public string HelpLink => "https://github.com/actions/runner/blob/main/docs/checks/git.md";
+
+        public Type ExtensionType => typeof(ICheckExtension);
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _logFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Diag), StringUtil.Format("{0}_{1:yyyyMMdd-HHmmss}-utc.log", nameof(GitCheck), DateTime.UtcNow));
+            _gitPath = WhichUtil.Which("git");
+        }
+
+        // git access to ghes/gh 
+        public async Task<bool> RunCheck(string url, string pat)
+        {
+            await File.AppendAllLinesAsync(_logFile, HostContext.WarnLog());
+            await File.AppendAllLinesAsync(_logFile, HostContext.CheckProxy());
+
+            if (string.IsNullOrEmpty(_gitPath))
+            {
+                await File.AppendAllLinesAsync(_logFile, new[] { $"{DateTime.UtcNow.ToString("O")} Can't verify git with GitHub.com or GitHub Enterprise Server since git is not installed." });
+                return false;
+            }
+
+            var checkGit = await CheckGit(url, pat);
+            var result = checkGit.Pass;
+            await File.AppendAllLinesAsync(_logFile, checkGit.Logs);
+
+            // try fix SSL error by providing extra CA certificate.
+            if (checkGit.SslError)
+            {
+                await File.AppendAllLinesAsync(_logFile, new[] { $"{DateTime.UtcNow.ToString("O")} Try fix SSL error by providing extra CA certificate." });
+                var downloadCert = await HostContext.DownloadExtraCA(url, pat);
+                await File.AppendAllLinesAsync(_logFile, downloadCert.Logs);
+
+                if (downloadCert.Pass)
+                {
+                    var recheckGit = await CheckGit(url, pat, extraCA: true);
+                    await File.AppendAllLinesAsync(_logFile, recheckGit.Logs);
+                    if (recheckGit.Pass)
+                    {
+                        await File.AppendAllLinesAsync(_logFile, new[] { $"{DateTime.UtcNow.ToString("O")} Fixed SSL error by providing extra CA certs." });
+                    }
+                }
+            }
+
+            return result;
+        }
+
+        private async Task<CheckResult> CheckGit(string url, string pat, bool extraCA = false)
+        {
+            var result = new CheckResult();
+            try
+            {
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Validate server cert and proxy configuration with Git ");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                var repoUrlBuilder = new UriBuilder(url);
+                repoUrlBuilder.Path = "actions/checkout";
+                repoUrlBuilder.UserName = "gh";
+                repoUrlBuilder.Password = pat;
+
+                var gitProxy = "";
+                var proxy = HostContext.WebProxy.GetProxy(repoUrlBuilder.Uri);
+                if (proxy != null)
+                {
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Runner is behind http proxy '{proxy.AbsoluteUri}'");
+                    if (HostContext.WebProxy.HttpProxyUsername != null ||
+                        HostContext.WebProxy.HttpsProxyUsername != null)
+                    {
+                        var proxyUrlWithCred = UrlUtil.GetCredentialEmbeddedUrl(
+                            proxy,
+                            HostContext.WebProxy.HttpProxyUsername ?? HostContext.WebProxy.HttpsProxyUsername,
+                            HostContext.WebProxy.HttpProxyPassword ?? HostContext.WebProxy.HttpsProxyPassword);
+                        gitProxy = $"-c http.proxy={proxyUrlWithCred}";
+                    }
+                    else
+                    {
+                        gitProxy = $"-c http.proxy={proxy.AbsoluteUri}";
+                    }
+                }
+
+                using (var processInvoker = HostContext.CreateService<IProcessInvoker>())
+                {
+                    processInvoker.OutputDataReceived += new EventHandler<ProcessDataReceivedEventArgs>((sender, args) =>
+                    {
+                        if (!string.IsNullOrEmpty(args.Data))
+                        {
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} {args.Data}");
+                        }
+                    });
+
+                    processInvoker.ErrorDataReceived += new EventHandler<ProcessDataReceivedEventArgs>((sender, args) =>
+                    {
+                        if (!string.IsNullOrEmpty(args.Data))
+                        {
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} {args.Data}");
+                        }
+                    });
+
+                    var gitArgs = $"{gitProxy} ls-remote --exit-code {repoUrlBuilder.Uri.AbsoluteUri} HEAD";
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Run 'git {gitArgs}' ");
+
+                    var env = new Dictionary<string, string>
+                    {
+                        { "GIT_TRACE", "1" },
+                        { "GIT_CURL_VERBOSE", "1" }
+                    };
+
+                    if (extraCA)
+                    {
+                        env["GIT_SSL_CAINFO"] = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Root), "download_ca_cert.pem");
+                    }
+
+                    await processInvoker.ExecuteAsync(
+                        HostContext.GetDirectory(WellKnownDirectory.Root),
+                        _gitPath,
+                        gitArgs,
+                        env,
+                        true,
+                        CancellationToken.None);
+                }
+
+                result.Pass = true;
+            }
+            catch (Exception ex)
+            {
+                result.Pass = false;
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     git ls-remote failed with error: {ex}");
+                if (result.Logs.Any(x => x.Contains("SSL Certificate problem", StringComparison.OrdinalIgnoreCase)))
+                {
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     git ls-remote failed due to SSL cert issue.");
+                    result.SslError = true;
+                }
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+
+            }
+
+            return result;
+        }
+    }
+}

src/Runner.Listener/Checks/ICheckExtension.cs

@@ -0,0 +1,30 @@
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+
+namespace GitHub.Runner.Listener.Check
+{
+    public interface ICheckExtension : IExtension
+    {
+        int Order { get; }
+        string CheckName { get; }
+        string CheckDescription { get; }
+        string CheckLog { get; }
+        string HelpLink { get; }
+        Task<bool> RunCheck(string url, string pat);
+    }
+
+    public class CheckResult
+    {
+        public CheckResult()
+        {
+            Logs = new List<string>();
+        }
+
+        public bool Pass { get; set; }
+
+        public bool SslError { get; set; }
+
+        public List<string> Logs { get; set; }
+    }
+}

src/Runner.Listener/Checks/InternetCheck.cs

@@ -0,0 +1,59 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+
+namespace GitHub.Runner.Listener.Check
+{
+    public sealed class InternetCheck : RunnerService, ICheckExtension
+    {
+        private string _logFile = null;
+
+        public int Order => 1;
+
+        public string CheckName => "Internet Connection";
+
+        public string CheckDescription => "Make sure the actions runner have access to public internet.";
+
+        public string CheckLog => _logFile;
+
+        public string HelpLink => "https://github.com/actions/runner/blob/main/docs/checks/internet.md";
+
+        public Type ExtensionType => typeof(ICheckExtension);
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _logFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Diag), StringUtil.Format("{0}_{1:yyyyMMdd-HHmmss}-utc.log", nameof(InternetCheck), DateTime.UtcNow));
+        }
+
+        // check runner access to api.github.com
+        public async Task<bool> RunCheck(string url, string pat)
+        {
+            await File.AppendAllLinesAsync(_logFile, HostContext.WarnLog());
+            await File.AppendAllLinesAsync(_logFile, HostContext.CheckProxy());
+
+            var checkTasks = new List<Task<CheckResult>>();
+            checkTasks.Add(CheckUtil.CheckDns("https://api.github.com"));
+            checkTasks.Add(CheckUtil.CheckPing("https://api.github.com"));
+
+            // We don't need to pass a PAT since it might be a token for GHES.
+            checkTasks.Add(HostContext.CheckHttpsRequests("https://api.github.com", pat: null, expectedHeader: "X-GitHub-Request-Id"));
+
+            var result = true;
+            while (checkTasks.Count > 0)
+            {
+                var finishedCheckTask = await Task.WhenAny<CheckResult>(checkTasks);
+                var finishedCheck = await finishedCheckTask;
+                result = result && finishedCheck.Pass;
+                await File.AppendAllLinesAsync(_logFile, finishedCheck.Logs);
+                checkTasks.Remove(finishedCheckTask);
+            }
+
+            await Task.WhenAll(checkTasks);
+            return result;
+        }
+    }
+}

src/Runner.Listener/Checks/NodeJsCheck.cs

@@ -0,0 +1,181 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.Runner.Common;
+using GitHub.Runner.Sdk;
+
+namespace GitHub.Runner.Listener.Check
+{
+    public sealed class NodeJsCheck : RunnerService, ICheckExtension
+    {
+        private string _logFile = null;
+
+        public int Order => 4;
+
+        public string CheckName => "Node.js Certificate/Proxy Validation";
+
+        public string CheckDescription => "Make sure the node.js have access to GitHub.com or the GitHub Enterprise Server.";
+
+        public string CheckLog => _logFile;
+
+        public string HelpLink => "https://github.com/actions/runner/blob/main/docs/checks/nodejs.md";
+
+        public Type ExtensionType => typeof(ICheckExtension);
+
+        public override void Initialize(IHostContext hostContext)
+        {
+            base.Initialize(hostContext);
+            _logFile = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Diag), StringUtil.Format("{0}_{1:yyyyMMdd-HHmmss}-utc.log", nameof(NodeJsCheck), DateTime.UtcNow));
+        }
+
+        // node access to ghes/gh
+        public async Task<bool> RunCheck(string url, string pat)
+        {
+            await File.AppendAllLinesAsync(_logFile, HostContext.WarnLog());
+            await File.AppendAllLinesAsync(_logFile, HostContext.CheckProxy());
+
+            // Request to github.com or ghes server
+            var urlBuilder = new UriBuilder(url);
+            if (UrlUtil.IsHostedServer(urlBuilder))
+            {
+                urlBuilder.Host = $"api.{urlBuilder.Host}";
+                urlBuilder.Path = "";
+            }
+            else
+            {
+                urlBuilder.Path = "api/v3";
+            }
+
+            var checkNode = await CheckNodeJs(urlBuilder.Uri.AbsoluteUri, pat);
+            var result = checkNode.Pass;
+            await File.AppendAllLinesAsync(_logFile, checkNode.Logs);
+
+            // try fix SSL error by providing extra CA certificate.
+            if (checkNode.SslError)
+            {
+                var downloadCert = await HostContext.DownloadExtraCA(urlBuilder.Uri.AbsoluteUri, pat);
+                await File.AppendAllLinesAsync(_logFile, downloadCert.Logs);
+
+                if (downloadCert.Pass)
+                {
+                    var recheckNode = await CheckNodeJs(urlBuilder.Uri.AbsoluteUri, pat, extraCA: true);
+                    await File.AppendAllLinesAsync(_logFile, recheckNode.Logs);
+                    if (recheckNode.Pass)
+                    {
+                        await File.AppendAllLinesAsync(_logFile, new[] { $"{DateTime.UtcNow.ToString("O")} Fixed SSL error by providing extra CA certs." });
+                    }
+                }
+            }
+
+            return result;
+        }
+
+        private async Task<CheckResult> CheckNodeJs(string url, string pat, bool extraCA = false)
+        {
+            var result = new CheckResult();
+            try
+            {
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Make Http request to {url} using node.js ");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+
+                // Request to github.com or ghes server
+                Uri requestUrl = new Uri(url);
+                var env = new Dictionary<string, string>()
+                {
+                    { "HOSTNAME", requestUrl.Host },
+                    { "PORT", requestUrl.IsDefaultPort ? (requestUrl.Scheme.ToLowerInvariant() == "https" ? "443" : "80") : requestUrl.Port.ToString() },
+                    { "PATH", requestUrl.AbsolutePath },
+                    { "PAT", pat }
+                };
+
+                var proxy = HostContext.WebProxy.GetProxy(requestUrl);
+                if (proxy != null)
+                {
+                    env["PROXYHOST"] = proxy.Host;
+                    env["PROXYPORT"] = proxy.IsDefaultPort ? (proxy.Scheme.ToLowerInvariant() == "https" ? "443" : "80") : proxy.Port.ToString();
+                    if (HostContext.WebProxy.HttpProxyUsername != null ||
+                        HostContext.WebProxy.HttpsProxyUsername != null)
+                    {
+                        env["PROXYUSERNAME"] = HostContext.WebProxy.HttpProxyUsername ?? HostContext.WebProxy.HttpsProxyUsername;
+                        env["PROXYPASSWORD"] = HostContext.WebProxy.HttpProxyPassword ?? HostContext.WebProxy.HttpsProxyPassword;
+                    }
+                    else
+                    {
+                        env["PROXYUSERNAME"] = "";
+                        env["PROXYPASSWORD"] = "";
+                    }
+                }
+                else
+                {
+                    env["PROXYHOST"] = "";
+                    env["PROXYPORT"] = "";
+                    env["PROXYUSERNAME"] = "";
+                    env["PROXYPASSWORD"] = "";
+                }
+
+                if (extraCA)
+                {
+                    env["NODE_EXTRA_CA_CERTS"] = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Root), "download_ca_cert.pem");
+                }
+
+                using (var processInvoker = HostContext.CreateService<IProcessInvoker>())
+                {
+                    processInvoker.OutputDataReceived += new EventHandler<ProcessDataReceivedEventArgs>((sender, args) =>
+                    {
+                        if (!string.IsNullOrEmpty(args.Data))
+                        {
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} [STDOUT] {args.Data}");
+                        }
+                    });
+
+                    processInvoker.ErrorDataReceived += new EventHandler<ProcessDataReceivedEventArgs>((sender, args) =>
+                    {
+                        if (!string.IsNullOrEmpty(args.Data))
+                        {
+                            result.Logs.Add($"{DateTime.UtcNow.ToString("O")} [STDERR] {args.Data}");
+                        }
+                    });
+
+                    var makeWebRequestScript = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Bin), "checkScripts", "makeWebRequest.js");
+                    var node12 = Path.Combine(HostContext.GetDirectory(WellKnownDirectory.Externals), "node12", "bin", $"node{IOUtil.ExeExtension}");
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} Run '{node12} \"{makeWebRequestScript}\"' ");
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} {StringUtil.ConvertToJson(env)}");
+                    await processInvoker.ExecuteAsync(
+                        HostContext.GetDirectory(WellKnownDirectory.Root),
+                        node12,
+                        $"\"{makeWebRequestScript}\"",
+                        env,
+                        true,
+                        CancellationToken.None);
+                }
+
+                result.Pass = true;
+            }
+            catch (Exception ex)
+            {
+                result.Pass = false;
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Make https request to {url} using node.js failed with error: {ex}");
+                if (result.Logs.Any(x => x.Contains("UNABLE_TO_VERIFY_LEAF_SIGNATURE") ||
+                                         x.Contains("UNABLE_TO_GET_ISSUER_CERT_LOCALLY") ||
+                                         x.Contains("SELF_SIGNED_CERT_IN_CHAIN")))
+                {
+                    result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****     Https request failed due to SSL cert issue.");
+                    result.SslError = true;
+                }
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ****                                                                                                       ****");
+                result.Logs.Add($"{DateTime.UtcNow.ToString("O")} ***************************************************************************************************************");
+            }
+
+            return result;
+        }
+    }
+}

