Update releaseVersion

fix workflows (#2143 )
M283 Hotfix for container env escaping (#2138 )
2025-12-10 12:36:23 +00:00 · 2022-09-20 14:23:02 -04:00 · 2022-09-20 14:02:36 -04:00 · 2022-09-20 12:53:33 -04:00 · 2021-10-04 15:10:53 -04:00 · 2021-10-04 14:30:09 -04:00
49 changed files with 817 additions and 171 deletions
--- a/.editorconfig
+++ b/.editorconfig
@@ -0,0 +1,8 @@
+# https://editorconfig.org/
+
+[*]
+insert_final_newline = true # ensure all files end with a single newline
+trim_trailing_whitespace = true # attempt to remove trailing whitespace on save
+
+[*.md]
+trim_trailing_whitespace = false # in markdown, "two trailing spaces" is unfortunately meaningful; it means `<br>`
--- a/.gitattributes
+++ b/.gitattributes
@@ -20,7 +20,7 @@
 #
 # Merging from the command prompt will add diff markers to the files if there
 # are conflicts (Merging from VS is not affected by the settings below, in VS
-# the diff markers are never inserted). Diff markers may cause the following 
+# the diff markers are never inserted). Diff markers may cause the following
 # file extensions to fail to load in VS. An alternative would be to treat
 # these files as binary and thus will always conflict and require user
 # intervention with every merge. To do so, just uncomment the entries below
@@ -70,9 +70,9 @@

 ###############################################################################
 # diff behavior for common document formats
-# 
+#
 # Convert binary document formats to text before diffing them. This feature
-# is only available from the command line. Turn it on by uncommenting the 
+# is only available from the command line. Turn it on by uncommenting the
 # entries below.
 ###############################################################################
 *.doc   diff=astextplain
--- a/.github/ISSUE_TEMPLATE/enhancement_request.md
+++ b/.github/ISSUE_TEMPLATE/enhancement_request.md
@@ -24,4 +24,4 @@ If applicable, add a code snippet.
 **Additional information**
 Add any other context about the feature here.

-NOTE: if the feature request has been agreed upon then the assignee will create an ADR.   See docs/adrs/README.md
+NOTE: if the feature request has been agreed upon then the assignee will create an ADR.   See docs/adrs/README.md
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -7,12 +7,12 @@ on:
    - main
    - releases/*
    paths-ignore:
-    - '**.md'    
+    - '**.md'
  pull_request:
    branches:
    - '*'
    paths-ignore:
-    - '**.md'    
+    - '**.md'

 jobs:
  build:
@@ -37,7 +37,7 @@ jobs:
          devScript: ./dev.sh

        - runtime: win-x64
-          os: windows-latest
+          os: windows-2019
          devScript: ./dev

    runs-on: ${{ matrix.os }}
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,7 +28,7 @@ jobs:
      #   languages: go, javascript, csharp, python, cpp, java

    - name: Manual build
-      run : | 
+      run : |
        ./dev.sh layout Release linux-x64
      working-directory: src

--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,7 +5,7 @@ on:
  push:
    paths:
    - releaseVersion
-  
+
 jobs:
  check:
    if: startsWith(github.ref, 'refs/heads/releases/') || github.ref == 'refs/heads/main'
@@ -13,8 +13,8 @@ jobs:
    steps:
    - uses: actions/checkout@v2

-    # Make sure ./releaseVersion match ./src/runnerversion 
-    # Query GitHub release ensure version is not used 
+    # Make sure ./releaseVersion match ./src/runnerversion
+    # Query GitHub release ensure version is not used
    - name: Check version
      uses: actions/github-script@0.3.0
      with:
@@ -42,7 +42,7 @@ jobs:
              throw e
            }
          }
-  
+
  build:
    needs: check
    outputs:
@@ -72,7 +72,7 @@ jobs:
          devScript: ./dev.sh

        - runtime: win-x64
-          os: windows-latest
+          os: windows-2019
          devScript: ./dev

    runs-on: ${{ matrix.os }}
@@ -152,7 +152,7 @@ jobs:
          releaseNote = releaseNote.replace(/<LINUX_ARM64_SHA>/g, '${{needs.build.outputs.linux-arm64-sha}}')
          console.log(releaseNote)
          core.setOutput('version', runnerVersion);
-          core.setOutput('note', releaseNote);  
+          core.setOutput('note', releaseNote);
    # Create GitHub release
    - uses: actions/create-release@master
      id: createRelease
@@ -164,6 +164,7 @@ jobs:
        release_name: "v${{ steps.releaseNote.outputs.version }}"
        body: |
          ${{ steps.releaseNote.outputs.note }}
+        prerelease: true

    # Upload release assets
    - name: Upload Release Asset (win-x64)
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -54,4 +54,4 @@
            "requireExactSource": false,
        },
    ],
-}
+}
--- a/docs/automate.md
+++ b/docs/automate.md
@@ -21,7 +21,7 @@ export RUNNER_CFG_PAT=yourPAT

 :point_right: [Sample script here](../scripts/create-latest-svc.sh) :point_left:

-Run as a one-liner. NOTE: replace with yourorg/yourrepo (repo level) or just yourorg (org level) 
+Run as a one-liner. NOTE: replace with yourorg/yourrepo (repo level) or just yourorg (org level)
 ```bash
 curl -s https://raw.githubusercontent.com/actions/runner/main/scripts/create-latest-svc.sh | bash -s yourorg/yourrepo
 ```
@@ -47,7 +47,7 @@ curl -s https://raw.githubusercontent.com/actions/runner/main/scripts/create-lat

 The runner is installed as a service using `systemd` and `systemctl`. Docker does not support `systemd` for service configuration on a container.

-## Uninstall running as service 
+## Uninstall running as service

 **Scenario**: Run on a machine or VM ([not container](#why-cant-i-use-a-container)) which automates:

@@ -57,7 +57,7 @@ The runner is installed as a service using `systemd` and `systemctl`. Docker doe

 :point_right: [Sample script here](../scripts/remove-svc.sh) :point_left:

-Repo level one liner.  NOTE: replace with yourorg/yourrepo (repo level) or just yourorg (org level) 
+Repo level one liner.  NOTE: replace with yourorg/yourrepo (repo level) or just yourorg (org level)
 ```bash
 curl -s https://raw.githubusercontent.com/actions/runner/main/scripts/remove-svc.sh | bash -s yourorg/yourrepo
 ```
--- a/docs/checks/actions.md
+++ b/docs/checks/actions.md
@@ -18,16 +18,16 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente

 - DNS lookup for api.github.com or myGHES.com using dotnet
 - Ping api.github.com or myGHES.com using dotnet
- Make HTTP GET to https://api.github.com or https://myGHES.com/api/v3 using dotnet, check response headers contains `X-GitHub-Request-Id` 
+- Make HTTP GET to https://api.github.com or https://myGHES.com/api/v3 using dotnet, check response headers contains `X-GitHub-Request-Id`
 ---
 - DNS lookup for vstoken.actions.githubusercontent.com using dotnet
 - Ping vstoken.actions.githubusercontent.com using dotnet
- Make HTTP GET to https://vstoken.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/vstoken/_apis/health using dotnet, check response headers contains `x-vss-e2eid` 
+- Make HTTP GET to https://vstoken.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/vstoken/_apis/health using dotnet, check response headers contains `x-vss-e2eid`
 ---
 - DNS lookup for pipelines.actions.githubusercontent.com using dotnet
 - Ping pipelines.actions.githubusercontent.com using dotnet
- Make HTTP GET to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid` 
- Make HTTP POST to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid` 
+- Make HTTP GET to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid`
+- Make HTTP POST to https://pipelines.actions.githubusercontent.com/_apis/health or https://myGHES.com/_services/pipelines/_apis/health using dotnet, check response headers contains `x-vss-e2eid`

 ## How to fix the issue?

@@ -42,4 +42,4 @@ Make sure the runner has access to actions service for GitHub.com or GitHub Ente
  
 ## Still not working?

-Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
--- a/docs/checks/git.md
+++ b/docs/checks/git.md
@@ -31,4 +31,4 @@ The test also set environment variable `GIT_TRACE=1` and `GIT_CURL_VERBOSE=1` be
  
 ## Still not working?

-Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
--- a/docs/checks/internet.md
+++ b/docs/checks/internet.md
@@ -13,7 +13,7 @@ Even the runner is configured to GitHub Enterprise Server, the runner can still

 - DNS lookup for api.github.com using dotnet
 - Ping api.github.com using dotnet
- Make HTTP GET to https://api.github.com using dotnet, check response headers contains `X-GitHub-Request-Id` 
+- Make HTTP GET to https://api.github.com using dotnet, check response headers contains `X-GitHub-Request-Id`

 ## How to fix the issue?

@@ -23,4 +23,4 @@ Even the runner is configured to GitHub Enterprise Server, the runner can still

 ## Still not working?

-Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
--- a/docs/checks/network.md
+++ b/docs/checks/network.md
@@ -25,7 +25,7 @@ Use a 3rd party tool to make the same requests as the runner did would be a good

 - Use `nslookup` to check DNS
 - Use `ping` to check Ping
- Use `traceroute`, `tracepath`, or `tracert` to check the network route between the runner and the Actions service 
+- Use `traceroute`, `tracepath`, or `tracert` to check the network route between the runner and the Actions service
 - Use `curl -v` to check the network stack, good for verifying default certificate/proxy settings.
 - Use `Invoke-WebRequest` from `pwsh` (`PowerShell Core`) to check the dotnet network stack, good for verifying bugs in the dotnet framework.

@@ -50,11 +50,12 @@ If you are having trouble connecting, try these steps:
    - The runner runs on .net core, lets validate the local settings for that stack
    - Open up `pwsh`
    - Run the command using the urls above `Invoke-WebRequest {url}`
-3. If not, get a packet trace using a tool like wireshark and start looking at the TLS handshake. 
+3. If not, get a packet trace using a tool like wireshark and start looking at the TLS handshake.
    - If you see a Client Hello followed by a Server RST:
      - You may need to configure your TLS settings to use the correct version
        - You should support TLS version 1.2 or later
      - You may need to configure your TLS settings to have up to date cipher suites, this may be solved by system updates and patches.
+        - Most notably, on windows server 2012 make sure [the tls cipher suite update](https://support.microsoft.com/en-us/topic/update-adds-new-tls-cipher-suites-and-changes-cipher-suite-priorities-in-windows-8-1-and-windows-server-2012-r2-8e395e43-c8ef-27d8-b60c-0fc57d526d94) is installed
      - Your firewall, proxy or network configuration may be blocking the connection
      - You will want to reach out to whoever is in charge of your network with these pcap files to further troubleshoot
    - If you see a failure later in the handshake:
--- a/docs/checks/nodejs.md
+++ b/docs/checks/nodejs.md
@@ -27,4 +27,4 @@ All javascript base Actions will get executed by the built-in `node` at `<runner
  
 ## Still not working?

-Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
+Contact GitHub customer service or log an issue at https://github.com/actions/runner if you think it's a runner issue.
--- a/docs/checks/sslcert.md
+++ b/docs/checks/sslcert.md
@@ -12,7 +12,7 @@ As long as your certificate is generated properly, most of the issues should be
 > !!! DO NOT SKIP SSL CERT VALIDATION !!!  
 > !!! IT IS A BAD SECURITY PRACTICE !!!  

-### Download SSL certificate chain 
+### Download SSL certificate chain

 Depends on how your SSL server certificate gets configured, you might need to download the whole certificate chain from a machine that has trusted the SSL certificate's CA.

