Bump System.Security.Cryptography.ProtectedData to 9.0.8

---
updated-dependencies:
- dependency-name: System.Security.Cryptography.ProtectedData
  dependency-version: 9.0.8
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: System.Security.Cryptography.ProtectedData
  dependency-version: 9.0.8
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:1": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.410"
+      "version": "8.0.412"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

.github/workflows/build.yml

@@ -41,7 +41,7 @@ jobs:
           devScript: ./dev.sh
 
         - runtime: win-x64
-          os: windows-2019
+          os: windows-latest
           devScript: ./dev
 
         - runtime: win-arm64

.github/workflows/release.yml

@@ -77,7 +77,7 @@ jobs:
           devScript: ./dev.sh
 
         - runtime: win-x64
-          os: windows-2019
+          os: windows-latest
           devScript: ./dev
 
         - runtime: win-arm64
@@ -133,37 +133,37 @@ jobs:
 
     # Download runner package tar.gz/zip produced by 'build' job
     - name: Download Artifact (win-x64)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-win-x64
         path: ./
     - name: Download Artifact (win-arm64)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-win-arm64
         path: ./
     - name: Download Artifact (osx-x64)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-osx-x64
         path: ./
     - name: Download Artifact (osx-arm64)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-osx-arm64
         path: ./
     - name: Download Artifact (linux-x64)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-linux-x64
         path: ./
     - name: Download Artifact (linux-arm)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-linux-arm
         path: ./
     - name: Download Artifact (linux-arm64)
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@v5
       with:
         name: runner-packages-linux-arm64
         path: ./

README.md

@@ -20,6 +20,20 @@ Runner releases:
 
 ![linux](docs/res/linux_sm.png)  [Pre-reqs](docs/start/envlinux.md) | [Download](https://github.com/actions/runner/releases)
 
-## Contribute
+### Note
 
-We accept contributions in the form of issues and pull requests. The runner typically requires changes across the entire system and we aim for issues in the runner to be entirely self contained and fixable here. Therefore, we will primarily handle bug issues opened in this repo and we kindly request you to create all feature and enhancement requests on the [GitHub Feedback](https://github.com/community/community/discussions/categories/actions-and-packages) page. [Read more about our guidelines here](docs/contribute.md) before contributing.
+Thank you for your interest in this GitHub repo, however, right now we are not taking contributions. 
+
+We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.
+
+We are taking the following steps to better direct requests related to GitHub Actions, including:
+
+1. We will be directing questions and support requests to our [Community Discussions area](https://github.com/orgs/community/discussions/categories/actions)
+
+2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
+
+3. Security Issues should be handled as per our [security.md](security.md)
+
+We will still provide security updates for this project and fix major breaking changes during this time.
+
+You are welcome to still raise bugs in this repo.

docs/checks/nodejs.md

@@ -4,9 +4,9 @@
 
 Make sure the built-in node.js has access to GitHub.com or GitHub Enterprise Server.
 
-The runner carries its own copy of node.js executable under `<runner_root>/externals/node20/`.
+The runner carries its own copies of node.js executables under `<runner_root>/externals/node20/` and `<runner_root>/externals/node24/`.
 
-All javascript base Actions will get executed by the built-in `node` at `<runner_root>/externals/node20/`.
+All javascript base Actions will get executed by the built-in `node` at either `<runner_root>/externals/node20/` or `<runner_root>/externals/node24/` depending on the version specified in the action's metadata.
 
 > Not the `node` from `$PATH`
 

docs/start/envlinux.md

@@ -4,7 +4,7 @@
 
 ## Supported Distributions and Versions
 
-Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#linux)."
+Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#linux)."
 
 ## Install .Net Core 3.x Linux Dependencies
 

docs/start/envosx.md

@@ -4,6 +4,6 @@
 
 ## Supported Versions
 
-Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#macos)."
+Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#macos)."
 
 ## [More .Net Core Prerequisites Information](https://docs.microsoft.com/en-us/dotnet/core/macos-prerequisites?tabs=netcore30)

docs/start/envwin.md

@@ -2,6 +2,6 @@
 
 ## Supported Versions
 
-Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#windows)."
+Please see "[Supported architectures and operating systems for self-hosted runners](https://docs.github.com/en/actions/reference/runners/self-hosted-runners#windows)."
 