src/Runner.Listener/CommandSettings.cs

@@ -27,6 +27,7 @@ namespace GitHub.Runner.Listener
 
         private readonly string[] validFlags =
         {
+            Constants.Runner.CommandLine.Flags.Check,
             Constants.Runner.CommandLine.Flags.Commit,
             Constants.Runner.CommandLine.Flags.Help,
             Constants.Runner.CommandLine.Flags.Replace,
@@ -42,6 +43,7 @@ namespace GitHub.Runner.Listener
             Constants.Runner.CommandLine.Args.Labels,
             Constants.Runner.CommandLine.Args.MonitorSocketAddress,
             Constants.Runner.CommandLine.Args.Name,
+            Constants.Runner.CommandLine.Args.PAT,
             Constants.Runner.CommandLine.Args.RunnerGroup,
             Constants.Runner.CommandLine.Args.StartupType,
             Constants.Runner.CommandLine.Args.Token,
@@ -59,6 +61,7 @@ namespace GitHub.Runner.Listener
         public bool Warmup => TestCommand(Constants.Runner.CommandLine.Commands.Warmup);
 
         // Flags.
+        public bool Check => TestFlag(Constants.Runner.CommandLine.Flags.Check);
         public bool Commit => TestFlag(Constants.Runner.CommandLine.Flags.Commit);
         public bool Help => TestFlag(Constants.Runner.CommandLine.Flags.Help);
         public bool Unattended => TestFlag(Constants.Runner.CommandLine.Flags.Unattended);
@@ -187,6 +190,22 @@ namespace GitHub.Runner.Listener
                 validator: Validators.NonEmptyValidator);
         }
 
+        public string GetGitHubPersonalAccessToken(bool required = false)
+        {
+            if (required)
+            {
+                return GetArgOrPrompt(
+                    name: Constants.Runner.CommandLine.Args.PAT,
+                    description: "What is your GitHub personal access token?",
+                    defaultValue: string.Empty,
+                    validator: Validators.NonEmptyValidator);
+            }
+            else
+            {
+                return GetArg(name: Constants.Runner.CommandLine.Args.PAT);
+            }
+        }
+
         public string GetRunnerRegisterToken()
         {
             return GetArgOrPrompt(

src/Runner.Listener/Configuration/ConfigurationManager.cs

@@ -4,7 +4,6 @@ using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
 using GitHub.Services.Common;
 using GitHub.Services.OAuth;
-using GitHub.Services.WebApi;
 using System;
 using System.Collections.Generic;
 using System.Linq;
@@ -12,6 +11,7 @@ using System.Net.Http;
 using System.Net.Http.Headers;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
+using System.Text;
 using System.Threading.Tasks;
 
 namespace GitHub.Runner.Listener.Configuration
@@ -107,8 +107,8 @@ namespace GitHub.Runner.Listener.Configuration
                 else
                 {
                     runnerSettings.GitHubUrl = inputUrl;
-                    var githubToken = command.GetRunnerRegisterToken();
-                    GitHubAuthResult authResult = await GetTenantCredential(inputUrl, githubToken, Constants.RunnerEvent.Register);
+                    var registerToken = await GetRunnerTokenAsync(command, inputUrl, "registration");
+                    GitHubAuthResult authResult = await GetTenantCredential(inputUrl, registerToken, Constants.RunnerEvent.Register);
                     runnerSettings.ServerUrl = authResult.TenantUrl;
                     creds = authResult.ToVssCredentials();
                     Trace.Info("cred retrieved via GitHub auth");
@@ -117,7 +117,7 @@ namespace GitHub.Runner.Listener.Configuration
                 try
                 {
                     // Determine the service deployment type based on connection data. (Hosted/OnPremises)
-                    runnerSettings.IsHostedServer = runnerSettings.GitHubUrl == null || IsHostedServer(new UriBuilder(runnerSettings.GitHubUrl));
+                    runnerSettings.IsHostedServer = runnerSettings.GitHubUrl == null || UrlUtil.IsHostedServer(new UriBuilder(runnerSettings.GitHubUrl));
 
                     // Warn if the Actions server url and GHES server url has different Host
                     if (!runnerSettings.IsHostedServer)
@@ -373,8 +373,8 @@ namespace GitHub.Runner.Listener.Configuration
                     }
                     else
                     {
-                        var githubToken = command.GetRunnerDeletionToken();
-                        GitHubAuthResult authResult = await GetTenantCredential(settings.GitHubUrl, githubToken, Constants.RunnerEvent.Remove);
+                        var deletionToken = await GetRunnerTokenAsync(command, settings.GitHubUrl, "remove");
+                        GitHubAuthResult authResult = await GetTenantCredential(settings.GitHubUrl, deletionToken, Constants.RunnerEvent.Remove);
                         creds = authResult.ToVssCredentials();
                         Trace.Info("cred retrieved via GitHub auth");
                     }
@@ -508,18 +508,107 @@ namespace GitHub.Runner.Listener.Configuration
             return agent;
         }
 
-        private bool IsHostedServer(UriBuilder gitHubUrl)
+        private async Task<string> GetRunnerTokenAsync(CommandSettings command, string githubUrl, string tokenType)
         {
-            return string.Equals(gitHubUrl.Host, "github.com", StringComparison.OrdinalIgnoreCase) ||
-                string.Equals(gitHubUrl.Host, "www.github.com", StringComparison.OrdinalIgnoreCase) ||
-                string.Equals(gitHubUrl.Host, "github.localhost", StringComparison.OrdinalIgnoreCase);
+            var githubPAT = command.GetGitHubPersonalAccessToken();
+            var runnerToken = string.Empty;
+            if (!string.IsNullOrEmpty(githubPAT))
+            {
+                Trace.Info($"Retriving runner {tokenType} token using GitHub PAT.");
+                var jitToken = await GetJITRunnerTokenAsync(githubUrl, githubPAT, tokenType);
+                Trace.Info($"Retrived runner {tokenType} token is good to {jitToken.ExpiresAt}.");
+                HostContext.SecretMasker.AddValue(jitToken.Token);
+                runnerToken = jitToken.Token;
+            }
+
+            if (string.IsNullOrEmpty(runnerToken))
+            {
+                if (string.Equals("registration", tokenType, StringComparison.OrdinalIgnoreCase))
+                {
+                    runnerToken = command.GetRunnerRegisterToken();
+                }
+                else
+                {
+                    runnerToken = command.GetRunnerDeletionToken();
+                }
+            }
+
+            return runnerToken;
+        }
+
+        private async Task<GitHubRunnerRegisterToken> GetJITRunnerTokenAsync(string githubUrl, string githubToken, string tokenType)
+        {
+            var githubApiUrl = "";
+            var gitHubUrlBuilder = new UriBuilder(githubUrl);
+            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
+            if (path.Length == 1)
+            {
+                // org runner
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/orgs/{path[0]}/actions/runners/{tokenType}-token";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/orgs/{path[0]}/actions/runners/{tokenType}-token";
+                }
+            }
+            else if (path.Length == 2)
+            {
+                // repo or enterprise runner.
+                var repoScope = "repos/";
+                if (string.Equals(path[0], "enterprises", StringComparison.OrdinalIgnoreCase))
+                {
+                    repoScope = "";
+                }
+
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/{repoScope}{path[0]}/{path[1]}/actions/runners/{tokenType}-token";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/{repoScope}{path[0]}/{path[1]}/actions/runners/{tokenType}-token";
+                }
+            }
+            else
+            {
+                throw new ArgumentException($"'{githubUrl}' should point to an org or repository.");
+            }
+
+            using (var httpClientHandler = HostContext.CreateHttpClientHandler())
+            using (var httpClient = new HttpClient(httpClientHandler))
+            {
+                var base64EncodingToken = Convert.ToBase64String(Encoding.UTF8.GetBytes($"github:{githubToken}"));
+                HostContext.SecretMasker.AddValue(base64EncodingToken);
+                httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("basic", base64EncodingToken);
+                httpClient.DefaultRequestHeaders.UserAgent.AddRange(HostContext.UserAgents);
+                httpClient.DefaultRequestHeaders.Accept.ParseAdd("application/vnd.github.v3+json");
+
+                var response = await httpClient.PostAsync(githubApiUrl, new StringContent(string.Empty));
+
+                if (response.IsSuccessStatusCode)
+                {
+                    Trace.Info($"Http response code: {response.StatusCode} from 'POST {githubApiUrl}'");
+                    var jsonResponse = await response.Content.ReadAsStringAsync();
+                    return StringUtil.ConvertFromJson<GitHubRunnerRegisterToken>(jsonResponse);
+                }
+                else
+                {
+                    _term.WriteError($"Http response code: {response.StatusCode} from 'POST {githubApiUrl}'");
+                    var errorResponse = await response.Content.ReadAsStringAsync();
+                    _term.WriteError(errorResponse);
+                    response.EnsureSuccessStatusCode();
+                    return null;
+                }
+            }
         }
 
         private async Task<GitHubAuthResult> GetTenantCredential(string githubUrl, string githubToken, string runnerEvent)
         {
             var githubApiUrl = "";
             var gitHubUrlBuilder = new UriBuilder(githubUrl);
-            if (IsHostedServer(gitHubUrlBuilder))
+            if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
             {
                 githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/actions/runner-registration";
             }

src/Runner.Listener/Configuration/CredentialManager.cs

@@ -71,6 +71,16 @@ namespace GitHub.Runner.Listener.Configuration
         }
     }
 
+    [DataContract]
+    public sealed class GitHubRunnerRegisterToken
+    {
+        [DataMember(Name = "token")]
+        public string Token { get; set; }
+
+        [DataMember(Name = "expires_at")]
+        public string ExpiresAt { get; set; }
+    }
+
     [DataContract]
     public sealed class GitHubAuthResult
     {

src/Runner.Listener/Configuration/IRSAKeyManager.cs

@@ -20,7 +20,7 @@ namespace GitHub.Runner.Listener.Configuration
         /// key is returned to the caller.
         /// </summary>
         /// <returns>An <c>RSACryptoServiceProvider</c> instance representing the key for the runner</returns>
-        RSACryptoServiceProvider CreateKey();
+        RSA CreateKey();
 
         /// <summary>
         /// Deletes the RSA key managed by the key manager.
@@ -32,7 +32,7 @@ namespace GitHub.Runner.Listener.Configuration
         /// </summary>
         /// <returns>An <c>RSACryptoServiceProvider</c> instance representing the key for the runner</returns>
         /// <exception cref="CryptographicException">No key exists in the store</exception>
-        RSACryptoServiceProvider GetKey();
+        RSA GetKey();
     }
 
     // Newtonsoft 10 is not working properly with dotnet RSAParameters class

src/Runner.Listener/Configuration/OAuthCredential.cs

@@ -36,7 +36,7 @@ namespace GitHub.Runner.Listener.Configuration
             // We expect the key to be in the machine store at this point. Configuration should have set all of
             // this up correctly so we can use the key to generate access tokens.
             var keyManager = context.GetService<IRSAKeyManager>();
-            var signingCredentials = VssSigningCredentials.Create(() => keyManager.GetKey());
+            var signingCredentials = VssSigningCredentials.Create(() => keyManager.GetKey(), requireFipsCryptography: true);
             var clientCredential = new VssOAuthJwtBearerClientCredential(clientId, authorizationUrl, signingCredentials);
             var agentCredential = new VssOAuthCredential(new Uri(oauthEndpointUrl, UriKind.Absolute), VssOAuthGrant.ClientCredentials, clientCredential);
 

src/Runner.Listener/Configuration/RSAEncryptedFileKeyManager.cs

@@ -13,14 +13,14 @@ namespace GitHub.Runner.Listener.Configuration
         private string _keyFile;
         private IHostContext _context;
 