@@ -28,7 +28,7 @@ The actions runner is a dotnet core application which will follow how dotnet loa

 You can get full details documentation at [here](https://docs.microsoft.com/en-us/dotnet/standard/security/cross-platform-cryptography#x509store)

-In short: 
+In short:
 - Windows: Load from Windows certificate store.
 - Linux: Load from OpenSSL CA cert bundle.
 - macOS: Load from macOS KeyChain.
@@ -43,13 +43,13 @@ To let the runner trusts your CA certificate, you will need to:
      1. RedHat: https://www.redhat.com/sysadmin/ca-certificates-cli
      2. Ubuntu: http://manpages.ubuntu.com/manpages/focal/man8/update-ca-certificates.8.html
      3. Google search: "trust ca certificate on [linux distribution]"
-      4. If all approaches failed, set environment variable `SSL_CERT_FILE` to the CA bundle `.pem` file we get. 
+      4. If all approaches failed, set environment variable `SSL_CERT_FILE` to the CA bundle `.pem` file we get.
    > To verify cert gets installed properly on Linux, you can try use `curl -v https://sitewithsslissue.com` and `pwsh -Command \"Invoke-WebRequest -Uri https://sitewithsslissue.com\"`

 ### Trust CA certificate for Git CLI

 Git uses various CA bundle file depends on your operation system.
- Git packaged the CA bundle file within the Git installation on Windows 
+- Git packaged the CA bundle file within the Git installation on Windows
 - Git use OpenSSL certificate CA bundle file on Linux and macOS

 You can check where Git check CA file by running:
--- a/docs/contribute.md
+++ b/docs/contribute.md
@@ -12,7 +12,7 @@ Issues in this repository should be for the runner application.  Note that the V

 ## Enhancements and Feature Requests

-We ask that before significant effort is put into code changes, that we have agreement on taking the change before time is invested in code changes. 
+We ask that before significant effort is put into code changes, that we have agreement on taking the change before time is invested in code changes.

 1. Create a feature request.  Once agreed we will take the enhancement
 2. Create an ADR to agree on the details of the change.
@@ -46,9 +46,9 @@ Tip: Make sure your job can run on this runner. The easiest way is to set `runs-


 ## Development Life Cycle
-If you're using VS Code, you can follow [these](contribute/vscode.md) steps instead. 
+If you're using VS Code, you can follow [these](contribute/vscode.md) steps instead.

-### To Build, Test, Layout 
+### To Build, Test, Layout

 Navigate to the `src` directory and run the following command:

--- a/docs/contribute/vscode.md
+++ b/docs/contribute/vscode.md
@@ -4,7 +4,7 @@ These examples use VS Code, but the idea should be similar across all IDEs as lo
 ## Configure

 To successfully start the runner, you need to register it using a repository and a runner registration token.
-Run `Configure` first to build the source code and set up the runner in `_layout`. 
+Run `Configure` first to build the source code and set up the runner in `_layout`.
 Once it's done creating `_layout`, it asks for the url of your repository and your token in the terminal.

 Check [Quickstart](../contribute.md#quickstart-run-a-job-from-a-real-repository) if you don't know how to get this token.
@@ -34,7 +34,7 @@ All the configs below can be found in `.vscode/launch.json`.

 If you launch `Run` or `Run [build]`, it starts a process called `Runner.Listener`.
 This process will receive any job queued on this repository if the job runs on matching labels (e.g `runs-on: self-hosted`).
-Once a job is received, a `Runner.Listener` starts a new process of `Runner.Worker`. 
+Once a job is received, a `Runner.Listener` starts a new process of `Runner.Worker`.
 Since this is a diferent process, you can't use the same debugger session debug it.
 Instead, a parallel debugging session has to be started, using a different launch config.
 Luckily, VS Code supports multiple parallel debugging sessions.
@@ -45,7 +45,7 @@ Because the worker process is usually started by the listener instead of an IDE,
 For this reason, `Runner.Worker` can be configured to wait for a debugger to be attached before it begins any actual work.

 Set the environment variable `GITHUB_ACTIONS_RUNNER_ATTACH_DEBUGGER` to `true` or `1` to enable this wait.
-All worker processes now will wait 20 seconds before they start working on their task. 
+All worker processes now will wait 20 seconds before they start working on their task.

 This gives enough time to attach a debugger by running `Debug Worker`.
 If for some reason you have multiple workers running, run the launch config `Attach` instead.
--- a/docs/design/auth.md
+++ b/docs/design/auth.md
@@ -58,4 +58,4 @@ Authentication in a workflow run to github.com can be accomplished by using the

 Hosted runner authentication differs from self-hosted authentication in that runners do not undergo a registration process, but instead, the hosted runners get the OAuth token directly by reading the `.credentials` file. The scope of this particular token is limited for a given workflow job execution, and the token is revoked as soon as the job is finished.

-![Hosted runner config and start](../res/hosted-config-start.png)
+![Hosted runner config and start](../res/hosted-config-start.png)
--- a/docs/start/envlinux.md
+++ b/docs/start/envlinux.md
@@ -27,7 +27,7 @@ Dependencies is missing for Dotnet Core 3.0
 Execute ./bin/installdependencies.sh to install any missing Dotnet Core 3.0 dependencies.
 ```
 You can easily correct the problem by executing `./bin/installdependencies.sh`.  
-The `installdependencies.sh` script should install all required dependencies on all supported Linux versions   
+The `installdependencies.sh` script should install all required dependencies on all supported Linux versions  
 > Note: The `installdependencies.sh` script will try to use the default package management mechanism on your Linux flavor (ex. `yum`/`apt-get`/`apt`).

 ### Full dependencies list
@@ -35,15 +35,15 @@ The `installdependencies.sh` script should install all required dependencies on
 Debian based OS (Debian, Ubuntu, Linux Mint)

 - liblttng-ust0
- libkrb5-3 
+- libkrb5-3
 - zlib1g
 - libssl1.1, libssl1.0.2 or libssl1.0.0
 - libicu63, libicu60, libicu57 or libicu55

 Fedora based OS (Fedora, Red Hat Enterprise Linux, CentOS, Oracle Linux 7)

- lttng-ust 
- openssl-libs 
+- lttng-ust
+- openssl-libs
 - krb5-libs
 - zlib
 - libicu
--- a/docs/start/envosx.md
+++ b/docs/start/envosx.md
@@ -5,7 +5,7 @@
 ## Supported Versions

  - macOS High Sierra (10.13) and later versions
- 
+
 ## Apple Silicon M1

 The runner is currently not supported on devices with an Apple M1 chip.  
--- a/releaseNote.md
+++ b/releaseNote.md
@@ -1,21 +1,11 @@
 ## Features

- Support the `--ephemeral` flag (#660)
-  - This optional flag will configure the runner to only take one job, and let the service un-configure the runner after that job finishes.
-  - Expect to see more info in the Github API documentation soon. We'll link to those docs directly as they become generally available!
-
 ## Bugs

- Fix a bug in `script/delete` wherein a repo with multiple runners would be unable to find the correct runner (#1268) (#1269)
- Mitigate a race condition when requesting an OIDC `Id_token` (#1320)
- Make client retries more resilient in JobServer (#1316)
+- Fixed an issue where container environment variables names or values could escape the docker command (#2108)

 ## Misc

- Increase readability of colored console output (#1295) (#1319)
- Add more network troubleshooting to the docs (#1325)
- Bump [path-parse](https://github.com/jbgutierrez/path-parse) from 1.0.6 to 1.0.7 (#1256)
-
 ## Windows x64
 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows.

@@ -26,7 +16,7 @@ mkdir \actions-runner ; cd \actions-runner
 # Download the latest runner package
 Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v<RUNNER_VERSION>/actions-runner-win-x64-<RUNNER_VERSION>.zip -OutFile actions-runner-win-x64-<RUNNER_VERSION>.zip
 # Extract the installer
-Add-Type -AssemblyName System.IO.Compression.FileSystem ; 
+Add-Type -AssemblyName System.IO.Compression.FileSystem ;
 [System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-x64-<RUNNER_VERSION>.zip", "$PWD")
 ```

--- a/2
+++ b/2
@@ -1 +1 @@
-2.282.0
+2.283.4
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -1,4 +1,4 @@
 # Sample scripts for self-hosted runners

 Here are some examples to work from if you'd like to automate your use of self-hosted runners.
-See the docs [here](../docs/automate.md).
+See the docs [here](../docs/automate.md).
--- a/src/Misc/layoutbin/update.sh.template
+++ b/src/Misc/layoutbin/update.sh.template
@@ -18,6 +18,8 @@ downloadrunnerversion=_DOWNLOAD_RUNNER_VERSION_
 logfile="_UPDATE_LOG_"
 restartinteractiverunner=_RESTART_INTERACTIVE_RUNNER_

+telemetryfile="$rootfolder/_diag/.telemetry"
+
 # log user who run the script
 date "+[%F %T-%4N] --------whoami--------" >> "$logfile" 2>&1
 whoami >> "$logfile" 2>&1
@@ -118,40 +120,101 @@ then
    exit 1
 fi

-# fix upgrade issue with macOS
+# fix upgrade issue with macOS when running as a service
+attemptedtargetedfix=0
 currentplatform=$(uname | awk '{print tolower($0)}')
-if [[ "$currentplatform" == 'darwin' ]]; then
-    # need a short-term fix for https://github.com/actions/runner/issues/743
-    # we will recreate all the ./externals/node12/bin/node of the past 5 versions
-    # v2.280.3 v2.280.2 v2.280.1 v2.279.0 v2.278.0
-    if [[ ! -e "$rootfolder/externals.2.280.3/node12/bin/node" ]]
+if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
+    # We needed a fix for https://github.com/actions/runner/issues/743
+    # We will recreate the ./externals/node12/bin/node of the past runner version that launched the runnerlistener service
+    # Otherwise mac gatekeeper kills the processes we spawn on creation as we are running a process with no backing file
+
+    # We need the pid for the nodejs loop, get that here, its the parent of the runner C# pid
+    # assumption here is only one process is invoking rootfolder/runsvc.sh
+    procgroup=$(ps x -o pgid,command | grep "$rootfolder/runsvc.sh" | grep -v grep | awk '{print $1}')
+    if [[ $? -eq 0 && -n "$procgroup" ]]
    then
-        mkdir -p "$rootfolder/externals.2.280.3/node12/bin"
-        cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.280.3/node12/bin/node"
+        # inspect the open file handles to find the node process
+        # we can't actually inspect the process using ps because it uses relative paths and doesn't follow symlinks
+        path=$(lsof -a -g "$procgroup" -F n | grep node12/bin/node | grep externals | tail -1 | cut -c2-)
+        if [[ $? -eq 0 && -n "$path" ]]
+        then
+            # trim the last 5 characters of the path '/node'
+            trimmedpath=$(dirname "$path")
+            if [[ $? -eq 0 && -n "$trimmedpath" ]]
+            then
+                attemptedtargetedfix=1
+                # Create the path if it does not exist
+                if [[ ! -e "$path" ]]
+                then
+                    date "+[%F %T-%4N] Creating fallback node at path $path" >> "$logfile" 2>&1
+                    mkdir -p "$trimmedpath"
+                    cp "$rootfolder/externals/node12/bin/node" "$path"
+                else
+                    date "+[%F %T-%4N] Path for fallback node exists, skipping creating $path" >> "$logfile" 2>&1
+                fi
+            else
+                date "+[%F %T-%4N] DarwinRunnerUpgrade: Failed to trim runner path. TrimmedPath: $trimmedpath, path: $path, pgid: $procgroup, root: $rootfolder" >> "$logfile" 2>&1
+                date "+[%F %T-%4N] DarwinRunnerUpgrade: Failed to trim runner path. TrimmedPath: $trimmedpath, path: $path, pgid: $procgroup, root: $rootfolder" >> "$telemetryfile" 2>&1
+            fi
+        else
+            date "+[%F %T-%4N] DarwinRunnerUpgrade: Failed to find runner path. Path: $path, pgid: $procgroup, root: $rootfolder" >> "$logfile" 2>&1
+            date "+[%F %T-%4N] DarwinRunnerUpgrade: Failed to find runner path. Path: $path, pgid: $procgroup, root: $rootfolder" >> "$telemetryfile" 2>&1
+        fi
+    else
+            date "+[%F %T-%4N] DarwinRunnerUpgrade: Failed to find runner pgid. pgid: $procgroup, root: $rootfolder" >> "$logfile" 2>&1
+            date "+[%F %T-%4N] DarwinRunnerUpgrade: Failed to find runner pgid. pgid: $procgroup, root: $rootfolder" >> "$telemetryfile" 2>&1
    fi