 ## [More .NET Core Prerequisites Information](https://docs.microsoft.com/en-us/dotnet/core/windows-prerequisites?tabs=netcore30)

images/Dockerfile

@@ -5,8 +5,8 @@ ARG TARGETOS
 ARG TARGETARCH
 ARG RUNNER_VERSION
 ARG RUNNER_CONTAINER_HOOKS_VERSION=0.7.0
-ARG DOCKER_VERSION=28.2.1
+ARG DOCKER_VERSION=28.3.2
-ARG BUILDX_VERSION=0.24.0
+ARG BUILDX_VERSION=0.26.1
 
 RUN apt update -y && apt install curl unzip -y
 

releaseNote.md

@@ -1,13 +1,13 @@
 ## What's Changed
-* Create schedule workflow to upgrade docker and buildx version. by @TingluoHuang in https://github.com/actions/runner/pull/3859
+* Try add orchestrationid into user-agent using token claim. by @TingluoHuang in https://github.com/actions/runner/pull/3945
-* Update dotnet sdk to latest version @8.0.409 by @github-actions in https://github.com/actions/runner/pull/3860
+* Fix null reference exception in user agent handling by @salmanmkc in https://github.com/actions/runner/pull/3946
-* Allow runner to use authv2 during config. by @TingluoHuang in https://github.com/actions/runner/pull/3866
+* Runner Support for executing Node24 Actions by @salmanmkc in https://github.com/actions/runner/pull/3940
-* show helpful error message when resolving actions directly with launch by @aiqiaoy in https://github.com/actions/runner/pull/3874
+* Update dotnet sdk to latest version @8.0.412 by @github-actions[bot] in https://github.com/actions/runner/pull/3941
-* Update dotnet sdk to latest version @8.0.410 by @github-actions in https://github.com/actions/runner/pull/3871
-* Update Docker to v28.2.1 and Buildx to v0.24.0 by @github-actions in https://github.com/actions/runner/pull/3881
-* Allow NO_SSL_VERIFY in RawHttpMessageHandler. by @TingluoHuang in https://github.com/actions/runner/pull/3883
 
-**Full Changelog**: https://github.com/actions/runner/compare/v2.324.0...v2.325.0
+## New Contributors
+* @salmanmkc made their first contribution in https://github.com/actions/runner/pull/3946
+
+**Full Changelog**: https://github.com/actions/runner/compare/v2.326.0...v2.327.0
 
 _Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
 To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.

src/Misc/expressionFunc/hashFiles/package-lock.json

@@ -716,9 +716,10 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
+      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"
@@ -4751,9 +4752,9 @@
       }
     },
     "brace-expansion": {
-      "version": "1.1.11",
+      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "requires": {
         "balanced-match": "^1.0.0",
         "concat-map": "0.0.1"

src/Misc/externals.sh

@@ -6,7 +6,8 @@ NODE_URL=https://nodejs.org/dist
 NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
-NODE20_VERSION="20.19.1"
+NODE20_VERSION="20.19.4"
+NODE24_VERSION="24.5.0"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args
@@ -139,6 +140,8 @@ function acquireExternalTool() {
 if [[ "$PACKAGERUNTIME" == "win-x64" || "$PACKAGERUNTIME" == "win-x86" ]]; then
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.exe" node20/bin
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.lib" node20/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.exe" node24/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.lib" node24/bin
     if [[ "$PRECACHE" != "" ]]; then
         acquireExternalTool "https://github.com/microsoft/vswhere/releases/download/2.6.7/vswhere.exe" vswhere
     fi
@@ -149,6 +152,8 @@ if [[ "$PACKAGERUNTIME" == "win-arm64" ]]; then
     # todo: replace these with official release when available
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.exe" node20/bin
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/$PACKAGERUNTIME/node.lib" node20/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.exe" node24/bin
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/$PACKAGERUNTIME/node.lib" node24/bin
     if [[ "$PRECACHE" != "" ]]; then
         acquireExternalTool "https://github.com/microsoft/vswhere/releases/download/2.6.7/vswhere.exe" vswhere
     fi
@@ -157,21 +162,26 @@ fi
 # Download the external tools only for OSX.
 if [[ "$PACKAGERUNTIME" == "osx-x64" ]]; then
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-darwin-x64.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-darwin-x64.tar.gz" node24 fix_nested_dir
 fi
 
 if [[ "$PACKAGERUNTIME" == "osx-arm64" ]]; then
     # node.js v12 doesn't support macOS on arm64.
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-darwin-arm64.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-darwin-arm64.tar.gz" node24 fix_nested_dir
 fi
 