-        public RSACryptoServiceProvider CreateKey()
+        public RSA CreateKey()
         {
-            RSACryptoServiceProvider rsa = null;
+            RSA rsa = null;
             if (!File.Exists(_keyFile))
             {
                 Trace.Info("Creating new RSA key using 2048-bit key length");
 
-                rsa = new RSACryptoServiceProvider(2048);
+                rsa = RSA.Create(2048);
 
                 // Now write the parameters to disk
                 SaveParameters(rsa.ExportParameters(true));
@@ -30,7 +30,7 @@ namespace GitHub.Runner.Listener.Configuration
             {
                 Trace.Info("Found existing RSA key parameters file {0}", _keyFile);
 
-                rsa = new RSACryptoServiceProvider();
+                rsa = RSA.Create();
                 rsa.ImportParameters(LoadParameters());
             }
 
@@ -46,7 +46,7 @@ namespace GitHub.Runner.Listener.Configuration
             }
         }
 
-        public RSACryptoServiceProvider GetKey()
+        public RSA GetKey()
         {
             if (!File.Exists(_keyFile))
             {
@@ -55,7 +55,7 @@ namespace GitHub.Runner.Listener.Configuration
 
             Trace.Info("Loading RSA key parameters from file {0}", _keyFile);
 
-            var rsa = new RSACryptoServiceProvider();
+            var rsa = RSA.Create();
             rsa.ImportParameters(LoadParameters());
             return rsa;
         }

src/Runner.Listener/Configuration/RSAFileKeyManager.cs

@@ -14,14 +14,14 @@ namespace GitHub.Runner.Listener.Configuration
         private string _keyFile;
         private IHostContext _context;
 
-        public RSACryptoServiceProvider CreateKey()
+        public RSA CreateKey()
         {
-            RSACryptoServiceProvider rsa = null;
+            RSA rsa = null;
             if (!File.Exists(_keyFile))
             {
                 Trace.Info("Creating new RSA key using 2048-bit key length");
 
-                rsa = new RSACryptoServiceProvider(2048);
+                rsa = RSA.Create(2048);
 
                 // Now write the parameters to disk
                 IOUtil.SaveObject(new RSAParametersSerializable(rsa.ExportParameters(true)), _keyFile);
@@ -54,7 +54,7 @@ namespace GitHub.Runner.Listener.Configuration
             {
                 Trace.Info("Found existing RSA key parameters file {0}", _keyFile);
 
-                rsa = new RSACryptoServiceProvider();
+                rsa = RSA.Create();
                 rsa.ImportParameters(IOUtil.LoadObject<RSAParametersSerializable>(_keyFile).RSAParameters);
             }
 
@@ -70,7 +70,7 @@ namespace GitHub.Runner.Listener.Configuration
             }
         }
 
-        public RSACryptoServiceProvider GetKey()
+        public RSA GetKey()
         {
             if (!File.Exists(_keyFile))
             {
@@ -80,7 +80,7 @@ namespace GitHub.Runner.Listener.Configuration
             Trace.Info("Loading RSA key parameters from file {0}", _keyFile);
 
             var parameters = IOUtil.LoadObject<RSAParametersSerializable>(_keyFile).RSAParameters;
-            var rsa = new RSACryptoServiceProvider();
+            var rsa = RSA.Create();
             rsa.ImportParameters(parameters);
             return rsa;
         }

src/Runner.Listener/MessageListener.cs

@@ -319,7 +319,8 @@ namespace GitHub.Runner.Listener
                 var keyManager = HostContext.GetService<IRSAKeyManager>();
                 using (var rsa = keyManager.GetKey())
                 {
-                    return aes.CreateDecryptor(rsa.Decrypt(_session.EncryptionKey.Value, RSAEncryptionPadding.OaepSHA1), message.IV);
+                    var padding = _session.UseFipsEncryption ? RSAEncryptionPadding.OaepSHA256 : RSAEncryptionPadding.OaepSHA1;
+                    return aes.CreateDecryptor(rsa.Decrypt(_session.EncryptionKey.Value, padding), message.IV);
                 }
             }
             else

src/Runner.Listener/Runner.Listener.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Exe</OutputType>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
     <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Runner.Listener/Runner.cs

@@ -1,6 +1,5 @@
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Listener.Configuration;
-using GitHub.Runner.Common.Util;
 using System;
 using System.Threading;
 using System.Threading.Tasks;
@@ -11,6 +10,8 @@ using System.Reflection;
 using System.Runtime.CompilerServices;
 using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;
+using System.Linq;
+using GitHub.Runner.Listener.Check;
 
 namespace GitHub.Runner.Listener
 {
@@ -72,6 +73,46 @@ namespace GitHub.Runner.Listener
                     return Constants.Runner.ReturnCode.Success;
                 }
 
+                if (command.Check)
+                {
+                    var url = command.GetUrl();
+                    var pat = command.GetGitHubPersonalAccessToken(required: true);
+                    var checkExtensions = HostContext.GetService<IExtensionManager>().GetExtensions<ICheckExtension>();
+                    var sortedChecks = checkExtensions.OrderBy(x => x.Order);
+                    foreach (var check in sortedChecks)
+                    {
+                        _term.WriteLine($"**********************************************************************************************************************");
+                        _term.WriteLine($"**  Check:               {check.CheckName}");
+                        _term.WriteLine($"**  Description:         {check.CheckDescription}");
+                        _term.WriteLine($"**********************************************************************************************************************");
+                        var result = await check.RunCheck(url, pat);
+                        if (!result)
+                        {
+                            _term.WriteLine($"**                                                                                                                  **");
+                            _term.WriteLine($"**                                            F A I L                                                               **");
+                            _term.WriteLine($"**                                                                                                                  **");
+                            _term.WriteLine($"**********************************************************************************************************************");
+                            _term.WriteLine($"** Log: {check.CheckLog}");
+                            _term.WriteLine($"** Help Doc: {check.HelpLink}");
+                            _term.WriteLine($"**********************************************************************************************************************");
+                        }
+                        else
+                        {
+                            _term.WriteLine($"**                                                                                                                  **");
+                            _term.WriteLine($"**                                            P A S S                                                               **");
+                            _term.WriteLine($"**                                                                                                                  **");
+                            _term.WriteLine($"**********************************************************************************************************************");
+                            _term.WriteLine($"** Log: {check.CheckLog}");
+                            _term.WriteLine($"**********************************************************************************************************************");
+                        }
+
+                        _term.WriteLine();
+                        _term.WriteLine();
+                    }
+
+                    return Constants.Runner.ReturnCode.Success;
+                }
+
                 // Configure runner prompt for args if not supplied
                 // Unattended configure mode will not prompt for args if not supplied and error on any missing or invalid value.
                 if (command.Configure)

src/Runner.PluginHost/Runner.PluginHost.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Exe</OutputType>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
     <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Runner.Plugins/Artifact/FileContainerServer.cs

@@ -444,7 +444,7 @@ namespace GitHub.Runner.Plugins.Artifact
                 {
                     // We should never
                     context.Error($"Error '{ex.Message}' when downloading file '{fileToDownload}'. (Downloader {downloaderId})");
-                    throw ex;
+                    throw;
                 }
             }
 
@@ -528,7 +528,7 @@ namespace GitHub.Runner.Plugins.Artifact
                 catch (Exception ex)
                 {
                     context.Output($"File error '{ex.Message}' when uploading file '{fileToUpload}'.");
-                    throw ex;
+                    throw;
                 }
             }
 

src/Runner.Plugins/Runner.Plugins.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Library</OutputType>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
     <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Runner.Sdk/Runner.Sdk.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Library</OutputType>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
     <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Runner.Sdk/RunnerWebProxy.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Net;
 using System.Text.RegularExpressions;
@@ -71,7 +71,7 @@ namespace GitHub.Runner.Sdk
 
             if (!string.IsNullOrEmpty(httpProxyAddress) && Uri.TryCreate(httpProxyAddress, UriKind.Absolute, out var proxyHttpUri))
             {
-                _httpProxyAddress = proxyHttpUri.AbsoluteUri;
+                _httpProxyAddress = proxyHttpUri.OriginalString;
 
                 // Set both environment variables since there are tools support both casing (curl, wget) and tools support only one casing (docker)
                 Environment.SetEnvironmentVariable("HTTP_PROXY", _httpProxyAddress);
@@ -101,7 +101,7 @@ namespace GitHub.Runner.Sdk
 
             if (!string.IsNullOrEmpty(httpsProxyAddress) && Uri.TryCreate(httpsProxyAddress, UriKind.Absolute, out var proxyHttpsUri))
             {
-                _httpsProxyAddress = proxyHttpsUri.AbsoluteUri;
+                _httpsProxyAddress = proxyHttpsUri.OriginalString;
 
                 // Set both environment variables since there are tools support both casing (curl, wget) and tools support only one casing (docker)
                 Environment.SetEnvironmentVariable("HTTPS_PROXY", _httpsProxyAddress);

src/Runner.Sdk/Util/UrlUtil.cs

@@ -4,6 +4,13 @@ namespace GitHub.Runner.Sdk
 {
     public static class UrlUtil
     {
+        public static bool IsHostedServer(UriBuilder gitHubUrl)
+        {
+            return string.Equals(gitHubUrl.Host, "github.com", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(gitHubUrl.Host, "www.github.com", StringComparison.OrdinalIgnoreCase) ||
+                string.Equals(gitHubUrl.Host, "github.localhost", StringComparison.OrdinalIgnoreCase);
+        }
+
         public static Uri GetCredentialEmbeddedUrl(Uri baseUrl, string username, string password)
         {
             ArgUtil.NotNull(baseUrl, nameof(baseUrl));

src/Runner.Worker/ActionCommandManager.cs

@@ -1,4 +1,5 @@
 using GitHub.DistributedTask.Pipelines;
+using GitHub.DistributedTask.Pipelines.ContextData;
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Worker.Container;
@@ -183,11 +184,48 @@ namespace GitHub.Runner.Worker
 
         public void ProcessCommand(IExecutionContext context, string line, ActionCommand command, ContainerInfo container)
         {
+            var allowUnsecureCommands = false;
+            bool.TryParse(Environment.GetEnvironmentVariable(Constants.Variables.Actions.AllowUnsupportedCommands), out allowUnsecureCommands);
+
+            // Apply environment from env context, env context contains job level env and action's env block
+#if OS_WINDOWS
+            var envContext = context.ExpressionValues["env"] as DictionaryContextData;
+#else
+            var envContext = context.ExpressionValues["env"] as CaseSensitiveDictionaryContextData;
+#endif
+            if (!allowUnsecureCommands && envContext.ContainsKey(Constants.Variables.Actions.AllowUnsupportedCommands))
+            {
+                bool.TryParse(envContext[Constants.Variables.Actions.AllowUnsupportedCommands].ToString(), out allowUnsecureCommands);
+            }
+
+            if (!allowUnsecureCommands)
+            {
+                throw new Exception(String.Format(Constants.Runner.UnsupportedCommandMessageDisabled, this.Command));
+            }
+
             if (!command.Properties.TryGetValue(SetEnvCommandProperties.Name, out string envName) || string.IsNullOrEmpty(envName))
             {
                 throw new Exception("Required field 'name' is missing in ##[set-env] command.");
             }
 
+
+            foreach (var blocked in _setEnvBlockList)
+            {
+                if (string.Equals(blocked, envName, StringComparison.OrdinalIgnoreCase))
+                {
+                    // Log Telemetry and let user know they shouldn't do this
+                    var issue = new Issue()
+                    {
+                        Type = IssueType.Error,
+                        Message = $"Can't update {blocked} environment variable using ::set-env:: command."
+                    };
+                    issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = $"{Constants.Runner.UnsupportedCommand}_{envName}";
+                    context.AddIssue(issue);
+
+                    return;
+                }
+            }
+
             context.Global.EnvironmentVariables[envName] = command.Data;
             context.SetEnvContext(envName, command.Data);
             context.Debug($"{envName}='{command.Data}'");
@@ -197,6 +235,11 @@ namespace GitHub.Runner.Worker
         {
             public const String Name = "name";
         }
+
+        private string[] _setEnvBlockList = 
+        {
+            "NODE_OPTIONS"
+        };
     }
 
     public sealed class SetOutputCommandExtension : RunnerService, IActionCommandExtension
@@ -282,6 +325,25 @@ namespace GitHub.Runner.Worker
 
         public void ProcessCommand(IExecutionContext context, string line, ActionCommand command, ContainerInfo container)
         {          
+            var allowUnsecureCommands = false;
+            bool.TryParse(Environment.GetEnvironmentVariable(Constants.Variables.Actions.AllowUnsupportedCommands), out allowUnsecureCommands);
+
+            // Apply environment from env context, env context contains job level env and action's env block
+#if OS_WINDOWS
+            var envContext = context.ExpressionValues["env"] as DictionaryContextData;
+#else
+            var envContext = context.ExpressionValues["env"] as CaseSensitiveDictionaryContextData;
+#endif
+            if (!allowUnsecureCommands && envContext.ContainsKey(Constants.Variables.Actions.AllowUnsupportedCommands))
+            {
+                bool.TryParse(envContext[Constants.Variables.Actions.AllowUnsupportedCommands].ToString(), out allowUnsecureCommands);
+            }
+
+            if (!allowUnsecureCommands)
+            {
+                throw new Exception(String.Format(Constants.Runner.UnsupportedCommandMessageDisabled, this.Command));
+            }
+
             ArgUtil.NotNullOrEmpty(command.Data, "path");
             context.Global.PrependPath.RemoveAll(x => string.Equals(x, command.Data, StringComparison.CurrentCulture));
             context.Global.PrependPath.Add(command.Data);

src/Runner.Worker/ActionManager.cs

@@ -594,7 +594,9 @@ namespace GitHub.Runner.Worker
                     actionDownloadInfos = await jobServer.ResolveActionDownloadInfoAsync(executionContext.Global.Plan.ScopeIdentifier, executionContext.Global.Plan.PlanType, executionContext.Global.Plan.PlanId, new WebApi.ActionReferenceList { Actions = actionReferences }, executionContext.CancellationToken);
                     break;
                 }
-                catch (Exception ex) when (attempt < 3)
+                catch (Exception ex) when (!executionContext.CancellationToken.IsCancellationRequested) // Do not retry if the run is canceled.
+                {
+                    if (attempt < 3)
                     {
                         executionContext.Output($"Failed to resolve action download info. Error: {ex.Message}");
                         executionContext.Debug(ex.ToString());
@@ -605,6 +607,22 @@ namespace GitHub.Runner.Worker
                             await Task.Delay(backoff);
                         }
                     }
+                    else
+                    {
+                        // Some possible cases are:
+                        // * Repo is rate limited
+                        // * Repo or tag doesn't exist, or isn't public
+                        if (ex is WebApi.UnresolvableActionDownloadInfoException)
+                        {
+                            throw;
+                        }
+                        else
+                        {
+                            // This exception will be traced as an infrastructure failure
+                            throw new WebApi.FailedToResolveActionDownloadInfoException("Failed to resolve action download info.", ex);
+                        }
+                    }
+                }
             }
 