-    if [[ ! -e "$rootfolder/externals.2.280.2/node12/bin/node" ]]
+    if [ $attemptedtargetedfix -eq 0 ]
    then
-        mkdir -p "$rootfolder/externals.2.280.2/node12/bin"
-        cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.280.2/node12/bin/node"
-    fi

-    if [[ ! -e "$rootfolder/externals.2.280.1/node12/bin/node" ]]
-    then
-        mkdir -p "$rootfolder/externals.2.280.1/node12/bin"
-        cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.280.1/node12/bin/node"
-    fi
+        date "+[%F %T-%4N] DarwinRunnerUpgrade: Defaulting to old macOS service fix" >> "$logfile" 2>&1
+        date "+[%F %T-%4N] DarwinRunnerUpgrade: Defaulting to old macOS service fix" >> "$telemetryfile" 2>&1
+        if [[ ! -e "$rootfolder/externals.2.280.3/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.280.3/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.280.3/node12/bin/node"
+        fi

-    if [[ ! -e "$rootfolder/externals.2.279.0/node12/bin/node" ]]
-    then
-        mkdir -p "$rootfolder/externals.2.279.0/node12/bin"
-        cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.279.0/node12/bin/node"
-    fi
+        if [[ ! -e "$rootfolder/externals.2.280.2/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.280.2/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.280.2/node12/bin/node"
+        fi

-    if [[ ! -e "$rootfolder/externals.2.278.0/node12/bin/node" ]]
-    then
-        mkdir -p "$rootfolder/externals.2.278.0/node12/bin"
-        cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.278.0/node12/bin/node"
+        if [[ ! -e "$rootfolder/externals.2.280.1/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.280.1/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.280.1/node12/bin/node"
+        fi
+
+        # GHES 3.2
+        if [[ ! -e "$rootfolder/externals.2.279.0/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.279.0/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.279.0/node12/bin/node"
+        fi
+
+        # GHES 3.1.2 or later
+        if [[ ! -e "$rootfolder/externals.2.278.0/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.278.0/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.278.0/node12/bin/node"
+        fi
+
+        # GHES 3.1.0
+        if [[ ! -e "$rootfolder/externals.2.276.1/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.276.1/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.276.1/node12/bin/node"
+        fi
+
+        # GHES 3.0
+        if [[ ! -e "$rootfolder/externals.2.273.5/node12/bin/node" ]]
+        then
+            mkdir -p "$rootfolder/externals.2.273.5/node12/bin"
+            cp "$rootfolder/externals/node12/bin/node" "$rootfolder/externals.2.273.5/node12/bin/node"
+        fi
    fi
 fi

--- a/src/Misc/layoutroot/run.sh
+++ b/src/Misc/layoutroot/run.sh
@@ -43,6 +43,21 @@ else
        else
            sleep 5
        fi
+    elif [[ $returnCode == 4 ]]; then
+        if [ ! -x "$(command -v sleep)" ]; then
+            if [ ! -x "$(command -v ping)" ]; then
+                COUNT="0"
+                while [[ $COUNT != 5000 ]]; do
+                    echo "SLEEP" > /dev/null
+                    COUNT=$[$COUNT+1]
+                done
+            else
+                ping -c 5 127.0.0.1 > /dev/null
+            fi
+        else
+            sleep 5
+        fi
+        "$DIR"/bin/Runner.Listener run $*
    else
        exit $returnCode
    fi
--- a/src/Runner.Common/Constants.cs
+++ b/src/Runner.Common/Constants.cs
@@ -26,6 +26,7 @@ namespace GitHub.Runner.Common
        Certificates,
        Options,
        SetupInfo,
+        Telemetry
    }

    public static class Constants
@@ -128,7 +129,7 @@ namespace GitHub.Runner.Common
                    public static readonly string Ephemeral = "ephemeral";
                    public static readonly string Help = "help";
                    public static readonly string Replace = "replace";
-                    public static readonly string Once = "once"; // TODO: Remove in 10/2021
+                    public static readonly string Once = "once"; // Keep this around since customers still relies on it
                    public static readonly string RunAsService = "runasservice";
                    public static readonly string Unattended = "unattended";
                    public static readonly string Version = "version";
@@ -154,6 +155,7 @@ namespace GitHub.Runner.Common
            public static readonly string LowDiskSpace = "LOW_DISK_SPACE";
            public static readonly string UnsupportedCommand = "UNSUPPORTED_COMMAND";
            public static readonly string UnsupportedCommandMessageDisabled = "The `{0}` command is disabled. Please upgrade to using Environment Files or opt into unsecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_COMMANDS` environment variable to `true`. For more information see: https://github.blog/changelog/2020-10-01-github-actions-deprecating-set-env-and-add-path-commands/";
+            public static readonly string UnsupportedStopCommandTokenDisabled = "You cannot use a endToken that is an empty string, the string 'pause-logging', or another workflow command. For more information see:  https://docs.github.com/en/actions/learn-github-actions/workflow-commands-for-github-actions#example-stopping-and-starting-workflow-commands or opt into insecure command execution by setting the `ACTIONS_ALLOW_UNSECURE_STOPCOMMAND_TOKENS` environment variable to `true`.";
        }

        public static class RunnerEvent
@@ -213,6 +215,7 @@ namespace GitHub.Runner.Common
                // Keep alphabetical
                //
                public static readonly string AllowUnsupportedCommands = "ACTIONS_ALLOW_UNSECURE_COMMANDS";
+                public static readonly string AllowUnsupportedStopCommandTokens = "ACTIONS_ALLOW_UNSECURE_STOPCOMMAND_TOKENS";
                public static readonly string RunnerDebug = "ACTIONS_RUNNER_DEBUG";
                public static readonly string StepDebug = "ACTIONS_STEP_DEBUG";
            }
--- a/src/Runner.Common/HostContext.cs
+++ b/src/Runner.Common/HostContext.cs
@@ -342,6 +342,12 @@ namespace GitHub.Runner.Common
                        GetDirectory(WellKnownDirectory.Root),
                        ".setup_info");
                    break;
+                
+                case WellKnownConfigFile.Telemetry:
+                    path = Path.Combine(
+                        GetDirectory(WellKnownDirectory.Diag),
+                        ".telemetry");
+                    break;

                default:
                    throw new NotSupportedException($"Unexpected well known config file: '{configFile}'");
--- a/src/Runner.Common/JobServer.cs
+++ b/src/Runner.Common/JobServer.cs
@@ -2,19 +2,16 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
-using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
-using GitHub.Runner.Sdk;
 using GitHub.Services.WebApi;
-using GitHub.Services.Common;

 namespace GitHub.Runner.Common
 {
    [ServiceLocator(Default = typeof(JobServer))]
    public interface IJobServer : IRunnerService
    {
-        Task ConnectAsync(Uri jobServerUrl, VssCredentials jobServerCredential, DelegatingHandler[] delegatingHandler = null);
+        Task ConnectAsync(VssConnection jobConnection);

        // logging and console
        Task<TaskLog> AppendLogContentAsync(Guid scopeIdentifier, string hubName, Guid planId, int logId, Stream uploadStream, CancellationToken cancellationToken);
@@ -35,21 +32,20 @@ namespace GitHub.Runner.Common
        private VssConnection _connection;
        private TaskHttpClient _taskClient;

-        public async Task ConnectAsync(Uri jobServerUrl, VssCredentials jobServerCredential, DelegatingHandler[] delegatingHandler = null)
+        public async Task ConnectAsync(VssConnection jobConnection)
        {
-            Trace.Info($"Establishing connection for JobServer");
+            _connection = jobConnection;
            int attemptCount = 5;
-
-            while (attemptCount-- > 0)
+            while (!_connection.HasAuthenticated && attemptCount-- > 0)
            {
                try
                {
-                    await RefreshConnectionAsync(jobServerUrl, jobServerCredential, delegatingHandler);
+                    await _connection.ConnectAsync();
                    break;
                }
                catch (Exception ex) when (attemptCount > 0)
                {
-                    Trace.Info($"Catch exception during connect. {attemptCount} attempts left.");
+                    Trace.Info($"Catch exception during connect. {attemptCount} attemp left.");
                    Trace.Error(ex);
                }

@@ -57,15 +53,6 @@ namespace GitHub.Runner.Common
            }

            _taskClient = _connection.GetClient<TaskHttpClient>();
-        }
-
-        private async Task RefreshConnectionAsync(Uri jobServerUrl, VssCredentials jobServerCredential, DelegatingHandler[] delegatingHandler)
-        {
-            Trace.Info($"Refresh JobServer VssConnection to get on a different AFD node.");
-            _hasConnection = false;
-            _connection?.Dispose();
-            _connection = VssUtil.CreateConnection(jobServerUrl, jobServerCredential, delegatingHandler);
-            await _connection.ConnectAsync();
            _hasConnection = true;
        }

--- a/src/Runner.Common/RunnerServer.cs
+++ b/src/Runner.Common/RunnerServer.cs
@@ -29,8 +29,10 @@ namespace GitHub.Runner.Common
        // Configuration
        Task<TaskAgent> AddAgentAsync(Int32 agentPoolId, TaskAgent agent);
        Task DeleteAgentAsync(int agentPoolId, int agentId);
+        Task DeleteAgentAsync(int agentId);
        Task<List<TaskAgentPool>> GetAgentPoolsAsync(string agentPoolName = null, TaskAgentPoolType poolType = TaskAgentPoolType.Automation);
        Task<List<TaskAgent>> GetAgentsAsync(int agentPoolId, string agentName = null);
+        Task<List<TaskAgent>> GetAgentsAsync(string agentName);
        Task<TaskAgent> ReplaceAgentAsync(int agentPoolId, TaskAgent agent);

        // messagequeue
@@ -252,6 +254,11 @@ namespace GitHub.Runner.Common
            return _genericTaskAgentClient.GetAgentsAsync(agentPoolId, agentName, false);
        }

+        public Task<List<TaskAgent>> GetAgentsAsync(string agentName)
+        {
+            return GetAgentsAsync(0, agentName); // search in all all agentPools
+        }
+
        public Task<TaskAgent> ReplaceAgentAsync(int agentPoolId, TaskAgent agent)
        {
            CheckConnection(RunnerConnectionType.Generic);
@@ -264,6 +271,11 @@ namespace GitHub.Runner.Common
            return _genericTaskAgentClient.DeleteAgentAsync(agentPoolId, agentId);
        }