 # Download the external tools for Linux PACKAGERUNTIMEs.
 if [[ "$PACKAGERUNTIME" == "linux-x64" ]]; then
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-x64.tar.gz" node20 fix_nested_dir
     acquireExternalTool "$NODE_ALPINE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-alpine-x64.tar.gz" node20_alpine
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-linux-x64.tar.gz" node24 fix_nested_dir
+    acquireExternalTool "$NODE_ALPINE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-alpine-x64.tar.gz" node24_alpine
 fi
 
 if [[ "$PACKAGERUNTIME" == "linux-arm64" ]]; then
     acquireExternalTool "$NODE_URL/v${NODE20_VERSION}/node-v${NODE20_VERSION}-linux-arm64.tar.gz" node20 fix_nested_dir
+    acquireExternalTool "$NODE_URL/v${NODE24_VERSION}/node-v${NODE24_VERSION}-linux-arm64.tar.gz" node24 fix_nested_dir
 fi
 
 if [[ "$PACKAGERUNTIME" == "linux-arm" ]]; then

src/Misc/layoutbin/hashFiles/index.js

@@ -3299,7 +3299,7 @@ function expand(str, isTop) {
   var isOptions = m.body.indexOf(',') >= 0;
   if (!isSequence && !isOptions) {
     // {a},b}
-    if (m.post.match(/,.*\}/)) {
+    if (m.post.match(/,(?!,).*\}/)) {
       str = m.pre + '{' + m.body + escClose + m.post;
       return expand(str);
     }

src/Misc/layoutbin/update.sh.template

@@ -123,7 +123,7 @@ fi
 # fix upgrade issue with macOS when running as a service
 attemptedtargetedfix=0
 currentplatform=$(uname | awk '{print tolower($0)}')
-if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
+if [[ "$currentplatform" == 'darwin'  && $restartinteractiverunner -eq 0 ]]; then
     # We needed a fix for https://github.com/actions/runner/issues/743
     # We will recreate the ./externals/nodeXY/bin/node of the past runner version that launched the runnerlistener service
     # Otherwise mac gatekeeper kills the processes we spawn on creation as we are running a process with no backing file
@@ -135,16 +135,22 @@ if [[ "$currentplatform" == 'darwin'  && restartinteractiverunner -eq 0 ]]; then
     then
         # inspect the open file handles to find the node process
         # we can't actually inspect the process using ps because it uses relative paths and doesn't follow symlinks
-        nodever="node20"
+        # Try finding node24 first, then fallback to earlier versions if needed
+        nodever="node24"
         path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-        if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node16
+        if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node20
         then
-            nodever="node16"
+            nodever="node20"
             path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
-            if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node12
+            if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node16
             then
-                nodever="node12"
+                nodever="node16"
                 path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
+                if [[ $? -ne 0 || -z "$path" ]] # Fallback if RunnerService.js was started with node12
+                then
+                    nodever="node12"
+                    path=$(lsof -a -g "$procgroup" -F n | grep $nodever/bin/node | grep externals | tail -1 | cut -c2-)
+                fi
             fi
         fi
         if [[ $? -eq 0 && -n "$path" ]]

src/Runner.Common/Constants.cs

@@ -170,6 +170,22 @@ namespace GitHub.Runner.Common
                 public static readonly string AddCheckRunIdToJobContext = "actions_add_check_run_id_to_job_context";
                 public static readonly string DisplayHelpfulActionsDownloadErrors = "actions_display_helpful_actions_download_errors";
             }
+            
+            // Node version migration related constants
+            public static class NodeMigration
+            {
+                // Node versions
+                public static readonly string Node20 = "node20";
+                public static readonly string Node24 = "node24";
+                
+                // Environment variables for controlling node version selection
+                public static readonly string ForceNode24Variable = "FORCE_JAVASCRIPT_ACTIONS_TO_NODE24";
+                public static readonly string AllowUnsecureNodeVersionVariable = "ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION";
+                
+                // Feature flags for controlling the migration phases
+                public static readonly string UseNode24ByDefaultFlag = "actions.runner.usenode24bydefault";
+                public static readonly string RequireNode24Flag = "actions.runner.requirenode24";
+            }
 