             ArgUtil.NotNull(actionDownloadInfos, nameof(actionDownloadInfos));

src/Runner.Worker/ActionRunner.cs

@@ -135,6 +135,19 @@ namespace GitHub.Runner.Worker
                 ExecutionContext.SetGitHubContext("event_path", workflowFile);
             }
 
+            // Set GITHUB_ACTION_REPOSITORY if this Action is from a repository
+            if (Action.Reference is Pipelines.RepositoryPathReference repoPathReferenceAction &&
+                !string.Equals(repoPathReferenceAction.RepositoryType, Pipelines.PipelineConstants.SelfAlias, StringComparison.OrdinalIgnoreCase))
+            {
+                ExecutionContext.SetGitHubContext("action_repository", repoPathReferenceAction.Name);
+                ExecutionContext.SetGitHubContext("action_ref", repoPathReferenceAction.Ref);
+            }
+            else
+            {
+                ExecutionContext.SetGitHubContext("action_repository", null);
+                ExecutionContext.SetGitHubContext("action_ref", null);
+            }
+
             // Setup container stephost for running inside the container.
             if (ExecutionContext.Global.Container != null)
             {

src/Runner.Worker/Container/ContainerInfo.cs

@@ -21,6 +21,11 @@ namespace GitHub.Runner.Worker.Container
         {
         }
 
+        public ContainerInfo(IHostContext hostContext)
+        {
+            UpdateWebProxyEnv(hostContext.WebProxy);
+        }
+
         public ContainerInfo(IHostContext hostContext, Pipelines.JobContainer container, bool isJobContainer = true, string networkAlias = null)
         {
             this.ContainerName = container.Alias;

src/Runner.Worker/ExecutionContext.cs

@@ -48,6 +48,7 @@ namespace GitHub.Runner.Worker
 
         Dictionary<string, string> IntraActionState { get; }
         Dictionary<string, VariableValue> JobOutputs { get; }
+        ActionsEnvironmentReference ActionsEnvironment { get; }
         DictionaryContextData ExpressionValues { get; }
         IList<IFunctionInfo> ExpressionFunctions { get; }
         JobContext JobContext { get; }
@@ -137,6 +138,8 @@ namespace GitHub.Runner.Worker
         public CancellationToken CancellationToken => _cancellationTokenSource.Token;
         public Dictionary<string, string> IntraActionState { get; private set; }
         public Dictionary<string, VariableValue> JobOutputs { get; private set; }
+
+        public ActionsEnvironmentReference ActionsEnvironment { get; private set; }
         public DictionaryContextData ExpressionValues { get; } = new DictionaryContextData();
         public IList<IFunctionInfo> ExpressionFunctions { get; } = new List<IFunctionInfo>();
 
@@ -611,6 +614,9 @@ namespace GitHub.Runner.Worker
             // Job Outputs
             JobOutputs = new Dictionary<string, VariableValue>(StringComparer.OrdinalIgnoreCase);
 
+            // Actions environment
+            ActionsEnvironment = message.ActionsEnvironment;
+
             // Service container info
             Global.ServiceContainers = new List<ContainerInfo>();
 
@@ -718,7 +724,6 @@ namespace GitHub.Runner.Worker
             }
 
             _jobServerQueue.QueueWebConsoleLine(_record.Id, msg, totalLines);
-            
             return totalLines;
         }
 
@@ -913,6 +918,12 @@ namespace GitHub.Runner.Worker
             context.AddIssue(new Issue() { Type = IssueType.Error, Message = message });
         }
 
+        // Do not add a format string overload. See comment on ExecutionContext.Write().
+        public static void InfrastructureError(this IExecutionContext context, string message)
+        {
+            context.AddIssue(new Issue() { Type = IssueType.Error, Message = message, IsInfrastructureIssue = true});
+        }
+
         // Do not add a format string overload. See comment on ExecutionContext.Write().
         public static void Warning(this IExecutionContext context, string message)
         {

src/Runner.Worker/GitHubContext.cs

@@ -10,6 +10,8 @@ namespace GitHub.Runner.Worker
         {
             "action",
             "action_path",
+            "action_ref",
+            "action_repository",
             "actor",
             "api_url",
             "base_ref",
@@ -23,6 +25,7 @@ namespace GitHub.Runner.Worker
             "ref",
             "repository",
             "repository_owner",
+            "retention_days",
             "run_id",
             "run_number",
             "server_url",

src/Runner.Worker/Handlers/ContainerActionHandler.cs

@@ -70,7 +70,7 @@ namespace GitHub.Runner.Worker.Handlers
             }
 
             // run container
-            var container = new ContainerInfo()
+            var container = new ContainerInfo(HostContext)
             {
                 ContainerImage = Data.Image,
                 ContainerName = ExecutionContext.Id.ToString("N"),

src/Runner.Worker/JobExtension.cs

@@ -5,6 +5,7 @@ using System.Globalization;
 using System.IO;
 using System.Linq;
 using System.Runtime.Serialization;
+using System.Threading;
 using System.Threading.Tasks;
 using GitHub.DistributedTask.Expressions2;
 using GitHub.DistributedTask.ObjectTemplating.Tokens;
@@ -41,6 +42,8 @@ namespace GitHub.Runner.Worker
         private readonly HashSet<string> _existingProcesses = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
         private bool _processCleanup;
         private string _processLookupId = $"github_{Guid.NewGuid()}";
+        private CancellationTokenSource _diskSpaceCheckToken = new CancellationTokenSource();
+        private Task _diskSpaceCheckTask = null;
 
         // Download all required actions.
         // Make sure all condition inputs are valid.
@@ -74,6 +77,10 @@ namespace GitHub.Runner.Worker
                         {
                             // print out HostName for self-hosted runner
                             context.Output($"Runner name: '{setting.AgentName}'");
+                            if (message.Variables.TryGetValue("system.runnerGroupName", out VariableValue runnerGroupName))
+                            {
+                                context.Output($"Runner group name: '{runnerGroupName.Value}'");
+                            }
                             context.Output($"Machine name: '{Environment.MachineName}'");
                         }
                     }
@@ -321,6 +328,12 @@ namespace GitHub.Runner.Worker
                         }
                     }
 
+                    jobContext.Global.EnvironmentVariables.TryGetValue(Constants.Runner.Features.DiskSpaceWarning, out var enableWarning);
+                    if (StringUtil.ConvertToBoolean(enableWarning, defaultValue: true))
+                    {
+                        _diskSpaceCheckTask = CheckDiskSpaceAsync(context, _diskSpaceCheckToken.Token);
+                    }
+
                     return steps;
                 }
                 catch (OperationCanceledException ex) when (jobContext.CancellationToken.IsCancellationRequested)
@@ -331,6 +344,14 @@ namespace GitHub.Runner.Worker
                     context.Result = TaskResult.Canceled;
                     throw;
                 }
+                catch (FailedToResolveActionDownloadInfoException ex)
+                {
+                    // Log the error and fail the JobExtension Initialization.
+                    Trace.Error($"Caught exception from JobExtenion Initialization: {ex}");
+                    context.InfrastructureError(ex.Message);
+                    context.Result = TaskResult.Failed;
+                    throw;
+                }
                 catch (Exception ex)
                 {
                     // Log the error and fail the JobExtension Initialization.
@@ -361,15 +382,8 @@ namespace GitHub.Runner.Worker
                     context.Start();
                     context.Debug("Starting: Complete job");
 
-                    // Evaluate job outputs
-                    if (message.JobOutputs != null && message.JobOutputs.Type != TokenType.Null)
-                    {
-                        try
-                        {
-                            context.Output($"Evaluate and set job outputs");
+                    Trace.Info("Initialize Env context");
 
-                            // Populate env context for each step
-                            Trace.Info("Initialize Env context for evaluating job outputs");
 #if OS_WINDOWS
                     var envContext = new DictionaryContextData();
 #else
@@ -381,10 +395,21 @@ namespace GitHub.Runner.Worker
                         envContext[pair.Key] = new StringContextData(pair.Value ?? string.Empty);
                     }
 
-                            Trace.Info("Initialize steps context for evaluating job outputs");
+                    // Populate env context for each step
+                    Trace.Info("Initialize steps context");
                     context.ExpressionValues["steps"] = context.Global.StepsContext.GetScope(context.ScopeName);
 
                     var templateEvaluator = context.ToPipelineTemplateEvaluator();
+                    // Evaluate job outputs
+                    if (message.JobOutputs != null && message.JobOutputs.Type != TokenType.Null)
+                    {
+                        try
+                        {
+                            context.Output($"Evaluate and set job outputs");
+
+                            // Populate env context for each step
+                            Trace.Info("Initialize Env context for evaluating job outputs");
+
                             var outputs = templateEvaluator.EvaluateJobOutput(message.JobOutputs, context.ExpressionValues, context.ExpressionFunctions);
                             foreach (var output in outputs)
                             {
@@ -413,6 +438,34 @@ namespace GitHub.Runner.Worker
                         }
                     }
 
+                    // Evaluate environment data
+                    if (jobContext.ActionsEnvironment?.Url != null && jobContext.ActionsEnvironment?.Url.Type != TokenType.Null)
+                    {
+                        try
+                        {
+                            context.Output($"Evaluate and set environment url");
+
+                            var environmentUrlToken = templateEvaluator.EvaluateEnvironmentUrl(jobContext.ActionsEnvironment.Url, context.ExpressionValues, context.ExpressionFunctions);
+                            var environmentUrl = environmentUrlToken.AssertString("environment.url");
+                            if (!string.Equals(environmentUrl.Value, HostContext.SecretMasker.MaskSecrets(environmentUrl.Value)))
+                            {
+                                context.Warning($"Skip setting environment url as environment '{jobContext.ActionsEnvironment.Name}' may contain secret.");
+                            }
+                            else
+                            {
+                                context.Output($"Evaluated environment url: {environmentUrl}");
+                                jobContext.ActionsEnvironment.Url = environmentUrlToken;
+                            }
+                        }
+                        catch (Exception ex)
+                        {
+                            context.Result = TaskResult.Failed;
+                            context.Error($"Failed to evaluate environment url");
+                            context.Error(ex);
+                            jobContext.Result = TaskResultUtil.MergeTaskResults(jobContext.Result, TaskResult.Failed);
+                        }
+                    }
+
                     if (context.Global.Variables.GetBoolean(Constants.Variables.Actions.RunnerDebug) ?? false)
                     {
                         Trace.Info("Support log upload starting.");
@@ -485,6 +538,11 @@ namespace GitHub.Runner.Worker
                             }
                         }
                     }
+
+                    if (_diskSpaceCheckTask != null)
+                    {
+                        _diskSpaceCheckToken.Cancel();
+                    }
                 }
                 catch (Exception ex)
                 {
@@ -500,6 +558,39 @@ namespace GitHub.Runner.Worker
             }
         }
 