+        public Task DeleteAgentAsync(int agentId)
+        {
+            return DeleteAgentAsync(0, agentId); // agentPool is ignored server side
+        }
+
        //-----------------------------------------------------------------
        // MessageQueue
        //-----------------------------------------------------------------
--- a/src/Runner.Listener/CommandSettings.cs
+++ b/src/Runner.Listener/CommandSettings.cs
@@ -31,6 +31,7 @@ namespace GitHub.Runner.Listener
            Constants.Runner.CommandLine.Flags.Commit,
            Constants.Runner.CommandLine.Flags.Ephemeral,
            Constants.Runner.CommandLine.Flags.Help,
+            Constants.Runner.CommandLine.Flags.Once,
            Constants.Runner.CommandLine.Flags.Replace,
            Constants.Runner.CommandLine.Flags.RunAsService,
            Constants.Runner.CommandLine.Flags.Unattended,
@@ -68,7 +69,7 @@ namespace GitHub.Runner.Listener
        public bool Version => TestFlag(Constants.Runner.CommandLine.Flags.Version);
        public bool Ephemeral => TestFlag(Constants.Runner.CommandLine.Flags.Ephemeral);

-        // TODO: Remove in 10/2021
+        // Keep this around since customers still relies on it
        public bool RunOnce => TestFlag(Constants.Runner.CommandLine.Flags.Once);

        // Constructor.
--- a/src/Runner.Listener/Configuration/ConfigurationManager.cs
+++ b/src/Runner.Listener/Configuration/ConfigurationManager.cs
@@ -22,6 +22,7 @@ namespace GitHub.Runner.Listener.Configuration
        bool IsConfigured();
        Task ConfigureAsync(CommandSettings command);
        Task UnconfigureAsync(CommandSettings command);
+        void DeleteLocalRunnerConfig();
        RunnerSettings LoadSettings();
    }

@@ -329,6 +330,38 @@ namespace GitHub.Runner.Listener.Configuration
 #endif
        }

+        // Delete .runner and .credentials files
+        public void DeleteLocalRunnerConfig()
+        {
+            bool isConfigured = _store.IsConfigured();
+            bool hasCredentials = _store.HasCredentials();
+            //delete credential config files
+            var currentAction = "Removing .credentials";
+            if (hasCredentials)
+            {
+                _store.DeleteCredential();
+                var keyManager = HostContext.GetService<IRSAKeyManager>();
+                keyManager.DeleteKey();
+                _term.WriteSuccessMessage("Removed .credentials");
+            }
+            else
+            {
+                _term.WriteLine("Does not exist. Skipping " + currentAction);
+            }
+
+            //delete settings config file
+            currentAction = "Removing .runner";
+            if (isConfigured)
+            {
+                _store.DeleteSettings();
+                _term.WriteSuccessMessage("Removed .runner");
+            }
+            else
+            {
+                _term.WriteLine("Does not exist. Skipping " + currentAction);
+            }
+        }
+
        public async Task UnconfigureAsync(CommandSettings command)
        {
            string currentAction = string.Empty;
@@ -382,7 +415,7 @@ namespace GitHub.Runner.Listener.Configuration
                    // Determine the service deployment type based on connection data. (Hosted/OnPremises)
                    await _runnerServer.ConnectAsync(new Uri(settings.ServerUrl), creds);

-                    var agents = await _runnerServer.GetAgentsAsync(settings.PoolId, settings.AgentName);
+                    var agents = await _runnerServer.GetAgentsAsync(settings.AgentName);
                    Trace.Verbose("Returns {0} agents", agents.Count);
                    TaskAgent agent = agents.FirstOrDefault();
                    if (agent == null)
@@ -391,7 +424,7 @@ namespace GitHub.Runner.Listener.Configuration
                    }
                    else
                    {
-                        await _runnerServer.DeleteAgentAsync(settings.PoolId, settings.AgentId);
+                        await _runnerServer.DeleteAgentAsync(settings.AgentId);

                        _term.WriteLine();
                        _term.WriteSuccessMessage("Runner removed successfully");
@@ -402,31 +435,7 @@ namespace GitHub.Runner.Listener.Configuration
                    _term.WriteLine("Cannot connect to server, because config files are missing. Skipping removing runner from the server.");
                }

-                //delete credential config files
-                currentAction = "Removing .credentials";
-                if (hasCredentials)
-                {
-                    _store.DeleteCredential();
-                    var keyManager = HostContext.GetService<IRSAKeyManager>();
-                    keyManager.DeleteKey();
-                    _term.WriteSuccessMessage("Removed .credentials");
-                }
-                else
-                {
-                    _term.WriteLine("Does not exist. Skipping " + currentAction);
-                }
-
-                //delete settings config file
-                currentAction = "Removing .runner";
-                if (isConfigured)
-                {
-                    _store.DeleteSettings();
-                    _term.WriteSuccessMessage("Removed .runner");
-                }
-                else
-                {
-                    _term.WriteLine("Does not exist. Skipping " + currentAction);
-                }
+                DeleteLocalRunnerConfig();
            }
            catch (Exception)
            {
--- a/src/Runner.Listener/JobDispatcher.cs
+++ b/src/Runner.Listener/JobDispatcher.cs
@@ -36,7 +36,10 @@ namespace GitHub.Runner.Listener
    {
        private readonly Lazy<Dictionary<long, TaskResult>> _localRunJobResult = new Lazy<Dictionary<long, TaskResult>>();
        private int _poolId;
-        RunnerSettings _runnerSetting;
+
+        IConfigurationStore _configurationStore;
+
+        RunnerSettings _runnerSettings;
        private static readonly string _workerProcessName = $"Runner.Worker{IOUtil.ExeExtension}";

        // this is not thread-safe
@@ -54,9 +57,9 @@ namespace GitHub.Runner.Listener
            base.Initialize(hostContext);

            // get pool id from config
-            var configurationStore = hostContext.GetService<IConfigurationStore>();
-            _runnerSetting = configurationStore.GetSettings();
-            _poolId = _runnerSetting.PoolId;
+            _configurationStore = hostContext.GetService<IConfigurationStore>();
+            _runnerSettings = _configurationStore.GetSettings();
+            _poolId = _runnerSettings.PoolId;

            int channelTimeoutSeconds;
            if (!int.TryParse(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_CHANNEL_TIMEOUT") ?? string.Empty, out channelTimeoutSeconds))
@@ -510,8 +513,9 @@ namespace GitHub.Runner.Listener

                                    var jobServer = HostContext.GetService<IJobServer>();
                                    VssCredentials jobServerCredential = VssUtil.GetVssCredential(systemConnection);
+                                    VssConnection jobConnection = VssUtil.CreateConnection(systemConnection.Url, jobServerCredential);
+                                    await jobServer.ConnectAsync(jobConnection);

-                                    await jobServer.ConnectAsync(systemConnection.Url, jobServerCredential);
                                    await LogWorkerProcessUnhandledException(jobServer, message, detailInfo);

                                    // Go ahead to finish the job with result 'Failed' if the STDERR from worker is System.IO.IOException, since it typically means we are running out of disk space.
@@ -660,13 +664,15 @@ namespace GitHub.Runner.Listener
                try
                {
                    request = await runnerServer.RenewAgentRequestAsync(poolId, requestId, lockToken, orchestrationId, token);
-
                    Trace.Info($"Successfully renew job request {requestId}, job is valid till {request.LockedUntil.Value}");

                    if (!firstJobRequestRenewed.Task.IsCompleted)
                    {
                        // fire first renew succeed event.
                        firstJobRequestRenewed.TrySetResult(0);
+
+                        // Update settings if the runner name has been changed server-side
+                        UpdateAgentNameIfNeeded(request.ReservedAgent?.Name);
                    }

                    if (encounteringError > 0)
@@ -766,6 +772,27 @@ namespace GitHub.Runner.Listener
            }
        }

+        private void UpdateAgentNameIfNeeded(string agentName)
+        {
+            var isNewAgentName = !string.Equals(_runnerSettings.AgentName, agentName, StringComparison.Ordinal);
+            if (!isNewAgentName || string.IsNullOrEmpty(agentName))
+            {
+                return;
+            }
+
+            _runnerSettings.AgentName = agentName;
+            try
+            {
+                _configurationStore.SaveSettings(_runnerSettings);
+            }
+            catch (Exception ex)
+            {
+                Trace.Error("Cannot update the settings file:");
+                Trace.Error(ex);
+            }
+
+        }
+
        // Best effort upload any logs for this job.
        private async Task TryUploadUnfinishedLogs(Pipelines.AgentJobRequestMessage message)
        {
@@ -790,8 +817,9 @@ namespace GitHub.Runner.Listener

                var jobServer = HostContext.GetService<IJobServer>();
                VssCredentials jobServerCredential = VssUtil.GetVssCredential(systemConnection);
+                VssConnection jobConnection = VssUtil.CreateConnection(systemConnection.Url, jobServerCredential);

-                await jobServer.ConnectAsync(systemConnection.Url, jobServerCredential);
+                await jobServer.ConnectAsync(jobConnection);

                var timeline = await jobServer.GetTimelineAsync(message.Plan.ScopeIdentifier, message.Plan.PlanType, message.Plan.PlanId, message.Timeline.Id, CancellationToken.None);

--- a/src/Runner.Listener/Runner.cs
+++ b/src/Runner.Listener/Runner.cs
@@ -214,7 +214,7 @@ namespace GitHub.Runner.Listener
                    var startupTypeAsString = command.GetStartupType();
                    if (string.IsNullOrEmpty(startupTypeAsString) && configuredAsService)
                    {
-                        // We need try our best to make the startup type accurate 
+                        // We need try our best to make the startup type accurate
                        // The problem is coming from runner autoupgrade, which result an old version service host binary but a newer version runner binary
                        // At that time the servicehost won't pass --startuptype to Runner.Listener while the runner is actually running as service.
                        // We will guess the startup type only when the runner is configured as service and the guess will based on whether STDOUT/STDERR/STDIN been redirect or not
@@ -233,8 +233,14 @@ namespace GitHub.Runner.Listener
                    Trace.Info($"Set runner startup type - {startType}");
                    HostContext.StartupType = startType;

+                    if (command.RunOnce)
+                    {
+                        _term.WriteLine("Warning: '--once' is going to be deprecated in the future, please consider using '--ephemeral' during runner registration.", ConsoleColor.Yellow);
+                        _term.WriteLine("https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling", ConsoleColor.Yellow);
+                    }
+
                    // Run the runner interactively or as service
-                    return await RunAsync(settings, command.RunOnce || settings.Ephemeral);  // TODO: Remove RunOnce later.
+                    return await RunAsync(settings, command.RunOnce || settings.Ephemeral);
                }
                else
                {
@@ -310,6 +316,9 @@ namespace GitHub.Runner.Listener