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";
             public static readonly Guid TelemetryRecordId = new Guid("11111111-1111-1111-1111-111111111111");

src/Runner.Common/HostContext.cs

@@ -15,6 +15,7 @@ using System.Threading.Tasks;
 using GitHub.DistributedTask.Logging;
 using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
+using GitHub.Services.WebApi.Jwt;
 
 namespace GitHub.Runner.Common
 {
@@ -306,6 +307,36 @@ namespace GitHub.Runner.Common
                 {
                     _userAgents.Add(new ProductInfoHeaderValue("ClientId", clientId));
                 }
+
+                // for Hosted runner, we can pull orchestrationId from JWT claims of the runner listening token.
+                if (credData != null &&
+                    credData.Scheme == Constants.Configuration.OAuthAccessToken &&
+                    credData.Data.TryGetValue(Constants.Runner.CommandLine.Args.Token, out var accessToken) &&
+                    !string.IsNullOrEmpty(accessToken))
+                {
+                    try
+                    {
+                        var jwt = JsonWebToken.Create(accessToken);
+                        var claims = jwt.ExtractClaims();
+                        var orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orch_id", StringComparison.OrdinalIgnoreCase))?.Value;
+                        if (string.IsNullOrEmpty(orchestrationId))
+                        {
+                            // fallback to orchid for C# actions-service
+                            orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orchid", StringComparison.OrdinalIgnoreCase))?.Value;
+                        }
+
+                        if (!string.IsNullOrEmpty(orchestrationId))
+                        {
+                            _trace.Info($"Pull OrchestrationId {orchestrationId} from runner JWT claims");
+                            _userAgents.Insert(0, new ProductInfoHeaderValue("OrchestrationId", orchestrationId));
+                        }
+                    }
+                    catch (Exception ex)
+                    {
+                        _trace.Error("Fail to extract OrchestrationId from runner JWT claims");
+                        _trace.Error(ex);
+                    }
+                }
             }
 
             var runnerFile = GetConfigFile(WellKnownConfigFile.Runner);

src/Runner.Common/Runner.Common.csproj

@@ -17,7 +17,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
     <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
-    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.8" />
     <PackageReference Include="System.Text.Encoding.CodePages" Version="8.0.0" />
     <PackageReference Include="System.Threading.Channels" Version="8.0.0" />
   </ItemGroup>

src/Runner.Common/RunnerDotcomServer.cs

@@ -19,6 +19,7 @@ namespace GitHub.Runner.Common
 
         Task<DistributedTask.WebApi.Runner> AddRunnerAsync(int runnerGroupId, TaskAgent agent, string githubUrl, string githubToken, string publicKey);
         Task<DistributedTask.WebApi.Runner> ReplaceRunnerAsync(int runnerGroupId, TaskAgent agent, string githubUrl, string githubToken, string publicKey);
+        Task DeleteRunnerAsync(string githubUrl, string githubToken, ulong runnerId);
         Task<List<TaskAgentPool>> GetRunnerGroupsAsync(string githubUrl, string githubToken);
     }
 
@@ -43,117 +44,15 @@ namespace GitHub.Runner.Common
 
         public async Task<List<TaskAgent>> GetRunnerByNameAsync(string githubUrl, string githubToken, string agentName)
         {
-            var githubApiUrl = "";
+            var githubApiUrl = $"{GetEntityUrl(githubUrl)}/runners?name={Uri.EscapeDataString(agentName)}";
-            var gitHubUrlBuilder = new UriBuilder(githubUrl);
-            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
-            var isOrgRunner = path.Length == 1;
-            var isRepoOrEnterpriseRunner = path.Length == 2;
-            var isRepoRunner = isRepoOrEnterpriseRunner && !string.Equals(path[0], "enterprises", StringComparison.OrdinalIgnoreCase);
-
-            if (isOrgRunner)
-            {
-                // org runner
-                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
-                {
-                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/orgs/{path[0]}/actions/runners?name={Uri.EscapeDataString(agentName)}";
-                }
-                else
-                {
-                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/orgs/{path[0]}/actions/runners?name={Uri.EscapeDataString(agentName)}";
-                }
-            }
-            else if (isRepoOrEnterpriseRunner)
-            {
-                // Repository runner
-                if (isRepoRunner)
-                {
-                    if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/repos/{path[0]}/{path[1]}/actions/runners?name={Uri.EscapeDataString(agentName)}";
-                    }
-                    else
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/repos/{path[0]}/{path[1]}/actions/runners?name={Uri.EscapeDataString(agentName)}";
-                    }
-                }
-                else
-                {
-                    // Enterprise runner
-                    if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/{path[0]}/{path[1]}/actions/runners?name={Uri.EscapeDataString(agentName)}";
-                    }
-                    else
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/{path[0]}/{path[1]}/actions/runners?name={Uri.EscapeDataString(agentName)}";
-                    }
-                }
-            }
-            else
-            {
-                throw new ArgumentException($"'{githubUrl}' should point to an org or enterprise.");
-            }
-
             var runnersList = await RetryRequest<ListRunnersResponse>(githubApiUrl, githubToken, RequestType.Get, 3, "Failed to get agents pools");
-
             return runnersList.ToTaskAgents();
         }
 