+        private async Task CheckDiskSpaceAsync(IExecutionContext context, CancellationToken token)
+        {
+            while (!token.IsCancellationRequested)
+            {
+                // Add warning when disk is lower than system.runner.lowdiskspacethreshold from service (default to 100 MB on service side)
+                var lowDiskSpaceThreshold = context.Global.Variables.GetInt(WellKnownDistributedTaskVariables.RunnerLowDiskspaceThreshold);
+                if (lowDiskSpaceThreshold == null)
+                {
+                    Trace.Info($"Low diskspace warning is not enabled.");
+                    return;
+                }
+                var workDirRoot = Directory.GetDirectoryRoot(HostContext.GetDirectory(WellKnownDirectory.Work));
+                var driveInfo = new DriveInfo(workDirRoot);
+                var freeSpaceInMB = driveInfo.AvailableFreeSpace / 1024 / 1024;
+                if (freeSpaceInMB < lowDiskSpaceThreshold)
+                {
+                    var issue = new Issue() { Type = IssueType.Warning, Message = $"You are running out of disk space. The runner will stop working when the machine runs out of disk space. Free space left: {freeSpaceInMB} MB" };
+                    issue.Data[Constants.Runner.InternalTelemetryIssueDataKey] = Constants.Runner.LowDiskSpace;
+                    context.AddIssue(issue);
+                    return;
+                }
+
+                try
+                {
+                    await Task.Delay(10 * 1000, token);
+                }
+                catch (TaskCanceledException)
+                {
+                    // ignore
+                }
+            }
+        }
+
         private Dictionary<int, Process> SnapshotProcesses()
         {
             Dictionary<int, Process> snapshot = new Dictionary<int, Process>();

src/Runner.Worker/JobRunner.cs

@@ -216,7 +216,7 @@ namespace GitHub.Runner.Worker
             }
 
             Trace.Info("Raising job completed event.");
-            var jobCompletedEvent = new JobCompletedEvent(message.RequestId, message.JobId, result, jobContext.JobOutputs);
+            var jobCompletedEvent = new JobCompletedEvent(message.RequestId, message.JobId, result, jobContext.JobOutputs, jobContext.ActionsEnvironment);
 
             var completeJobRetryLimit = 5;
             var exceptions = new List<Exception>();

src/Runner.Worker/Runner.Worker.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>netcoreapp3.1</TargetFramework>
+    <TargetFramework>net5.0</TargetFramework>
     <OutputType>Exe</OutputType>
     <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
     <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Sdk/Common/Common/Authentication/HttpRequestMessageWrapper.cs

@@ -12,29 +12,9 @@ namespace GitHub.Services.Common
             m_request = request;
         }
 
-        public IHttpHeaders Headers
-        {
-            get
-            {
-                return this;
-            }
-        }
-
-        public Uri RequestUri
-        {
-            get
-            {
-                return m_request.RequestUri;
-            }
-        }
-
-        public IDictionary<string, object> Properties
-        {
-            get
-            {
-                return m_request.Properties;
-            }
-        }
+        public IHttpHeaders Headers => this;
+        public Uri RequestUri => m_request.RequestUri;
+        public IDictionary<string,object> Properties => m_request.Options;
 
         IEnumerable<String> IHttpHeaders.GetValues(String name)
         {

src/Sdk/Common/Common/Diagnostics/HttpRequestMessageExtensions.cs

@@ -21,7 +21,7 @@ namespace GitHub.Services.Common.Diagnostics
         public static VssTraceActivity GetActivity(this HttpRequestMessage message)
         {
             Object traceActivity;
-            if (!message.Properties.TryGetValue(VssTraceActivity.PropertyName, out traceActivity))
+            if (!message.Options.TryGetValue(VssTraceActivity.PropertyName, out traceActivity))
             {
                 return VssTraceActivity.Empty;
             }

src/Sdk/Common/Common/VssHttpMessageHandler.cs

@@ -169,7 +169,7 @@ namespace GitHub.Services.Common
             }
 
             // Add ourselves to the message so the underlying token issuers may use it if necessary
-            request.Properties[VssHttpMessageHandler.PropertyName] = this;
+            request.Options.Set(new HttpRequestOptionsKey<VssHttpMessageHandler>(VssHttpMessageHandler.PropertyName), this);
 
             Boolean succeeded = false;
             Boolean lastResponseDemandedProxyAuth = false;
@@ -409,7 +409,7 @@ namespace GitHub.Services.Common
             // Read the completion option provided by the caller. If we don't find the property then we
             // assume it is OK to buffer by default.
             HttpCompletionOption completionOption;
-            if (!request.Properties.TryGetValue(VssHttpRequestSettings.HttpCompletionOptionPropertyName, out completionOption))
+            if (!request.Options.TryGetValue(VssHttpRequestSettings.HttpCompletionOptionPropertyName, out completionOption))
             {
                 completionOption = HttpCompletionOption.ResponseContentRead;
             }

src/Sdk/Common/Common/VssHttpMessageHandlerTraceInfo.cs

@@ -77,9 +77,9 @@ namespace GitHub.Services.Common
         public static void SetTraceInfo(HttpRequestMessage message, VssHttpMessageHandlerTraceInfo traceInfo)
         {
             object existingTraceInfo;
-            if (!message.Properties.TryGetValue(TfsTraceInfoKey, out existingTraceInfo))
+            if (!message.Options.TryGetValue(TfsTraceInfoKey, out existingTraceInfo))
             {
-                message.Properties.Add(TfsTraceInfoKey, traceInfo);
+                message.Options.Set(new HttpRequestOptionsKey<VssHttpMessageHandlerTraceInfo>(TfsTraceInfoKey), traceInfo);
             }
         }
 
@@ -92,7 +92,7 @@ namespace GitHub.Services.Common
         {
             VssHttpMessageHandlerTraceInfo traceInfo = null;
 
-            if (message.Properties.TryGetValue(TfsTraceInfoKey, out object traceInfoObject))
+            if (message.Options.TryGetValue(TfsTraceInfoKey, out object traceInfoObject))
             {
                 traceInfo = traceInfoObject as VssHttpMessageHandlerTraceInfo;
             }

src/Sdk/Common/Common/VssHttpRequestSettings.cs

@@ -291,12 +291,12 @@ namespace GitHub.Services.Common
         protected internal virtual Boolean ApplyTo(HttpRequestMessage request)
         {
             // Make sure we only apply the settings to the request once
-            if (request.Properties.ContainsKey(PropertyName))
+            if (request.Options.TryGetValue(new HttpRequestOptionsKey<VssHttpRequestSettings>(PropertyName), out _))
             {
                 return false;
             }
 
-            request.Properties.Add(PropertyName, this);
+            request.Options.Set(new HttpRequestOptionsKey<VssHttpRequestSettings>(PropertyName), this);
 
             if (this.AcceptLanguages != null && this.AcceptLanguages.Count > 0)
             {

src/Sdk/Common/Common/VssHttpRetryMessageHandler.cs

@@ -55,7 +55,7 @@ namespace GitHub.Services.Common
             // Allow overriding default retry options per request
             VssHttpRetryOptions retryOptions = m_retryOptions;
             object retryOptionsObject;
-            if (request.Properties.TryGetValue(HttpRetryOptionsKey, out retryOptionsObject)) // NETSTANDARD compliant, TryGetValue<T> is not
+            if (request.Options.TryGetValue(HttpRetryOptionsKey, out retryOptionsObject)) // NETSTANDARD compliant, TryGetValue<T> is not
             {
                 // Fallback to default options if object of unexpected type was passed
                 retryOptions = retryOptionsObject as VssHttpRetryOptions ?? m_retryOptions;
@@ -66,7 +66,7 @@ namespace GitHub.Services.Common
 
             IVssHttpRetryInfo retryInfo = null;
             object retryInfoObject;
-            if (request.Properties.TryGetValue(HttpRetryInfoKey, out retryInfoObject)) // NETSTANDARD compliant, TryGetValue<T> is not
+            if (request.Options.TryGetValue(HttpRetryInfoKey, out retryInfoObject)) // NETSTANDARD compliant, TryGetValue<T> is not
             {
                 retryInfo = retryInfoObject as IVssHttpRetryInfo;
             }

src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateConstants.cs

@@ -52,6 +52,7 @@ namespace GitHub.DistributedTask.ObjectTemplating
         internal const String String = "string";
         internal const String StringDefinition = "string-definition";
         internal const String StringDefinitionProperties = "string-definition-properties";
+        internal const String StringRunnerContextNoSecrets = "string-runner-context-no-secrets";
         internal const String Structure = "structure";
         internal const String TemplateSchema = "template-schema";
         internal const String True = "true";

src/Sdk/DTPipelines/Pipelines/AgentJobRequestMessage.cs

@@ -41,7 +41,8 @@ namespace GitHub.DistributedTask.Pipelines
             IEnumerable<JobStep> steps,
             IList<String> fileTable,
             TemplateToken jobOutputs,
-            IList<TemplateToken> defaults)
+            IList<TemplateToken> defaults,
+            ActionsEnvironmentReference actionsEnvironment)
         {
             this.MessageType = JobRequestMessageTypes.PipelineAgentJobRequest;
             this.Plan = plan;
@@ -54,7 +55,7 @@ namespace GitHub.DistributedTask.Pipelines
             this.Resources = jobResources;
             this.Workspace = workspaceOptions;
             this.JobOutputs = jobOutputs;
-
+            this.ActionsEnvironment = actionsEnvironment;
             m_variables = new Dictionary<String, VariableValue>(variables, StringComparer.OrdinalIgnoreCase);
             m_maskHints = new List<MaskHint>(maskHints);
             m_steps = new List<JobStep>(steps);
@@ -228,6 +229,13 @@ namespace GitHub.DistributedTask.Pipelines
             }
         }
 
+        [DataMember(EmitDefaultValue = false)]
+        public ActionsEnvironmentReference ActionsEnvironment
+        {
+            get;
+            set;
+        }
+
         /// <summary>
         /// Gets the collection of variables associated with the current context.
         /// </summary>

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateConstants.cs

@@ -17,6 +17,7 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
         public const String Credentials = "credentials";
         public const String Defaults = "defaults";
         public const String Env = "env";
+        public const String Environment = "environment";
         public const String Event = "event";
         public const String EventPattern = "github.event";
         public const String Exclude = "exclude";

src/Sdk/DTPipelines/Pipelines/ObjectTemplating/PipelineTemplateEvaluator.cs

@@ -279,6 +279,33 @@ namespace GitHub.DistributedTask.Pipelines.ObjectTemplating
             return result;
         }
 
+        public TemplateToken EvaluateEnvironmentUrl(
+            TemplateToken token,
+            DictionaryContextData contextData,
+            IList<IFunctionInfo> expressionFunctions)
+        {
+            var result = default(TemplateToken);
+            if (token != null && token.Type != TokenType.Null)
+            {
+                var context = CreateContext(contextData, expressionFunctions);
+                try
+                {
+                    token = TemplateEvaluator.Evaluate(context, TemplateConstants.StringRunnerContextNoSecrets, token, 0, null, omitHeader: true);
+                    context.Errors.Check();
+                    result = token.AssertString("environment.url");
+                }
+                catch (Exception ex) when (!(ex is TemplateValidationException))
+                {
+                    context.Errors.Add(ex);
+                }
+
+                context.Errors.Check();
+            }
+
+            return result;
+        }
+
+
         public Dictionary<String, String> EvaluateJobDefaultsRun(
             TemplateToken token,
             DictionaryContextData contextData,

src/Sdk/DTPipelines/workflow-v1.0.json

@@ -515,6 +515,20 @@
       "string": {}
     },
 
+    "string-runner-context-no-secrets": {
+      "context": [
+        "github",
+        "needs",
+        "strategy",
+        "matrix",
+        "steps",
+        "job",
+        "runner",
+        "env"
+      ],
+      "string": {}
+    },
+
     "string-steps-context": {
       "context": [
         "github",

src/Sdk/DTWebApi/WebApi/ActionsEnvironmentReference.cs

@@ -0,0 +1,23 @@
+using System.Runtime.Serialization;
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
+
+namespace GitHub.DistributedTask.WebApi
+{
+    /// <summary>
+    /// Information about an environment parsed from YML with evaluated name, URL will be evaluated on runner
+    /// </summary>
+    [DataContract]
+    public class ActionsEnvironmentReference
+    {
+        public ActionsEnvironmentReference(string name)
+        {
+            Name = name;
+        }
+
+        [DataMember(EmitDefaultValue = false)]
+        public string Name { get; set; }
+
+        [DataMember(EmitDefaultValue = false)]
+        public TemplateToken Url { get; set; }
+    }
+}

src/Sdk/DTWebApi/WebApi/Exceptions.cs

@@ -2458,4 +2458,42 @@ namespace GitHub.DistributedTask.WebApi
         {
         }
     }
+
+    [Serializable]
+    public class UnresolvableActionDownloadInfoException : DistributedTaskException
+    {
+        public UnresolvableActionDownloadInfoException(String message)
+            : base(message)
+        {
+        }
+
+        public UnresolvableActionDownloadInfoException(String message, Exception innerException)
+            : base(message, innerException)
+        {
+        }
+
+        protected UnresolvableActionDownloadInfoException(SerializationInfo info, StreamingContext context)
+            : base(info, context)
+        {
+        }
+    }
+
+    [Serializable]
+    public sealed class FailedToResolveActionDownloadInfoException : DistributedTaskException
+    {
+        public FailedToResolveActionDownloadInfoException(String message)
+            : base(message)
+        {
+        }
+
+        public FailedToResolveActionDownloadInfoException(String message, Exception innerException)
+            : base(message, innerException)
+        {
+        }
+
+        private FailedToResolveActionDownloadInfoException(SerializationInfo info, StreamingContext context)
+            : base(info, context)
+        {
+        }
+    }
 }

src/Sdk/DTWebApi/WebApi/Issue.cs

@@ -17,6 +17,7 @@ namespace GitHub.DistributedTask.WebApi
             this.Type = issueToBeCloned.Type;
             this.Category = issueToBeCloned.Category;
             this.Message = issueToBeCloned.Message;
+            this.IsInfrastructureIssue = issueToBeCloned.IsInfrastructureIssue;
 
             if (issueToBeCloned.m_data != null)
             {
@@ -48,6 +49,13 @@ namespace GitHub.DistributedTask.WebApi
             set;
         }
 