                IJobDispatcher jobDispatcher = null;
                CancellationTokenSource messageQueueLoopTokenSource = CancellationTokenSource.CreateLinkedTokenSource(HostContext.RunnerShutdownToken);
+                
+                // Should we try to cleanup ephemeral runners
+                bool runOnceJobCompleted = false;
                try
                {
                    var notification = HostContext.GetService<IJobNotification>();
@@ -371,6 +380,7 @@ namespace GitHub.Runner.Listener
                                Task completeTask = await Task.WhenAny(getNextMessage, jobDispatcher.RunOnceJobCompleted.Task);
                                if (completeTask == jobDispatcher.RunOnceJobCompleted.Task)
                                {
+                                    runOnceJobCompleted = true;
                                    Trace.Info("Job has finished at backend, the runner will exit since it is running under onetime use mode.");
                                    Trace.Info("Stop message queue looping.");
                                    messageQueueLoopTokenSource.Cancel();
@@ -478,6 +488,12 @@ namespace GitHub.Runner.Listener
                    }

                    messageQueueLoopTokenSource.Dispose();
+
+                    if (settings.Ephemeral && runOnceJobCompleted)
+                    {
+                        var configManager = HostContext.GetService<IConfigurationManager>();
+                        configManager.DeleteLocalRunnerConfig();
+                    }
                }
            }
            catch (TaskAgentAccessTokenExpiredException)
--- a/src/Runner.Worker/ActionCommandManager.cs
+++ b/src/Runner.Worker/ActionCommandManager.cs
@@ -1,7 +1,5 @@
-using GitHub.DistributedTask.Pipelines;
-using GitHub.DistributedTask.Pipelines.ContextData;
+using GitHub.DistributedTask.Pipelines.ContextData;
 using GitHub.DistributedTask.WebApi;
-using GitHub.Runner.Common.Util;
 using GitHub.Runner.Worker.Container;
 using System;
 using System.Collections.Generic;
@@ -110,11 +108,18 @@ namespace GitHub.Runner.Worker
                    // Stop command
                    if (string.Equals(actionCommand.Command, _stopCommand, StringComparison.OrdinalIgnoreCase))
                    {
-                        context.Output(input);
-                        context.Debug("Paused processing commands until '##[{actionCommand.Data}]' is received");
+                        ValidateStopToken(context, actionCommand.Data);
+
                        _stopToken = actionCommand.Data;
                        _stopProcessCommand = true;
                        _registeredCommands.Add(_stopToken);
+                        if (_stopToken.Length > 6)
+                        {
+                            HostContext.SecretMasker.AddValue(_stopToken);
+                        }
+
+                        context.Output(input);
+                        context.Debug("Paused processing commands until the token you called ::stopCommands:: with is received");
                        return true;
                    }
                    // Found command
@@ -148,7 +153,42 @@ namespace GitHub.Runner.Worker
            return true;
        }

-        internal static bool EnhancedAnnotationsEnabled(IExecutionContext context) {
+        private void ValidateStopToken(IExecutionContext context, string stopToken)
+        {
+#if OS_WINDOWS
+            var envContext = context.ExpressionValues["env"] as DictionaryContextData;
+#else
+            var envContext = context.ExpressionValues["env"] as CaseSensitiveDictionaryContextData;
+#endif
+            var allowUnsecureStopCommandTokens = false;
+            allowUnsecureStopCommandTokens = StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable(Constants.Variables.Actions.AllowUnsupportedStopCommandTokens));
+            if (!allowUnsecureStopCommandTokens && envContext.ContainsKey(Constants.Variables.Actions.AllowUnsupportedStopCommandTokens))
+            {
+                allowUnsecureStopCommandTokens = StringUtil.ConvertToBoolean(envContext[Constants.Variables.Actions.AllowUnsupportedStopCommandTokens].ToString());
+            }
+
+            bool isTokenInvalid = _registeredCommands.Contains(stopToken)
+                || string.IsNullOrEmpty(stopToken)
+                || string.Equals(stopToken, "pause-logging", StringComparison.OrdinalIgnoreCase);
+
+            if (isTokenInvalid)
+            {
+                var telemetry = new JobTelemetry
+                {
+                    Message = $"Invoked ::stopCommand:: with token: [{stopToken}]",
+                    Type = JobTelemetryType.ActionCommand
+                };
+                context.JobTelemetry.Add(telemetry);
+            }
+
+            if (isTokenInvalid && !allowUnsecureStopCommandTokens)
+            {
+                throw new Exception(Constants.Runner.UnsupportedStopCommandTokenDisabled);
+            }
+        }
+
+        internal static bool EnhancedAnnotationsEnabled(IExecutionContext context)
+        {
            return context.Global.Variables.GetBoolean("DistributedTask.EnhancedAnnotations") ?? false;
        }
    }
@@ -252,7 +292,7 @@ namespace GitHub.Runner.Worker
            public const String Name = "name";
        }

-        private string[] _setEnvBlockList = 
+        private string[] _setEnvBlockList =
        {
            "NODE_OPTIONS"
        };
@@ -353,7 +393,7 @@ namespace GitHub.Runner.Worker
        public Type ExtensionType => typeof(IActionCommandExtension);

        public void ProcessCommand(IExecutionContext context, string line, ActionCommand command, ContainerInfo container)
-        {          
+        {
            var allowUnsecureCommands = false;
            bool.TryParse(Environment.GetEnvironmentVariable(Constants.Variables.Actions.AllowUnsupportedCommands), out allowUnsecureCommands);

@@ -542,11 +582,11 @@ namespace GitHub.Runner.Worker
            command.Properties.TryGetValue(IssueCommandProperties.Line, out string line);
            command.Properties.TryGetValue(IssueCommandProperties.Column, out string column);

-            if (!ActionCommandManager.EnhancedAnnotationsEnabled(context)) 
+            if (!ActionCommandManager.EnhancedAnnotationsEnabled(context))
            {
                context.Debug("Enhanced Annotations not enabled on the server. The 'title', 'end_line', and 'end_column' fields are unsupported.");
            }
-            
+
            Issue issue = new Issue()
            {
                Category = "General",
@@ -598,7 +638,7 @@ namespace GitHub.Runner.Worker
            context.AddIssue(issue);
        }

-        public static void ValidateLinesAndColumns(ActionCommand command, IExecutionContext context) 
+        public static void ValidateLinesAndColumns(ActionCommand command, IExecutionContext context)
        {
            command.Properties.TryGetValue(IssueCommandProperties.Line, out string line);
            command.Properties.TryGetValue(IssueCommandProperties.EndLine, out string endLine);
@@ -627,28 +667,28 @@ namespace GitHub.Runner.Worker
                column = endColumn;
            }

-            if (!hasStartLine && hasColumn) 
+            if (!hasStartLine && hasColumn)
            {
                context.Debug($"Invalid {command.Command} command value. '{IssueCommandProperties.Column}' and '{IssueCommandProperties.EndColumn}' can only be set if '{IssueCommandProperties.Line}' value is provided.");
                command.Properties.Remove(IssueCommandProperties.Column);
                command.Properties.Remove(IssueCommandProperties.EndColumn);
            }

-            if (hasEndLine && line != endLine && hasColumn) 
+            if (hasEndLine && line != endLine && hasColumn)
            {
                context.Debug($"Invalid {command.Command} command value. '{IssueCommandProperties.Column}' and '{IssueCommandProperties.EndColumn}' cannot be set if '{IssueCommandProperties.Line}' and '{IssueCommandProperties.EndLine}' are different values.");
                command.Properties.Remove(IssueCommandProperties.Column);
                command.Properties.Remove(IssueCommandProperties.EndColumn);
            }

-            if (hasStartLine && hasEndLine && endLineNumber < lineNumber) 
+            if (hasStartLine && hasEndLine && endLineNumber < lineNumber)
            {
                context.Debug($"Invalid {command.Command} command value. '{IssueCommandProperties.EndLine}' cannot be less than '{IssueCommandProperties.Line}'.");
                command.Properties.Remove(IssueCommandProperties.Line);
                command.Properties.Remove(IssueCommandProperties.EndLine);
            }

-            if (hasStartColumn && hasEndColumn && endColumnNumber < columnNumber) 
+            if (hasStartColumn && hasEndColumn && endColumnNumber < columnNumber)
            {
                context.Debug($"Invalid {command.Command} command value. '{IssueCommandProperties.EndColumn}' cannot be less than '{IssueCommandProperties.Column}'.");
                command.Properties.Remove(IssueCommandProperties.Column);
--- a/src/Runner.Worker/ActionManager.cs
+++ b/src/Runner.Worker/ActionManager.cs
@@ -633,7 +633,12 @@ namespace GitHub.Runner.Worker
                }
                catch (Exception ex) when (!executionContext.CancellationToken.IsCancellationRequested) // Do not retry if the run is canceled.
                {
-                    if (attempt < 3)
+                    // UnresolvableActionDownloadInfoException is a 422 client error, don't retry
+                    // Some possible cases are:
+                    // * Repo is rate limited
+                    // * Repo or tag doesn't exist, or isn't public
+                    // * Policy validation failed
+                    if (attempt < 3 && !(ex is WebApi.UnresolvableActionDownloadInfoException))
                    {
                        executionContext.Output($"Failed to resolve action download info. Error: {ex.Message}");
                        executionContext.Debug(ex.ToString());
@@ -649,6 +654,7 @@ namespace GitHub.Runner.Worker
                        // Some possible cases are:
                        // * Repo is rate limited
                        // * Repo or tag doesn't exist, or isn't public
+                        // * Policy validation failed
                        if (ex is WebApi.UnresolvableActionDownloadInfoException)
                        {
                            throw;
--- a/src/Runner.Worker/Container/DockerCommandManager.cs
+++ b/src/Runner.Worker/Container/DockerCommandManager.cs
@@ -131,11 +131,11 @@ namespace GitHub.Runner.Worker.Container
            {
                if (String.IsNullOrEmpty(env.Value))
                {
-                    dockerOptions.Add($"-e \"{env.Key}\"");
+                    dockerOptions.Add(DockerUtil.CreateEscapedOption("-e", env.Key));
                }
                else
                {
-                    dockerOptions.Add($"-e \"{env.Key}={env.Value.Replace("\"", "\\\"")}\"");
+                    dockerOptions.Add(DockerUtil.CreateEscapedOption("-e", env.Key, env.Value));
                }
            }

@@ -202,7 +202,7 @@ namespace GitHub.Runner.Worker.Container
            {
                // e.g. -e MY_SECRET maps the value into the exec'ed process without exposing
                // the value directly in the command
-                dockerOptions.Add($"-e {env.Key}");
+                dockerOptions.Add(DockerUtil.CreateEscapedOption("-e", env.Key));
            }

            // Watermark for GitHub Action environment
--- a/src/Runner.Worker/Container/DockerUtil.cs
+++ b/src/Runner.Worker/Container/DockerUtil.cs
@@ -6,6 +6,9 @@ namespace GitHub.Runner.Worker.Container
 {
    public class DockerUtil
    {
+        private static readonly Regex QuoteEscape = new Regex(@"(\\*)" + "\"", RegexOptions.Compiled);
+        private static readonly Regex EndOfStringEscape = new Regex(@"(\\+)$", RegexOptions.Compiled);
+
        public static List<PortMapping> ParseDockerPort(IList<string> portMappingLines)
        {
            const string targetPort = "targetPort";
@@ -17,7 +20,7 @@ namespace GitHub.Runner.Worker.Container
            string pattern = $"^(?<{targetPort}>\\d+)/(?<{proto}>\\w+) -> (?<{host}>.+):(?<{hostPort}>\\d+)$";