+        [DataMember(Order = 4)]
+        public bool? IsInfrastructureIssue
+        {
+            get;
+            set;
+        }
+
         public IDictionary<String, String> Data
         {
             get

src/Sdk/DTWebApi/WebApi/JobEvent.cs

@@ -131,6 +131,17 @@ namespace GitHub.DistributedTask.WebApi
             this.Outputs = outputs;
         }
 
+        public JobCompletedEvent(
+            Int64 requestId,
+            Guid jobId,
+            TaskResult result,
+            Dictionary<String, VariableValue> outputs,
+            ActionsEnvironmentReference actionsEnvironment)
+            : this(requestId, jobId, result, outputs)
+        {
+            this.ActionsEnvironment = actionsEnvironment;
+        }
+
         [DataMember(EmitDefaultValue = false)]
         public Int64 RequestId
         {
@@ -151,6 +162,13 @@ namespace GitHub.DistributedTask.WebApi
             get;
             set;
         }
+
+        [DataMember(EmitDefaultValue = false)]
+        public ActionsEnvironmentReference ActionsEnvironment
+        {
+            get;
+            set;
+        }
     }
 
     [DataContract]

src/Sdk/DTWebApi/WebApi/TaskAgentSession.cs

@@ -65,5 +65,15 @@ namespace GitHub.DistributedTask.WebApi
             get;
             set;
         }
+
+        /// <summary>
+        /// Gets or sets whether to use FIPS compliant encryption scheme for job message key
+        /// </summary>
+        [DataMember]
+        public bool UseFipsEncryption
+        {
+            get;
+            set;
+        }
     }
 }

src/Sdk/DTWebApi/WebApi/TimelineRecordState.cs

@@ -13,5 +13,8 @@ namespace GitHub.DistributedTask.WebApi
 
         [EnumMember]
         Completed,
+
+        [EnumMember]
+        Delayed,
     }
 }

src/Sdk/DTWebApi/WebApi/WellKnownDistributedTaskVariables.cs

@@ -5,5 +5,6 @@ namespace GitHub.DistributedTask.WebApi
     public static class WellKnownDistributedTaskVariables
     {
         public static readonly String JobId = "system.jobId";
+        public static readonly String RunnerLowDiskspaceThreshold = "system.runner.lowdiskspacethreshold";
     }
 }

src/Sdk/Sdk.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
     <PropertyGroup>
-        <TargetFramework>netcoreapp3.1</TargetFramework>
+        <TargetFramework>net5.0</TargetFramework>
         <OutputType>Library</OutputType>
         <RuntimeIdentifiers>win-x64;win-x86;linux-x64;linux-arm64;linux-arm;osx-x64</RuntimeIdentifiers>
         <TargetLatestRuntimePatch>true</TargetLatestRuntimePatch>

src/Sdk/WebApi/WebApi/Jwt/JsonWebTokenUtilities.cs

@@ -130,55 +130,6 @@ namespace GitHub.Services.WebApi.Jwt
             return credentials.SignatureAlgorithm;
         }
 
-        public static ClaimsPrincipal ValidateToken(this JsonWebToken token, JsonWebTokenValidationParameters parameters)
-        {
-            ArgumentUtility.CheckForNull(token, nameof(token));
-            ArgumentUtility.CheckForNull(parameters, nameof(parameters));
-
-            ClaimsIdentity actorIdentity = ValidateActor(token, parameters);
-            ValidateLifetime(token, parameters);
-            ValidateAudience(token, parameters);
-            ValidateSignature(token, parameters);
-            ValidateIssuer(token, parameters);
-
-            ClaimsIdentity identity = new ClaimsIdentity("Federation", parameters.IdentityNameClaimType, ClaimTypes.Role);
-
-            if (actorIdentity != null)
-            {
-                identity.Actor = actorIdentity;
-            }
-
-            IEnumerable<Claim> claims = token.ExtractClaims();
-
-            foreach (Claim claim in claims)
-            {
-                identity.AddClaim(new Claim(claim.Type, claim.Value, claim.ValueType, token.Issuer));
-            }
-
-            return new ClaimsPrincipal(identity);
-        }
-
-        private static ClaimsIdentity ValidateActor(JsonWebToken token, JsonWebTokenValidationParameters parameters)
-        {
-            ArgumentUtility.CheckForNull(token, nameof(token));
-            ArgumentUtility.CheckForNull(parameters, nameof(parameters));
-
-            if (!parameters.ValidateActor)
-            {
-                return null;
-            }
-
-            //this recursive call with check the parameters
-            ClaimsPrincipal principal = token.Actor.ValidateToken(parameters.ActorValidationParameters);
-
-            if (!(principal?.Identity is ClaimsIdentity))
-            {
-                throw new ActorValidationException();
-            }
-
-            return (ClaimsIdentity)principal.Identity;
-        }
-
         private static void ValidateLifetime(JsonWebToken token, JsonWebTokenValidationParameters parameters)
         {
             ArgumentUtility.CheckForNull(token, nameof(token));
@@ -241,59 +192,6 @@ namespace GitHub.Services.WebApi.Jwt
             throw new InvalidAudienceException(); //validation exception;            
         }
 
-        private static void ValidateSignature(JsonWebToken token, JsonWebTokenValidationParameters parameters)
-        {
-            ArgumentUtility.CheckForNull(token, nameof(token));
-            ArgumentUtility.CheckForNull(parameters, nameof(parameters));
-
-            if (!parameters.ValidateSignature)
-            {
-                return;
-            }
-
-            string encodedData = token.EncodedToken;
-
-            string[] parts = encodedData.Split('.');
-
-            if (parts.Length != 3)
-            {
-                throw new InvalidTokenException(JwtResources.EncodedTokenDataMalformed()); //validation exception
-            }
-
-            if (string.IsNullOrEmpty(parts[2]))
-            {
-                throw new InvalidTokenException(JwtResources.SignatureNotFound()); //validation exception
-            }
-
-            if (token.Algorithm == JWTAlgorithm.None)
-            {
-                throw new InvalidTokenException(JwtResources.InvalidSignatureAlgorithm()); //validation exception
-            }
-
-            ArgumentUtility.CheckForNull(parameters.SigningCredentials, nameof(parameters.SigningCredentials));
-
-            //ArgumentUtility.CheckEnumerableForNullOrEmpty(parameters.SigningToken.SecurityKeys, nameof(parameters.SigningToken.SecurityKeys));
-
-            byte[] sourceInput = Encoding.UTF8.GetBytes(string.Format("{0}.{1}", parts[0], parts[1]));
-
-            byte[] sourceSignature = parts[2].FromBase64StringNoPadding();
-
-
-            try
-            {
-                if (parameters.SigningCredentials.VerifySignature(sourceInput, sourceSignature))
-                {
-                    return;
-                }
-            }
-            catch (Exception)
-            {
-                //swallow exceptions here, we'll throw if nothing works...
-            }
-
-            throw new SignatureValidationException(); //valiation exception
-        }
-
         private static void ValidateIssuer(JsonWebToken token, JsonWebTokenValidationParameters parameters)
         {
             ArgumentUtility.CheckForNull(token, nameof(token));

src/Sdk/WebApi/WebApi/VssHttpClientBase.cs

@@ -833,7 +833,7 @@ namespace GitHub.Services.WebApi
             {
                 if (userState != null)
                 {
-                    message.Properties[UserStatePropertyName] = userState;
+                    message.Options.Set(new HttpRequestOptionsKey<object>(UserStatePropertyName), userState);
                 }
                 
                 if (!message.Headers.Contains(Common.Internal.HttpHeaders.VssE2EID))
@@ -842,11 +842,11 @@ namespace GitHub.Services.WebApi
                 }
                 VssHttpEventSource.Log.HttpRequestStart(traceActivity, message);
                 message.Trace();
-                message.Properties[VssTraceActivity.PropertyName] = traceActivity;
+                message.Options.Set(new HttpRequestOptionsKey<VssTraceActivity>(VssTraceActivity.PropertyName), traceActivity);
 
                 // Send the completion option to the inner handler stack so we know when it's safe to buffer
                 // and when we should avoid buffering.
-                message.Properties[VssHttpRequestSettings.HttpCompletionOptionPropertyName] = completionOption;
+                message.Options.Set(new HttpRequestOptionsKey<HttpCompletionOption>(VssHttpRequestSettings.HttpCompletionOptionPropertyName), completionOption);
 
                 //ConfigureAwait(false) enables the continuation to be run outside
                 //any captured SyncronizationContext (such as ASP.NET's) which keeps things

src/Sdk/WebApi/WebApi/VssRequestTimerTrace.cs

@@ -18,7 +18,7 @@ namespace GitHub.Services.WebApi
         {
             Object tracerObj = null;
             VssRequestTimerTrace tracer = null;
-            if (request.Properties.TryGetValue(tracerKey, out tracerObj))
+            if (request.Options.TryGetValue(tracerKey, out tracerObj))
             {
                 tracer = tracerObj as VssRequestTimerTrace;
                 Debug.Assert(tracer != null, "Tracer object is the wrong type!");
@@ -26,7 +26,7 @@ namespace GitHub.Services.WebApi
             else
             {
                 tracer = new VssRequestTimerTrace();
-                request.Properties[tracerKey] = tracer;
+                request.Options.Set(new HttpRequestOptionsKey<VssRequestTimerTrace>(tracerKey), tracer);
             }
 
             if (tracer != null)
@@ -39,7 +39,7 @@ namespace GitHub.Services.WebApi
         {
             Object tracerObj = null;
             VssRequestTimerTrace tracer = null;
-            if (response.RequestMessage.Properties.TryGetValue(tracerKey, out tracerObj))
+            if (response.RequestMessage.Options.TryGetValue(tracerKey, out tracerObj))
             {
                 tracer = tracerObj as VssRequestTimerTrace;
                 Debug.Assert(tracer != null, "Tracer object is the wrong type!");

src/Sdk/WebApi/WebApi/VssSigningCredentials.cs

@@ -1,7 +1,6 @@
 using System;
 using System.Collections.Generic;
 using System.Security.Cryptography;
-using System.Security.Cryptography.X509Certificates;
 using GitHub.Services.Common;
 using GitHub.Services.WebApi.Jwt;
 
@@ -75,7 +74,6 @@ namespace GitHub.Services.WebApi
             {
                 throw new InvalidOperationException();
             }
-
             return GetSignature(input);
         }
 
@@ -86,48 +84,13 @@ namespace GitHub.Services.WebApi
         /// <returns>A blob of data representing the signature of the input data</returns>
         protected abstract Byte[] GetSignature(Byte[] input);
 
-        /// <summary>
-        /// Verifies the signature of the input data, returning true if the signature is valid.
-        /// </summary>
-        /// <param name="input">The data which should be signed</param>
-        /// <param name="signature">The signature which should be verified</param>
-        /// <returns>True if the provided signature matches the current signing token; otherwise, false</returns>
-        public abstract Boolean VerifySignature(Byte[] input, Byte[] signature);
-
-        /// <summary>
-        /// Creates a new <c>VssSigningCredentials</c> instance using the specified <paramref name="certificate"/> instance
-        /// as the signing key.
-        /// </summary>
-        /// <param name="certificate">The certificate which contains the key used for signing and verification</param>
-        /// <returns>A new <c>VssSigningCredentials</c> instance which uses the specified certificate for signing</returns>
-        public static VssSigningCredentials Create(X509Certificate2 certificate)
-        {
-            ArgumentUtility.CheckForNull(certificate, nameof(certificate));
-
-            if (certificate.HasPrivateKey)
-            {
-                var rsa = certificate.GetRSAPrivateKey();
-                if (rsa == null)
-                {
-                    throw new SignatureAlgorithmUnsupportedException(certificate.SignatureAlgorithm.FriendlyName);
-                }
-
-                if (rsa.KeySize < c_minKeySize)
-                {
-                    throw new InvalidCredentialsException(JwtResources.SigningTokenKeyTooSmall());
-                }
-            }
-
-            return new X509Certificate2SigningToken(certificate);
-        }
-
         /// <summary>
         /// Creates a new <c>VssSigningCredentials</c> instance using the specified <paramref name="factory"/> 
         /// callback function to retrieve the signing key.
         /// </summary>
         /// <param name="factory">The factory which creates <c>RSA</c> keys used for signing and verification</param>
         /// <returns>A new <c>VssSigningCredentials</c> instance which uses the specified provider for signing</returns>
-        public static VssSigningCredentials Create(Func<RSA> factory)
+        public static VssSigningCredentials Create(Func<RSA> factory, bool requireFipsCryptography)
         {
             ArgumentUtility.CheckForNull(factory, nameof(factory));
 
@@ -143,22 +106,12 @@ namespace GitHub.Services.WebApi
                     throw new InvalidCredentialsException(JwtResources.SigningTokenKeyTooSmall());
                 }
 