            List<PortMapping> portMappings = new List<PortMapping>();
-            foreach(var line in portMappingLines)
+            foreach (var line in portMappingLines)
            {
                Match m = Regex.Match(line, pattern, RegexOptions.None, TimeSpan.FromSeconds(1));
                if (m.Success)
@@ -61,5 +64,44 @@ namespace GitHub.Runner.Worker.Container
            }
            return "";
        }
+
+        public static string CreateEscapedOption(string flag, string key)
+        {
+            if (String.IsNullOrEmpty(key))
+            {
+                return "";
+            }
+            return $"{flag} {EscapeString(key)}";
+        }
+
+        public static string CreateEscapedOption(string flag, string key, string value)
+        {
+            if (String.IsNullOrEmpty(key))
+            {
+                return "";
+            }
+            var escapedString = EscapeString($"{key}={value}");
+            return $"{flag} {escapedString}";
+        }
+
+        private static string EscapeString(string value)
+        {
+            if (String.IsNullOrEmpty(value))
+            {
+                return "";
+            }
+            // Dotnet escaping rules are weird here, we can only escape \ if it precedes a "
+            // If a double quotation mark follows two or an even number of backslashes, each proceeding backslash pair is replaced with one backslash and the double quotation mark is removed.
+            // If a double quotation mark follows an odd number of backslashes, including just one, each preceding pair is replaced with one backslash and the remaining backslash is removed; however, in this case the double quotation mark is not removed.
+            // https://docs.microsoft.com/en-us/dotnet/api/system.environment.getcommandlineargs?redirectedfrom=MSDN&view=net-6.0#remarks
+
+            // First, find any \ followed by a " and double the number of \ + 1.
+             value = QuoteEscape.Replace(value, @"$1$1\" + "\"");
+            // Next, what if it ends in `\`, it would escape the end quote. So, we need to detect that at the end of the string and perform the same escape
+            // Luckily, we can just use the $ character with detects the end of string in regex
+            value = EndOfStringEscape.Replace(value, @"$1$1");
+            // Finally, wrap it in quotes
+            return $"\"{value}\"";
+        }
    }
 }
--- a/src/Runner.Worker/ExecutionContext.cs
+++ b/src/Runner.Worker/ExecutionContext.cs
@@ -52,6 +52,7 @@ namespace GitHub.Runner.Worker
        Dictionary<string, VariableValue> JobOutputs { get; }
        ActionsEnvironmentReference ActionsEnvironment { get; }
        List<ActionsStepTelemetry> ActionsStepsTelemetry { get; }
+        List<JobTelemetry> JobTelemetry { get; }
        DictionaryContextData ExpressionValues { get; }
        IList<IFunctionInfo> ExpressionFunctions { get; }
        JobContext JobContext { get; }
@@ -150,6 +151,7 @@ namespace GitHub.Runner.Worker

        public ActionsEnvironmentReference ActionsEnvironment { get; private set; }
        public List<ActionsStepTelemetry> ActionsStepsTelemetry { get; private set; }
+        public List<JobTelemetry> JobTelemetry { get; private set; }
        public DictionaryContextData ExpressionValues { get; } = new DictionaryContextData();
        public IList<IFunctionInfo> ExpressionFunctions { get; } = new List<IFunctionInfo>();

@@ -294,6 +296,7 @@ namespace GitHub.Runner.Worker
            child.ContextName = contextName;
            child.EmbeddedId = embeddedId;
            child.SiblingScopeName = siblingScopeName;
+            child.JobTelemetry = JobTelemetry;
            if (intraActionState == null)
            {
                child.IntraActionState = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
@@ -650,6 +653,8 @@ namespace GitHub.Runner.Worker
            // ActionsStepTelemetry
            ActionsStepsTelemetry = new List<ActionsStepTelemetry>();

+            JobTelemetry = new List<JobTelemetry>();
+
            // Service container info
            Global.ServiceContainers = new List<ContainerInfo>();

--- a/src/Runner.Worker/GitHubContext.cs
+++ b/src/Runner.Worker/GitHubContext.cs
@@ -26,6 +26,7 @@ namespace GitHub.Runner.Worker
            "repository",
            "repository_owner",
            "retention_days",
+            "run_attempt",
            "run_id",
            "run_number",
            "server_url",
--- a/src/Runner.Worker/Handlers/StepHost.cs
+++ b/src/Runner.Worker/Handlers/StepHost.cs
@@ -188,7 +188,7 @@ namespace GitHub.Runner.Worker.Handlers
            {
                // e.g. -e MY_SECRET maps the value into the exec'ed process without exposing
                // the value directly in the command
-                dockerCommandArgs.Add($"-e {env.Key}");
+                dockerCommandArgs.Add(DockerUtil.CreateEscapedOption("-e", env.Key));
            }
            if (!string.IsNullOrEmpty(PrependPath))
            {
--- a/src/Runner.Worker/JobRunner.cs
+++ b/src/Runner.Worker/JobRunner.cs
@@ -7,6 +7,7 @@ using System;
 using System.Collections.Generic;
 using System.IO;
 using System.Linq;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using System.Net.Http;
@@ -48,8 +49,8 @@ namespace GitHub.Runner.Worker
            Trace.Info($"Creating job server with URL: {jobServerUrl}");
            // jobServerQueue is the throttling reporter.
            _jobServerQueue = HostContext.GetService<IJobServerQueue>();
-            
-            await jobServer.ConnectAsync(jobServerUrl, jobServerCredential, new DelegatingHandler[] { new ThrottlingReportHandler(_jobServerQueue) });
+            VssConnection jobConnection = VssUtil.CreateConnection(jobServerUrl, jobServerCredential, new DelegatingHandler[] { new ThrottlingReportHandler(_jobServerQueue) });
+            await jobServer.ConnectAsync(jobConnection);

            _jobServerQueue.Start(message);
            HostContext.WritePerfCounter($"WorkerJobServerQueueStarted_{message.RequestId.ToString()}");
@@ -106,6 +107,9 @@ namespace GitHub.Runner.Worker

                jobContext.SetRunnerContext("os", VarUtil.OS);

+                var runnerSettings = HostContext.GetService<IConfigurationStore>().GetSettings();
+                jobContext.SetRunnerContext("name", runnerSettings.AgentName);
+
                string toolsDirectory = HostContext.GetDirectory(WellKnownDirectory.Tools);
                Directory.CreateDirectory(toolsDirectory);
                jobContext.SetRunnerContext("tool_cache", toolsDirectory);
@@ -225,8 +229,15 @@ namespace GitHub.Runner.Worker
                return result;
            }

+            // Load any upgrade telemetry
+            LoadFromTelemetryFile(jobContext.JobTelemetry);
+
+            // Make sure we don't submit secrets as telemetry
+            MaskTelemetrySecrets(jobContext.JobTelemetry);
+
            Trace.Info("Raising job completed event.");
-            var jobCompletedEvent = new JobCompletedEvent(message.RequestId, message.JobId, result, jobContext.JobOutputs, jobContext.ActionsEnvironment, jobContext.ActionsStepsTelemetry);
+            var jobCompletedEvent = new JobCompletedEvent(message.RequestId, message.JobId, result, jobContext.JobOutputs, jobContext.ActionsEnvironment, jobContext.ActionsStepsTelemetry, jobContext.JobTelemetry);
+

            var completeJobRetryLimit = 5;
            var exceptions = new List<Exception>();
@@ -270,6 +281,38 @@ namespace GitHub.Runner.Worker
            throw new AggregateException(exceptions);
        }

+        private void MaskTelemetrySecrets(List<JobTelemetry> jobTelemetry)
+        {
+            foreach (var telemetryItem in jobTelemetry)
+            {
+                telemetryItem.Message = HostContext.SecretMasker.MaskSecrets(telemetryItem.Message);
+            }
+        }
+
+        private void LoadFromTelemetryFile(List<JobTelemetry> jobTelemetry)
+        {
+            try
+            {
+                var telemetryFilePath = HostContext.GetConfigFile(WellKnownConfigFile.Telemetry);
+                if (File.Exists(telemetryFilePath))
+                {
+                    var telemetryData = File.ReadAllText(telemetryFilePath, Encoding.UTF8);
+                    var telemetry = new JobTelemetry
+                    {
+                        Message = $"Runner File Telemetry:\n{telemetryData}",
+                        Type = JobTelemetryType.General
+                    };
+                    jobTelemetry.Add(telemetry);
+                    IOUtil.DeleteFile(telemetryFilePath);
+                }
+            }
+            catch (Exception e)
+            {
+                Trace.Error("Error when trying to load telemetry from telemetry file");
+                Trace.Error(e);
+            }
+        }
+
        private async Task ShutdownQueue(bool throwOnFailure)
        {
            if (_jobServerQueue != null)
--- a/src/Sdk/DTWebApi/WebApi/JobEvent.cs
+++ b/src/Sdk/DTWebApi/WebApi/JobEvent.cs
@@ -153,6 +153,19 @@ namespace GitHub.DistributedTask.WebApi
        {
            this.ActionsEnvironment = actionsEnvironment;
            this.ActionsStepsTelemetry = actionsStepsTelemetry;
+        }        
+        
+        public JobCompletedEvent(
+            Int64 requestId,
+            Guid jobId,
+            TaskResult result,
+            Dictionary<String, VariableValue> outputs,
+            ActionsEnvironmentReference actionsEnvironment,
+            List<ActionsStepTelemetry> actionsStepsTelemetry,
+            List<JobTelemetry> jobTelemetry)
+            : this(requestId, jobId, result, outputs, actionsEnvironment, actionsStepsTelemetry)
+        {
+            this.JobTelemetry = jobTelemetry;
        }

        [DataMember(EmitDefaultValue = false)]
@@ -189,6 +202,13 @@ namespace GitHub.DistributedTask.WebApi
            get;
            set;
        }
+
+        [DataMember(EmitDefaultValue = false)]
+        public List<JobTelemetry> JobTelemetry
+        {
+            get;
+            set;
+        }
    }