-                return new RSASigningToken(factory, rsa.KeySize);
-            }
-        }
-
-        /// <summary>
-        /// Creates a new <c>VssSigningCredentials</c> instance using the specified <paramref name="key"/> as the signing 
-        /// key. The returned signing token performs symmetric key signing and verification.
-        /// </summary>
-        /// <param name="rsa">The key used for signing and verification</param>
-        /// <returns>A new <c>VssSigningCredentials</c> instance which uses the specified key for signing</returns>
-        public static VssSigningCredentials Create(Byte[] key)
+                if (requireFipsCryptography)
                 {
-            ArgumentUtility.CheckForNull(key, nameof(key));
-
-            // Probably should have validation here, but there was none previously
-            return new SymmetricKeySigningToken(key);
+                    return new RSASigningToken(factory, rsa.KeySize, RSASignaturePadding.Pss);
+                }
+                return new RSASigningToken(factory, rsa.KeySize, RSASignaturePadding.Pkcs1);
+            }
         }
 
         private const Int32 c_minKeySize = 2048;
@@ -166,57 +119,6 @@ namespace GitHub.Services.WebApi
 
 #region Concrete Implementations
 
-        private class SymmetricKeySigningToken : VssSigningCredentials
-        {
-            public SymmetricKeySigningToken(Byte[] key)
-            {
-                m_key = new Byte[key.Length];
-                Buffer.BlockCopy(key, 0, m_key, 0, m_key.Length);
-            }
-
-            public override Boolean CanSignData
-            {
-                get
-                {
-                    return true;
-                }
-            }
-
-            public override Int32 KeySize
-            {
-                get
-                {
-                    return m_key.Length * 8;
-                }
-            }
-
-            public override JWTAlgorithm SignatureAlgorithm
-            {
-                get
-                {
-                    return JWTAlgorithm.HS256;
-                }
-            }
-
-            protected override Byte[] GetSignature(Byte[] input)
-            {
-                using (var hash = new HMACSHA256(m_key))
-                {
-                    return hash.ComputeHash(input);
-                }
-            }
-
-            public override Boolean VerifySignature(
-                Byte[] input,
-                Byte[] signature)
-            {
-                var computedSignature = SignData(input);
-                return SecureCompare.TimeInvariantEquals(computedSignature, signature);
-            }
-
-            private readonly Byte[] m_key;
-        }
-
         private abstract class AsymmetricKeySigningToken : VssSigningCredentials
         {
             protected abstract Boolean HasPrivateKey();
@@ -244,70 +146,14 @@ namespace GitHub.Services.WebApi
             private Boolean? m_hasPrivateKey;
         }
 
-        private class X509Certificate2SigningToken : AsymmetricKeySigningToken, IJsonWebTokenHeaderProvider
-        {
-            public X509Certificate2SigningToken(X509Certificate2 certificate)
-            {
-                m_certificate = certificate;
-            }
-
-            public override Int32 KeySize
-            {
-                get
-                {
-                    return m_certificate.GetRSAPublicKey().KeySize;
-                }
-            }
-
-            public override DateTime ValidFrom
-            {
-                get
-                {
-                    return m_certificate.NotBefore;
-                }
-            }
-
-            public override DateTime ValidTo
-            {
-                get
-                {
-                    return m_certificate.NotAfter;
-                }
-            }
-
-            public override Boolean VerifySignature(
-                Byte[] input,
-                Byte[] signature)
-            {
-                var rsa = m_certificate.GetRSAPublicKey();
-                return rsa.VerifyData(input, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
-            }
-
-            protected override Byte[] GetSignature(Byte[] input)
-            {
-                var rsa = m_certificate.GetRSAPrivateKey();
-                return rsa.SignData(input, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
-            }
-
-            protected override Boolean HasPrivateKey()
-            {
-                return m_certificate.HasPrivateKey;
-            }
-
-            void IJsonWebTokenHeaderProvider.SetHeaders(IDictionary<String, Object> headers)
-            {
-                headers[JsonWebTokenHeaderParameters.X509CertificateThumbprint] = m_certificate.GetCertHash().ToBase64StringNoPadding();
-            }
-
-            private readonly X509Certificate2 m_certificate;
-        }
-
         private class RSASigningToken : AsymmetricKeySigningToken
         {
             public RSASigningToken(
                 Func<RSA> factory,
-                Int32 keySize)
+                Int32 keySize,
+                RSASignaturePadding signaturePadding)
             {
+                m_signaturePadding = signaturePadding;
                 m_keySize = keySize;
                 m_factory = factory;
             }
@@ -324,7 +170,7 @@ namespace GitHub.Services.WebApi
             {
                 using (var rsa = m_factory())
                 {
-                    return rsa.SignData(input, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+                    return rsa.SignData(input, HashAlgorithmName.SHA256, m_signaturePadding);
                 }
             }
 
@@ -344,18 +190,9 @@ namespace GitHub.Services.WebApi
                 }
             }
 
-            public override Boolean VerifySignature(
-                Byte[] input,
-                Byte[] signature)
-            {
-                using (var rsa = m_factory())
-                {
-                    return rsa.VerifyData(input, signature, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
-                }
-            }
-
             private readonly Int32 m_keySize;
             private readonly Func<RSA> m_factory;
+            private readonly RSASignaturePadding m_signaturePadding;
         }
 
         #endregion

src/Test/L0/Listener/JobDispatcherL0.cs

@@ -33,7 +33,7 @@ namespace GitHub.Runner.Common.Tests.Listener
             TaskOrchestrationPlanReference plan = new TaskOrchestrationPlanReference();
             TimelineReference timeline = null;
             Guid jobId = Guid.NewGuid();
-            var result = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, "someJob", "someJob", null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+            var result = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, "someJob", "someJob", null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
             result.ContextData["github"] = new Pipelines.ContextData.DictionaryContextData();
             return result;
         }

src/Test/L0/Listener/RunnerL0.cs

@@ -43,7 +43,7 @@ namespace GitHub.Runner.Common.Tests.Listener
             TaskOrchestrationPlanReference plan = new TaskOrchestrationPlanReference();
             TimelineReference timeline = null;
             Guid jobId = Guid.NewGuid();
-            return new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, "test", "test", null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+            return new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, "test", "test", null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
         }
 
         private JobCancelMessage CreateJobCancelMessage()

src/Test/L0/RunnerWebProxyL0.cs

@@ -1,4 +1,4 @@
-using GitHub.Runner.Common.Util;
+using GitHub.Runner.Common.Util;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
@@ -127,11 +127,11 @@ namespace GitHub.Runner.Common.Tests
                 Environment.SetEnvironmentVariable("no_proxy", "github.com, google.com,");
                 var proxy = new RunnerWebProxy();
 
-                Assert.Equal("http://127.0.0.1:8888/", proxy.HttpProxyAddress);
+                Assert.Equal("http://127.0.0.1:8888", proxy.HttpProxyAddress);
                 Assert.Null(proxy.HttpProxyUsername);
                 Assert.Null(proxy.HttpProxyPassword);
 
-                Assert.Equal("http://user:pass@127.0.0.1:9999/", proxy.HttpsProxyAddress);
+                Assert.Equal("http://user:pass@127.0.0.1:9999", proxy.HttpsProxyAddress);
                 Assert.Equal("user", proxy.HttpsProxyUsername);
                 Assert.Equal("pass", proxy.HttpsProxyPassword);
 
@@ -161,11 +161,11 @@ namespace GitHub.Runner.Common.Tests
                 Environment.SetEnvironmentVariable("NO_PROXY", "github.com, google.com,");
                 var proxy = new RunnerWebProxy();
 
-                Assert.Equal("http://127.0.0.1:7777/", proxy.HttpProxyAddress);
+                Assert.Equal("http://127.0.0.1:7777", proxy.HttpProxyAddress);
                 Assert.Null(proxy.HttpProxyUsername);
                 Assert.Null(proxy.HttpProxyPassword);
 
-                Assert.Equal("http://user:pass@127.0.0.1:8888/", proxy.HttpsProxyAddress);
+                Assert.Equal("http://user:pass@127.0.0.1:8888", proxy.HttpsProxyAddress);
                 Assert.Equal("user", proxy.HttpsProxyUsername);
                 Assert.Equal("pass", proxy.HttpsProxyPassword);
 
@@ -218,19 +218,19 @@ namespace GitHub.Runner.Common.Tests
                 Environment.SetEnvironmentVariable("no_proxy", "github.com, google.com,");
                 var proxy = new RunnerWebProxy();
 
-                Assert.Equal("http://user1@127.0.0.1:8888/", proxy.HttpProxyAddress);
+                Assert.Equal("http://user1@127.0.0.1:8888", proxy.HttpProxyAddress);
                 Assert.Equal("user1", proxy.HttpProxyUsername);
                 Assert.Null(proxy.HttpProxyPassword);
 
-                var cred = proxy.Credentials.GetCredential(new Uri("http://user1@127.0.0.1:8888/"), "Basic");
+                var cred = proxy.Credentials.GetCredential(new Uri("http://user1@127.0.0.1:8888"), "Basic");
                 Assert.Equal("user1", cred.UserName);
                 Assert.Equal(string.Empty, cred.Password);
 
-                Assert.Equal("http://user2:pass@127.0.0.1:9999/", proxy.HttpsProxyAddress);
+                Assert.Equal("http://user2:pass@127.0.0.1:9999", proxy.HttpsProxyAddress);
                 Assert.Equal("user2", proxy.HttpsProxyUsername);
                 Assert.Equal("pass", proxy.HttpsProxyPassword);
 
-                cred = proxy.Credentials.GetCredential(new Uri("http://user2:pass@127.0.0.1:9999/"), "Basic");
+                cred = proxy.Credentials.GetCredential(new Uri("http://user2:pass@127.0.0.1:9999"), "Basic");
                 Assert.Equal("user2", cred.UserName);
                 Assert.Equal("pass", cred.Password);
 
@@ -256,19 +256,19 @@ namespace GitHub.Runner.Common.Tests
                 Environment.SetEnvironmentVariable("no_proxy", "github.com, google.com,");
                 var proxy = new RunnerWebProxy();
 
-                Assert.Equal("http://user1:pass1%40@127.0.0.1:8888/", proxy.HttpProxyAddress);
+                Assert.Equal("http://user1:pass1%40@127.0.0.1:8888", proxy.HttpProxyAddress);
                 Assert.Equal("user1", proxy.HttpProxyUsername);
                 Assert.Equal("pass1@", proxy.HttpProxyPassword);
 
-                var cred = proxy.Credentials.GetCredential(new Uri("http://user1:pass1%40@127.0.0.1:8888/"), "Basic");
+                var cred = proxy.Credentials.GetCredential(new Uri("http://user1:pass1%40@127.0.0.1:8888"), "Basic");
                 Assert.Equal("user1", cred.UserName);
                 Assert.Equal("pass1@", cred.Password);
 
-                Assert.Equal("http://user2:pass2%40@127.0.0.1:9999/", proxy.HttpsProxyAddress);
+                Assert.Equal("http://user2:pass2%40@127.0.0.1:9999", proxy.HttpsProxyAddress);
                 Assert.Equal("user2", proxy.HttpsProxyUsername);
                 Assert.Equal("pass2@", proxy.HttpsProxyPassword);
 
-                cred = proxy.Credentials.GetCredential(new Uri("http://user2:pass2%40@127.0.0.1:9999/"), "Basic");
+                cred = proxy.Credentials.GetCredential(new Uri("http://user2:pass2%40@127.0.0.1:9999"), "Basic");
                 Assert.Equal("user2", cred.UserName);
                 Assert.Equal("pass2@", cred.Password);
 
@@ -405,6 +405,36 @@ namespace GitHub.Runner.Common.Tests
             }
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Common")]
+        public void WebProxyFromEnvironmentVariablesWithPort80()
+        {
+            try
+            {
+                Environment.SetEnvironmentVariable("http_proxy", "http://127.0.0.1:80");
+                Environment.SetEnvironmentVariable("https_proxy", "http://user:pass@127.0.0.1:80");
+                Environment.SetEnvironmentVariable("no_proxy", "github.com, google.com,");
+                var proxy = new RunnerWebProxy();
+
+                Assert.Equal("http://127.0.0.1:80", Environment.GetEnvironmentVariable("http_proxy"));
+                Assert.Null(proxy.HttpProxyUsername);
+                Assert.Null(proxy.HttpProxyPassword);
+
+                Assert.Equal("http://user:pass@127.0.0.1:80", Environment.GetEnvironmentVariable("https_proxy"));
+                Assert.Equal("user", proxy.HttpsProxyUsername);
+                Assert.Equal("pass", proxy.HttpsProxyPassword);
+
+                Assert.Equal(2, proxy.NoProxyList.Count);
+                Assert.Equal("github.com", proxy.NoProxyList[0].Host);
+                Assert.Equal("google.com", proxy.NoProxyList[1].Host);
+            }
+            finally
+            {
+                CleanProxyEnv();
+            }
+        }
+
         private void CleanProxyEnv()
         {
             Environment.SetEnvironmentVariable("http_proxy", null);

src/Test/L0/ServiceInterfacesL0.cs

@@ -1,4 +1,5 @@
 using GitHub.Runner.Listener;
+using GitHub.Runner.Listener.Check;
 using GitHub.Runner.Listener.Configuration;
 using GitHub.Runner.Worker;
 using GitHub.Runner.Worker.Handlers;
@@ -21,7 +22,8 @@ namespace GitHub.Runner.Common.Tests
             // Otherwise, the interface needs to whitelisted.
             var whitelist = new[]
             {
-                typeof(ICredentialProvider)
+                typeof(ICredentialProvider),
+                typeof(ICheckExtension),
             };
             Validate(
                 assembly: typeof(IMessageListener).GetTypeInfo().Assembly,
@@ -85,7 +87,8 @@ namespace GitHub.Runner.Common.Tests
                     continue;
                 }
 