    [DataContract]
--- a/src/Sdk/DTWebApi/WebApi/JobTelemetry.cs
+++ b/src/Sdk/DTWebApi/WebApi/JobTelemetry.cs
@@ -0,0 +1,17 @@
+using System.Runtime.Serialization;
+
+namespace GitHub.DistributedTask.WebApi
+{
+    /// <summary>
+    /// Information about a job run on the runner
+    /// </summary>
+    [DataContract]
+    public class JobTelemetry
+    {
+        [DataMember(EmitDefaultValue = false)]
+        public string Message { get; set; }
+
+        [DataMember(EmitDefaultValue = false)]
+        public JobTelemetryType Type { get; set; }
+    }
+}
--- a/src/Sdk/DTWebApi/WebApi/JobTelemetryType.cs
+++ b/src/Sdk/DTWebApi/WebApi/JobTelemetryType.cs
@@ -0,0 +1,13 @@
+using System.Runtime.Serialization;
+
+namespace GitHub.DistributedTask.WebApi
+{
+    public enum JobTelemetryType
+    {
+        [EnumMember]
+        General = 0,
+
+        [EnumMember]
+        ActionCommand = 1,
+    }
+}
--- a/src/Test/L0/Container/DockerUtilL0.cs
+++ b/src/Test/L0/Container/DockerUtilL0.cs
@@ -144,5 +144,54 @@ namespace GitHub.Runner.Common.Tests.Worker.Container
            var actual = DockerUtil.ParseRegistryHostnameFromImageName(input);
            Assert.Equal(expected, actual);
        }
+
+        [Theory]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        [InlineData("", "")]
+        [InlineData("foo", "foo")]
+        [InlineData("foo \\ bar", "foo \\ bar")]
+        [InlineData("foo \\", "foo \\\\")]
+        [InlineData("foo \\\\", "foo \\\\\\\\")]
+        [InlineData("foo \\\" bar", "foo \\\\\\\" bar")]
+        [InlineData("foo \\\\\" bar", "foo \\\\\\\\\\\" bar")]
+        public void CreateEscapedOption_keyOnly(string input, string escaped)
+        {
+            var flag = "--example";
+            var actual = DockerUtil.CreateEscapedOption(flag, input);
+            string expected;
+            if (String.IsNullOrEmpty(input))
+            {
+                expected = "";
+            }
+            else
+            {
+                expected = $"{flag} \"{escaped}\"";
+            }
+            Assert.Equal(expected, actual);
+        }
+
+        [Theory]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        [InlineData("foo", "bar", "foo=bar")]
+        [InlineData("foo\\", "bar", "foo\\=bar")]
+        [InlineData("foo\\", "bar\\", "foo\\=bar\\\\")]
+        [InlineData("foo \\","bar \\", "foo \\=bar \\\\")]
+        public void CreateEscapedOption_keyValue(string keyInput, string valueInput, string escapedString)
+        {
+            var flag = "--example";
+            var actual = DockerUtil.CreateEscapedOption(flag, keyInput, valueInput);
+            string expected;
+            if (String.IsNullOrEmpty(keyInput))
+            {
+                expected = "";
+            }
+            else
+            {
+                expected = $"{flag} \"{escapedString}\"";
+            }
+            Assert.Equal(expected, actual);
+        }
    }
 }
--- a/src/Test/L0/Listener/Configuration/ConfigurationManagerL0.cs
+++ b/src/Test/L0/Listener/Configuration/ConfigurationManagerL0.cs
@@ -161,7 +161,8 @@ namespace GitHub.Runner.Common.Tests.Listener.Configuration
                       "--work", _expectedWorkFolder,
                       "--auth", _expectedAuthType,
                       "--token", _expectedToken,
-                       "--labels", userLabels
+                       "--labels", userLabels,
+                       "--ephemeral",
                    });
                trace.Info("Constructed.");
                _store.Setup(x => x.IsConfigured()).Returns(false);
@@ -179,6 +180,7 @@ namespace GitHub.Runner.Common.Tests.Listener.Configuration
                Assert.True(s.AgentName.Equals(_expectedAgentName));
                Assert.True(s.PoolId.Equals(_secondRunnerGroupId));
                Assert.True(s.WorkFolder.Equals(_expectedWorkFolder));
+                Assert.True(s.Ephemeral.Equals(true));

                // validate GetAgentPoolsAsync gets called twice with automation pool type
                _runnerServer.Verify(x => x.GetAgentPoolsAsync(It.IsAny<string>(), It.Is<TaskAgentPoolType>(p => p == TaskAgentPoolType.Automation)), Times.Exactly(2));
--- a/src/Test/L0/Listener/JobDispatcherL0.cs
+++ b/src/Test/L0/Listener/JobDispatcherL0.cs
@@ -264,6 +264,170 @@ namespace GitHub.Runner.Common.Tests.Listener
            }
        }

+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Runner")]
+        public async void RenewJobRequestNewAgentNameUpdatesSettings()
+        {
+            //Arrange
+            using (var hc = new TestHostContext(this))
+            {
+                var count = 0;
+                var oldName = "OldName";
+                var newName = "NewName";
+                var oldSettings = new RunnerSettings { AgentName = oldName };
+                var reservedAgent = new TaskAgentReference { Name = newName };
+
+                var trace = hc.GetTrace(nameof(DispatcherRenewJobRequestStopOnJobTokenExpiredExceptions));
+                TaskCompletionSource<int> firstJobRequestRenewed = new TaskCompletionSource<int>();
+                CancellationTokenSource cancellationTokenSource = new CancellationTokenSource();
+
+                var request = new Mock<TaskAgentJobRequest>();
+                request.Object.ReservedAgent = reservedAgent;
+                PropertyInfo lockUntilProperty = request.Object.GetType().GetProperty("LockedUntil", BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public);
+                Assert.NotNull(lockUntilProperty);
+                lockUntilProperty.SetValue(request.Object, DateTime.UtcNow.AddMinutes(5));
+                hc.SetSingleton<IRunnerServer>(_runnerServer.Object);
+                hc.SetSingleton<IConfigurationStore>(_configurationStore.Object);
+                _configurationStore.Setup(x => x.GetSettings()).Returns(oldSettings);
+                _runnerServer.Setup(x => x.RenewAgentRequestAsync(It.IsAny<int>(), It.IsAny<long>(), It.IsAny<Guid>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
+                            .Returns(() =>
+                            {
+                                count++;
+                                if (count < 5)
+                                {
+                                    return Task.FromResult<TaskAgentJobRequest>(request.Object);
+                                }
+                                else if (count == 5 || count == 6 || count == 7)
+                                {
+                                    throw new TimeoutException("");
+                                }
+                                else
+                                {
+                                    cancellationTokenSource.Cancel();
+                                    return Task.FromResult<TaskAgentJobRequest>(request.Object);
+                                }
+                            });
+
+                var jobDispatcher = new JobDispatcher();
+                jobDispatcher.Initialize(hc);
+
+                // Act
+                await jobDispatcher.RenewJobRequestAsync(0, 0, Guid.Empty, Guid.NewGuid().ToString(), firstJobRequestRenewed, cancellationTokenSource.Token);
+
+                // Assert
+                _configurationStore.Verify(x => x.SaveSettings(It.Is<RunnerSettings>(settings => settings.AgentName == newName)), Times.Once);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Runner")]
+        public async void RenewJobRequestSameAgentNameIgnored()
+        {
+            //Arrange
+            using (var hc = new TestHostContext(this))
+            {
+                var count = 0;
+                var oldName = "OldName";
+                var newName = "OldName";
+                var oldSettings = new RunnerSettings { AgentName = oldName };
+                var reservedAgent = new TaskAgentReference { Name = newName };
+
+                var trace = hc.GetTrace(nameof(DispatcherRenewJobRequestStopOnJobTokenExpiredExceptions));
+                TaskCompletionSource<int> firstJobRequestRenewed = new TaskCompletionSource<int>();
+                CancellationTokenSource cancellationTokenSource = new CancellationTokenSource();
+
+                var request = new Mock<TaskAgentJobRequest>();
+                request.Object.ReservedAgent = reservedAgent;
+                PropertyInfo lockUntilProperty = request.Object.GetType().GetProperty("LockedUntil", BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public);
+                Assert.NotNull(lockUntilProperty);
+                lockUntilProperty.SetValue(request.Object, DateTime.UtcNow.AddMinutes(5));
+                hc.SetSingleton<IRunnerServer>(_runnerServer.Object);
+                hc.SetSingleton<IConfigurationStore>(_configurationStore.Object);
+                _configurationStore.Setup(x => x.GetSettings()).Returns(oldSettings);
+                _runnerServer.Setup(x => x.RenewAgentRequestAsync(It.IsAny<int>(), It.IsAny<long>(), It.IsAny<Guid>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
+                            .Returns(() =>
+                            {
+                                count++;
+                                if (count < 5)
+                                {
+                                    return Task.FromResult<TaskAgentJobRequest>(request.Object);
+                                }
+                                else if (count == 5 || count == 6 || count == 7)
+                                {
+                                    throw new TimeoutException("");
+                                }
+                                else
+                                {
+                                    cancellationTokenSource.Cancel();
+                                    return Task.FromResult<TaskAgentJobRequest>(request.Object);
+                                }
+                            });
+                var jobDispatcher = new JobDispatcher();
+                jobDispatcher.Initialize(hc);
+
+                // Act
+                await jobDispatcher.RenewJobRequestAsync(0, 0, Guid.Empty, Guid.NewGuid().ToString(), firstJobRequestRenewed, cancellationTokenSource.Token);
+
+                // Assert
+                _configurationStore.Verify(x => x.SaveSettings(It.IsAny<RunnerSettings>()), Times.Never);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Runner")]
+        public async void RenewJobRequestNullAgentNameIgnored()
+        {
+            //Arrange
+            using (var hc = new TestHostContext(this))
+            {
+                var count = 0;
+                var oldName = "OldName";
+                var oldSettings = new RunnerSettings { AgentName = oldName };
+
+                var trace = hc.GetTrace(nameof(DispatcherRenewJobRequestStopOnJobTokenExpiredExceptions));
+                TaskCompletionSource<int> firstJobRequestRenewed = new TaskCompletionSource<int>();
+                CancellationTokenSource cancellationTokenSource = new CancellationTokenSource();
+
+                var request = new Mock<TaskAgentJobRequest>();
+                PropertyInfo lockUntilProperty = request.Object.GetType().GetProperty("LockedUntil", BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.Public);
+                Assert.NotNull(lockUntilProperty);
+                lockUntilProperty.SetValue(request.Object, DateTime.UtcNow.AddMinutes(5));
+                hc.SetSingleton<IRunnerServer>(_runnerServer.Object);
+                hc.SetSingleton<IConfigurationStore>(_configurationStore.Object);
+                _configurationStore.Setup(x => x.GetSettings()).Returns(oldSettings);
+                _runnerServer.Setup(x => x.RenewAgentRequestAsync(It.IsAny<int>(), It.IsAny<long>(), It.IsAny<Guid>(), It.IsAny<string>(), It.IsAny<CancellationToken>()))
+                            .Returns(() =>
+                            {
+                                count++;
+                                if (count < 5)
+                                {
+                                    return Task.FromResult<TaskAgentJobRequest>(request.Object);
+                                }
+                                else if (count == 5 || count == 6 || count == 7)
+                                {
+                                    throw new TimeoutException("");
+                                }
+                                else
+                                {
+                                    cancellationTokenSource.Cancel();
+                                    return Task.FromResult<TaskAgentJobRequest>(request.Object);
+                                }
+                            });
+
+                var jobDispatcher = new JobDispatcher();
+                jobDispatcher.Initialize(hc);
+
+                // Act
+                await jobDispatcher.RenewJobRequestAsync(0, 0, Guid.Empty, Guid.NewGuid().ToString(), firstJobRequestRenewed, cancellationTokenSource.Token);
+
+                // Assert
+                _configurationStore.Verify(x => x.SaveSettings(It.IsAny<RunnerSettings>()), Times.Never);
+            }
+        }
+
        [Fact]
        [Trait("Level", "L0")]
        [Trait("Category", "Runner")]
--- a/src/Test/L0/Listener/RunnerL0.cs
+++ b/src/Test/L0/Listener/RunnerL0.cs
@@ -149,6 +149,9 @@ namespace GitHub.Runner.Common.Tests.Listener
                    _messageListener.Verify(x => x.CreateSessionAsync(It.IsAny<CancellationToken>()), Times.Once());
                    _messageListener.Verify(x => x.DeleteSessionAsync(), Times.Once());
                    _messageListener.Verify(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()), Times.AtLeastOnce());
+
+                    // verify that we didn't try to delete local settings file (since we're not ephemeral)
+                    _configurationManager.Verify(x => x.DeleteLocalRunnerConfig(), Times.Never());
                }
            }
        }
@@ -312,6 +315,9 @@ namespace GitHub.Runner.Common.Tests.Listener
                _messageListener.Verify(x => x.CreateSessionAsync(It.IsAny<CancellationToken>()), Times.Once());
                _messageListener.Verify(x => x.DeleteSessionAsync(), Times.Once());
                _messageListener.Verify(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()), Times.AtLeastOnce());
+
+                // verify that we did try to delete local settings file (since we're ephemeral)
+                _configurationManager.Verify(x => x.DeleteLocalRunnerConfig(), Times.Once());
            }
        }

--- a/src/Test/L0/Worker/ActionCommandManagerL0.cs
+++ b/src/Test/L0/Worker/ActionCommandManagerL0.cs
@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.IO;
 using System.Runtime.CompilerServices;
+using GitHub.DistributedTask.Pipelines.ContextData;
 using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Worker;
 using GitHub.Runner.Worker.Container;
@@ -83,6 +84,7 @@ namespace GitHub.Runner.Common.Tests.Worker
        {
            using (TestHostContext hc = CreateTestContext())
            {
+                _ec.Setup(x => x.ExpressionValues).Returns(GetExpressionValues());
                _ec.Setup(x => x.Write(It.IsAny<string>(), It.IsAny<string>()))
                   .Returns((string tag, string line) =>
                            {
@@ -105,6 +107,88 @@ namespace GitHub.Runner.Common.Tests.Worker
            }
        }

+        [Theory]
+        [InlineData("stop-commands", "1")]
+        [InlineData("", "1")]
+        [InlineData("set-env", "1")]
+        [InlineData("stop-commands", "true")]
+        [InlineData("", "true")]
+        [InlineData("set-env", "true")]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StopProcessCommand__AllowsInvalidStopTokens__IfEnvVarIsSet(string invalidToken, string allowUnsupportedStopCommandTokens)
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Object.Global.EnvironmentVariables = new Dictionary<string, string>();
+                var expressionValues = new DictionaryContextData
+            {
+                ["env"] =
+#if OS_WINDOWS
+                        new DictionaryContextData{ { Constants.Variables.Actions.AllowUnsupportedStopCommandTokens, new StringContextData(allowUnsupportedStopCommandTokens) }}
+#else
+                        new CaseSensitiveDictionaryContextData{ { Constants.Variables.Actions.AllowUnsupportedStopCommandTokens, new StringContextData(allowUnsupportedStopCommandTokens) }}
+#endif
+            };
+                _ec.Setup(x => x.ExpressionValues).Returns(expressionValues);
+                _ec.Setup(x => x.JobTelemetry).Returns(new List<JobTelemetry>());
+
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, $"::stop-commands::{invalidToken}", null));
+            }
+        }
+
+        [Theory]
+        [InlineData("stop-commands")]
+        [InlineData("")]
+        [InlineData("set-env")]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StopProcessCommand__FailOnInvalidStopTokens(string invalidToken)
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Object.Global.EnvironmentVariables = new Dictionary<string, string>();
+                _ec.Setup(x => x.ExpressionValues).Returns(GetExpressionValues());
+                _ec.Setup(x => x.JobTelemetry).Returns(new List<JobTelemetry>());
+                Assert.Throws<Exception>(() => _commandManager.TryProcessCommand(_ec.Object, $"::stop-commands::{invalidToken}", null));
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StopProcessCommandAcceptsValidToken()
+        {
+            var validToken = "randomToken";
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Setup(x => x.ExpressionValues).Returns(GetExpressionValues());
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, $"::stop-commands::{validToken}", null));
+                Assert.False(_commandManager.TryProcessCommand(_ec.Object, "##[set-env name=foo]bar", null));
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, $"::{validToken}::", null));
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "##[set-env name=foo]bar", null));
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void StopProcessCommandMasksValidTokenForEntireRun()
+        {
+            var validToken = "randomToken";
+            using (TestHostContext hc = CreateTestContext())
+            {
+                _ec.Setup(x => x.ExpressionValues).Returns(GetExpressionValues());
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, $"::stop-commands::{validToken}", null));
+                Assert.False(_commandManager.TryProcessCommand(_ec.Object, "##[set-env name=foo]bar", null));
+                Assert.Equal("***", hc.SecretMasker.MaskSecrets(validToken));
+
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, $"::{validToken}::", null));
+                Assert.True(_commandManager.TryProcessCommand(_ec.Object, "##[set-env name=foo]bar", null));
+                Assert.Equal("***", hc.SecretMasker.MaskSecrets(validToken));
+            }
+        }
+
        [Fact]
        [Trait("Level", "L0")]
        [Trait("Category", "Worker")]
@@ -202,15 +286,15 @@ namespace GitHub.Runner.Common.Tests.Worker
                                return 1;
                            });

-                var registeredCommands = new HashSet<string>(new string[1]{ "warning" });
+                var registeredCommands = new HashSet<string>(new string[1] { "warning" });
                ActionCommand command;
-                
+
                // Columns when lines are different
                ActionCommand.TryParseV2("::warning line=1,endLine=2,col=1,endColumn=2::this is a warning", registeredCommands, out command);
                Assert.Equal("1", command.Properties["col"]);
                IssueCommandExtension.ValidateLinesAndColumns(command, _ec.Object);
                Assert.False(command.Properties.ContainsKey("col"));
-            
+
                // No lines with columns
                ActionCommand.TryParseV2("::warning col=1,endColumn=2::this is a warning", registeredCommands, out command);
                Assert.Equal("1", command.Properties["col"]);
@@ -375,5 +459,19 @@ namespace GitHub.Runner.Common.Tests.Worker

            return hostContext;
        }
+
+        private DictionaryContextData GetExpressionValues()
+        {
+            return new DictionaryContextData
+            {
+                ["env"] =
+#if OS_WINDOWS
+                        new DictionaryContextData()
+#else
+                        new CaseSensitiveDictionaryContextData()
+#endif
+            };
+        }
+
    }
 }
--- a/src/runnerversion
+++ b/src/runnerversion
@@ -1 +1 @@
-2.282.0
+2.283.4
Author	SHA1	Message	Date
Thomas Boop	436989949b	Update releaseVersion	2022-09-20 14:23:02 -04:00
Thomas Boop	06f7d8a4a3	fix workflows (#2143 )	2022-09-20 14:02:36 -04:00
Thomas Boop	06e1773933	M283 Hotfix for container env escaping (#2138 ) * Fix escaping of docker envs backport * create as prerelease * update release notes Co-authored-by: Nikola Jokic <97525037+nikola-jokic@users.noreply.github.com>	2022-09-20 12:53:33 -04:00
Thomas Boop	844595b1b3	Update releaseVersion	2021-10-04 15:10:53 -04:00
Thomas Boop	98a1935e50	fix ephemeral runner upgrade on mac/linux (#1401 )	2021-10-04 14:30:09 -04:00
Ferenc Hammerl	4d908df4b2	Create new release 2.283.2	2021-09-30 14:58:13 +02:00
Ferenc Hammerl	b53b520498	Create Release 2.283.2 (#1394 ) * Update telemetry (#1355) * Track "pause-logging" * Bump release version * Don't retry 422 (#1352) * Update the comment about the `--once` in Constants.cs (#1360) * Update Constants.cs * feedback. * Update src/Runner.Listener/Runner.cs Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> * Fix unconfiguring of runner after group changes (#1359) * Ignore agentpool when unconfiguring the runner Runner names and IDs are unique within a ServiceHost They don't need to be included when unconfiguring the runner. * Use -1 instead of 0 to highlight how it is ignored * Use overloads and 0 instead of -1 Using 0 seems to be the convention * Fix typo calling the wrong method * only cleanup runner local files on success (#1384) * Stop-Commands: stopToken restrictions (#1371) * Prevent stopTokens that are workflow commands Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> * Check context for env var too * Accept true, 1 and $true instead of just "true" * Setup ExpressionValues in tests * Update src/Runner.Common/Constants.cs Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> * Separate success and fail tests for invalid token * Fix envcontext for tests Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> * Handle keeping previous OSX versions more smoothly on Mac (#1381) * Handle macOS upgrade smoothly * cleanup * misc cleanup * final updates * Update src/Misc/layoutbin/update.sh.template Co-authored-by: Patrick Ellis <319655+pje@users.noreply.github.com> * Update src/Misc/layoutbin/update.sh.template Co-authored-by: Patrick Ellis <319655+pje@users.noreply.github.com> * Upload telemetry and default to old method as needed * minor fix * add one more bit of logging * some more telemetry * quote variables to handle spaces * tiny fix for ubuntu * remove version and move telemetry to diag * use full path Co-authored-by: Patrick Ellis <319655+pje@users.noreply.github.com> * Runner 2.283.2 Release (#1389) Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> Co-authored-by: Tingluo Huang <tingluohuang@github.com> Co-authored-by: Patrick Ellis <319655+pje@users.noreply.github.com>	2021-09-30 14:53:01 +02:00
Ferenc Hammerl	e6baf0d275	Release 2.283.1	2021-09-20 16:02:11 +02:00
Ferenc Hammerl	e7ad4652b6	[Backport] Update telemetry (#1356 ) * Track "pause-logging" * Bump release version	2021-09-20 15:54:24 +02:00
Ferenc Hammerl	b03ca604ff	Release 2.283.0	2021-09-20 15:15:16 +02:00
Ferenc Hammerl	ecfc2cc9e9	Prepare 2.283.0 release (#1351 ) * Update releaseNote.md * Update runnerversion * Update releaseNote.md Co-authored-by: Patrick Ellis <319655+pje@users.noreply.github.com> Co-authored-by: Patrick Ellis <319655+pje@users.noreply.github.com>	2021-09-20 14:59:37 +02:00
Ferenc Hammerl	740fb43731	Generic telemetry (#1321 ) * Add generateIdTokenUrl as an env var * Add generateIdTokenUrl to env vars * Add basic telemetry class and submit it on jobcompleted * Use constructor overload * Rename telemetry to jobTelemetry * Rename telemetry file * Make JobTelemetryType a string * Collect telemetry * Remove debugger * Update src/Runner.Worker/ActionCommandManager.cs Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com> * Use same JobTelemetry for all contexts * Mask telemetry data * Mask in JobRunner instead * Empty line * Change method signature Returning with a List suggests we clone it and that the original doesn't change.. * Update launch.json Co-authored-by: Thomas Boop <52323235+thboop@users.noreply.github.com>	2021-09-20 14:44:50 +02:00
Patrick Ellis	f259e5706f	Ephemeral runner deletes local .runner,.credentials files after completion (#1344 ) Closes #1337	2021-09-16 11:00:27 -04:00
Ferenc Hammerl	5d84918ed5	Add name to runner context (#1312 ) * Add generateIdTokenUrl as an env var * Add generateIdTokenUrl to env vars * Add name and runner_group to context * No longer add runner-group * Update runner name if needed * Get interface instead of concrete class * Check for nulls on ReservedAgent * Avoid loading setting file unnecesseraly * Only check agentName once * Use Trace.Error when can't update settings * Better equals and exception handling * Update JobDispatcher.cs * Add tests and null check	2021-09-16 15:25:51 +02:00
Julio Barba	881c521005	Revert "Recreate VssConnection on retry (#1316 )" (#1343 ) This reverts commit `4359dd605b`.	2021-09-15 13:21:50 -04:00
Patrick Ellis	176e7f5208	Trim trailing whitespace in all md and yml files (#1329 ) * Trim non-significant trailing whitespace, add final newlines to md,yml files * Add .editorconfig with basic whitespace conventions	2021-09-15 13:35:25 +02:00
Jacob Wallraff	b6d46c148a	Add attempt number to GitHub context (#1302 ) * Add attempt number to GitHub context * Change context name * Changing order	2021-09-15 11:00:53 +02:00
Thomas Boop	38e33bb8e3	Update network.md	2021-09-14 15:28:30 -04:00
@@ -1 +1 @@
 .282.0
 .283.4