-                if (interfaceTypeInfo.FullName.Contains("IConverter")){
+                if (interfaceTypeInfo.FullName.Contains("IConverter"))
+                {
                     continue;
                 }
 

src/Test/L0/Worker/ActionCommandManagerL0.cs

@@ -148,7 +148,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 TimelineReference timeline = new TimelineReference();
                 Guid jobId = Guid.NewGuid();
                 string jobName = "some job name";
-                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
                 jobRequest.Resources.Repositories.Add(new Pipelines.RepositoryResource()
                 {
                     Alias = Pipelines.PipelineConstants.SelfAlias,

src/Test/L0/Worker/ActionManagerL0.cs

@@ -146,7 +146,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 using var stream = File.OpenRead(archiveFile);
                 var mockClientHandler = new Mock<HttpClientHandler>();
                 mockClientHandler.Protected().Setup<Task<HttpResponseMessage>>("SendAsync", ItExpr.Is<HttpRequestMessage>(m => m.RequestUri == new Uri(expectedArchiveLink)), ItExpr.IsAny<CancellationToken>())
-                    .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK) { Content = new StreamContent(stream) });
+                    .ReturnsAsync(() => new HttpResponseMessage(HttpStatusCode.OK) { Content = new StreamContent(stream) });
 
                 var mockHandlerFactory = new Mock<IHttpClientHandlerFactory>();
                 mockHandlerFactory.Setup(p => p.CreateClientHandler(It.IsAny<RunnerWebProxy>())).Returns(mockClientHandler.Object);
@@ -205,9 +205,9 @@ namespace GitHub.Runner.Common.Tests.Worker
                 using var stream = File.OpenRead(archiveFile);
                 var mockClientHandler = new Mock<HttpClientHandler>();
                 mockClientHandler.Protected().Setup<Task<HttpResponseMessage>>("SendAsync", ItExpr.Is<HttpRequestMessage>(m => m.RequestUri == new Uri(builtInArchiveLink)), ItExpr.IsAny<CancellationToken>())
-                    .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.NotFound));
+                    .ReturnsAsync(() => new HttpResponseMessage(HttpStatusCode.NotFound));
                 mockClientHandler.Protected().Setup<Task<HttpResponseMessage>>("SendAsync", ItExpr.Is<HttpRequestMessage>(m => m.RequestUri == new Uri(dotcomArchiveLink)), ItExpr.IsAny<CancellationToken>())
-                    .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.OK) { Content = new StreamContent(stream) });
+                    .ReturnsAsync(() => new HttpResponseMessage(HttpStatusCode.OK) { Content = new StreamContent(stream) });
 
                 var mockHandlerFactory = new Mock<IHttpClientHandlerFactory>();
                 mockHandlerFactory.Setup(p => p.CreateClientHandler(It.IsAny<RunnerWebProxy>())).Returns(mockClientHandler.Object);
@@ -265,7 +265,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 using var stream = File.OpenRead(archiveFile);
                 var mockClientHandler = new Mock<HttpClientHandler>();
                 mockClientHandler.Protected().Setup<Task<HttpResponseMessage>>("SendAsync", ItExpr.IsAny<HttpRequestMessage>(), ItExpr.IsAny<CancellationToken>())
-                    .ReturnsAsync(new HttpResponseMessage(HttpStatusCode.NotFound));
+                    .ReturnsAsync(() => new HttpResponseMessage(HttpStatusCode.NotFound));
 
                 var mockHandlerFactory = new Mock<IHttpClientHandlerFactory>();
                 mockHandlerFactory.Setup(p => p.CreateClientHandler(It.IsAny<RunnerWebProxy>())).Returns(mockClientHandler.Object);

src/Test/L0/Worker/ActionRunnerL0.cs

@@ -333,6 +333,66 @@ namespace GitHub.Runner.Common.Tests.Worker
             _ec.Verify(x => x.AddIssue(It.Is<Issue>(s => s.Message.Contains("Unexpected input(s) 'invalid1', 'invalid2'")), It.IsAny<string>()), Times.Once);
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async void SetGitHubContextActionRepoRef()
+        {
+            //Arrange
+            Setup();
+            var actionId = Guid.NewGuid();
+            var actionInputs = new MappingToken(null, null, null);
+            actionInputs.Add(new StringToken(null, null, null, "input1"), new StringToken(null, null, null, "test1"));
+            actionInputs.Add(new StringToken(null, null, null, "input2"), new StringToken(null, null, null, "test2"));
+            var action = new Pipelines.ActionStep()
+            {
+                Name = "action",
+                Id = actionId,
+                Reference = new Pipelines.RepositoryPathReference()
+                {
+                    Name = "actions/test",
+                    Ref = "master"
+                },
+                Inputs = actionInputs
+            };
+
+            _actionRunner.Action = action;
+
+            Dictionary<string, string> finialInputs = new Dictionary<string, string>();
+            _handlerFactory.Setup(x => x.Create(It.IsAny<IExecutionContext>(), It.IsAny<ActionStepDefinitionReference>(), It.IsAny<IStepHost>(), It.IsAny<ActionExecutionData>(), It.IsAny<Dictionary<string, string>>(), It.IsAny<Dictionary<string, string>>(), It.IsAny<Variables>(), It.IsAny<string>()))
+                           .Callback((IExecutionContext executionContext, Pipelines.ActionStepDefinitionReference actionReference, IStepHost stepHost, ActionExecutionData data, Dictionary<string, string> inputs, Dictionary<string, string> environment, Variables runtimeVariables, string taskDirectory) =>
+                           {
+                               finialInputs = inputs;
+                           })
+                           .Returns(new Mock<IHandler>().Object);
+
+            //Act
+            await _actionRunner.RunAsync();
+
+            //Assert
+            _ec.Verify(x => x.SetGitHubContext("action_repository", "actions/test"), Times.Once);
+            _ec.Verify(x => x.SetGitHubContext("action_ref", "master"), Times.Once);
+
+            action = new Pipelines.ActionStep()
+            {
+                Name = "action",
+                Id = actionId,
+                Reference = new Pipelines.ScriptReference(),
+                Inputs = actionInputs
+            };
+            _actionRunner.Action = action;
+
+            _hc.EnqueueInstance<IDefaultStepHost>(_defaultStepHost.Object);
+            _hc.EnqueueInstance(_fileCommandManager.Object);
+
+            //Act
+            await _actionRunner.RunAsync();
+
+            //Assert
+            _ec.Verify(x => x.SetGitHubContext("action_repository", null), Times.Once);
+            _ec.Verify(x => x.SetGitHubContext("action_ref", null), Times.Once);
+        }
+
         private void Setup([CallerMemberName] string name = "")
         {
             _ecTokenSource?.Dispose();

src/Test/L0/Worker/ExecutionContextL0.cs

@@ -26,7 +26,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 TimelineReference timeline = new TimelineReference();
                 Guid jobId = Guid.NewGuid();
                 string jobName = "some job name";
-                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
                 jobRequest.Resources.Repositories.Add(new Pipelines.RepositoryResource()
                 {
                     Alias = Pipelines.PipelineConstants.SelfAlias,
@@ -102,7 +102,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 TimelineReference timeline = new TimelineReference();
                 Guid jobId = Guid.NewGuid();
                 string jobName = "some job name";
-                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
                 jobRequest.Resources.Repositories.Add(new Pipelines.RepositoryResource()
                 {
                     Alias = Pipelines.PipelineConstants.SelfAlias,
@@ -153,7 +153,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 TimelineReference timeline = new TimelineReference();
                 Guid jobId = Guid.NewGuid();
                 string jobName = "some job name";
-                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
                 jobRequest.Resources.Repositories.Add(new Pipelines.RepositoryResource()
                 {
                     Alias = Pipelines.PipelineConstants.SelfAlias,
@@ -251,7 +251,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 TimelineReference timeline = new TimelineReference();
                 Guid jobId = Guid.NewGuid();
                 string jobName = "some job name";
-                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
                 jobRequest.Resources.Repositories.Add(new Pipelines.RepositoryResource()
                 {
                     Alias = Pipelines.PipelineConstants.SelfAlias,
@@ -335,7 +335,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 TimelineReference timeline = new TimelineReference();
                 Guid jobId = Guid.NewGuid();
                 string jobName = "some job name";
-                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+                var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, jobName, jobName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
                 jobRequest.Resources.Repositories.Add(new Pipelines.RepositoryResource()
                 {
                     Alias = Pipelines.PipelineConstants.SelfAlias,

src/Test/L0/Worker/JobExtensionL0.cs

@@ -8,6 +8,7 @@ using System.Runtime.CompilerServices;
 using System.Threading.Tasks;
 using Xunit;
 using System.Threading;
+using GitHub.DistributedTask.ObjectTemplating.Tokens;
 using Pipelines = GitHub.DistributedTask.Pipelines;
 
 namespace GitHub.Runner.Common.Tests.Worker
@@ -98,7 +99,7 @@ namespace GitHub.Runner.Common.Tests.Worker
             };
 
             Guid jobId = Guid.NewGuid();
-            _message = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, "test", "test", null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), steps, null, null, null);
+            _message = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, "test", "test", null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), steps, null, null, null, null);
             GitHubContext github = new GitHubContext();
             github["repository"] = new Pipelines.ContextData.StringContextData("actions/runner");
             _message.ContextData.Add("github", github);
@@ -281,5 +282,70 @@ namespace GitHub.Runner.Common.Tests.Worker
                     Times.Never);
             }
         }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void EnsureFinalizeJobRunsIfMessageHasNoEnvironmentUrl()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                _message.ActionsEnvironment = new ActionsEnvironmentReference("production");
+
+                _jobEc = new Runner.Worker.ExecutionContext {Result = TaskResult.Succeeded};
+                _jobEc.Initialize(hc);
+                _jobEc.InitializeJob(_message, _tokenSource.Token);
+
+                jobExtension.FinalizeJob(_jobEc, _message, DateTime.UtcNow);
+
+                Assert.Equal(TaskResult.Succeeded, _jobEc.Result);
+            }
+        }
+
+        [Fact] [Trait("Level", "L0")] [Trait("Category", "Worker")]
+        public void EnsureFinalizeJobHandlesNullEnvironmentUrl()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                _message.ActionsEnvironment = new ActionsEnvironmentReference("production")
+                {
+                    Url = null
+                };
+
+                _jobEc = new Runner.Worker.ExecutionContext {Result = TaskResult.Succeeded};
+                _jobEc.Initialize(hc);
+                _jobEc.InitializeJob(_message, _tokenSource.Token);
+
+                jobExtension.FinalizeJob(_jobEc, _message, DateTime.UtcNow);
+
+                Assert.Equal(TaskResult.Succeeded, _jobEc.Result);
+            }
+        }
+
+        [Fact] [Trait("Level", "L0")] [Trait("Category", "Worker")]
+        public void EnsureFinalizeJobHandlesNullEnvironment()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                var jobExtension = new JobExtension();
+                jobExtension.Initialize(hc);
+
+                _message.ActionsEnvironment = null;
+
+                _jobEc = new Runner.Worker.ExecutionContext {Result = TaskResult.Succeeded};
+                _jobEc.Initialize(hc);
+                _jobEc.InitializeJob(_message, _tokenSource.Token);
+
+                jobExtension.FinalizeJob(_jobEc, _message, DateTime.UtcNow);
+
+                Assert.Equal(TaskResult.Succeeded, _jobEc.Result);
+            }
+        }
     }
 }

src/Test/L0/Worker/JobRunnerL0.cs

@@ -60,7 +60,7 @@ namespace GitHub.Runner.Common.Tests.Worker
             TaskOrchestrationPlanReference plan = new TaskOrchestrationPlanReference();
             TimelineReference timeline = new Timeline(Guid.NewGuid());
             Guid jobId = Guid.NewGuid();
-            _message = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, testName, testName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null);
+            _message = new Pipelines.AgentJobRequestMessage(plan, timeline, jobId, testName, testName, null, null, null, new Dictionary<string, VariableValue>(), new List<MaskHint>(), new Pipelines.JobResources(), new Pipelines.ContextData.DictionaryContextData(), new Pipelines.WorkspaceOptions(), new List<Pipelines.ActionStep>(), null, null, null, null);
             _message.Variables[Constants.Variables.System.Culture] = "en-US";
             _message.Resources.Endpoints.Add(new ServiceEndpoint()
             {

src/Test/L0/Worker/WorkerL0.cs

@@ -67,7 +67,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                     new Pipelines.ContextData.DictionaryContextData()
                 },
             };
-            var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, JobId, jobName, jobName, new StringToken(null, null, null, "ubuntu"), sidecarContainers, null, variables, new List<MaskHint>(), resources, context, null, actions, null, null, null);
+            var jobRequest = new Pipelines.AgentJobRequestMessage(plan, timeline, JobId, jobName, jobName, new StringToken(null, null, null, "ubuntu"), sidecarContainers, null, variables, new List<MaskHint>(), resources, context, null, actions, null, null, null, null);
             return jobRequest;
         }