         public async Task<List<TaskAgentPool>> GetRunnerGroupsAsync(string githubUrl, string githubToken)
         {
-            var githubApiUrl = "";
+            var githubApiUrl = $"{GetEntityUrl(githubUrl)}/runner-groups";
-            var gitHubUrlBuilder = new UriBuilder(githubUrl);
-            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
-            var isOrgRunner = path.Length == 1;
-            var isRepoOrEnterpriseRunner = path.Length == 2;
-            var isRepoRunner = isRepoOrEnterpriseRunner && !string.Equals(path[0], "enterprises", StringComparison.OrdinalIgnoreCase);
-
-            if (isOrgRunner)
-            {
-                // org runner
-                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
-                {
-                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/orgs/{path[0]}/actions/runner-groups";
-                }
-                else
-                {
-                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/orgs/{path[0]}/actions/runner-groups";
-                }
-            }
-            else if (isRepoOrEnterpriseRunner)
-            {
-                // Repository Runner
-                if (isRepoRunner)
-                {
-                    if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/repos/{path[0]}/{path[1]}/actions/runner-groups";
-                    }
-                    else
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/repos/{path[0]}/{path[1]}/actions/runner-groups";
-                    }
-                }
-                else
-                {
-                    // Enterprise Runner
-                    if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/{path[0]}/{path[1]}/actions/runner-groups";
-                    }
-                    else
-                    {
-                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/{path[0]}/{path[1]}/actions/runner-groups";
-                    }
-                }
-            }
-            else
-            {
-                throw new ArgumentException($"'{githubUrl}' should point to an org or enterprise.");
-            }
-
             var agentPools = await RetryRequest<RunnerGroupList>(githubApiUrl, githubToken, RequestType.Get, 3, "Failed to get agents pools");
-
             return agentPools?.ToAgentPoolList();
         }
 
@@ -204,6 +103,12 @@ namespace GitHub.Runner.Common
             return await RetryRequest<DistributedTask.WebApi.Runner>(githubApiUrl, githubToken, RequestType.Post, 3, "Failed to add agent", body);
         }
 
+        public async Task DeleteRunnerAsync(string githubUrl, string githubToken, ulong runnerId)
+        {
+            var githubApiUrl = $"{GetEntityUrl(githubUrl)}/runners/{runnerId}";
+            await RetryRequest<DistributedTask.WebApi.Runner>(githubApiUrl, githubToken, RequestType.Delete, 3, "Failed to delete agent");
+        }
+
         private async Task<T> RetryRequest<T>(string githubApiUrl, string githubToken, RequestType requestType, int maxRetryAttemptsCount = 5, string errorMessage = null, StringContent body = null)
         {
             int retry = 0;
@@ -220,13 +125,22 @@ namespace GitHub.Runner.Common
                     try
                     {
                         HttpResponseMessage response = null;
-                        if (requestType == RequestType.Get)
+                        switch (requestType)
                         {
-                            response = await httpClient.GetAsync(githubApiUrl);
+                            case RequestType.Get:
-                        }
+                                response = await httpClient.GetAsync(githubApiUrl);
-                        else
+                                break;
-                        {
+                            case RequestType.Post:
-                            response = await httpClient.PostAsync(githubApiUrl, body);
+                                response = await httpClient.PostAsync(githubApiUrl, body);
+                                break;
+                            case RequestType.Patch:
+                                response = await httpClient.PatchAsync(githubApiUrl, body);
+                                break;
+                            case RequestType.Delete:
+                                response = await httpClient.DeleteAsync(githubApiUrl);
+                                break;
+                            default:
+                                throw new ArgumentOutOfRangeException(nameof(requestType), requestType, null);
                         }
 
                         if (response != null)
@@ -261,5 +175,61 @@ namespace GitHub.Runner.Common
                 await Task.Delay(backOff);
             }
         }
+
+        private string GetEntityUrl(string githubUrl)
+        {
+            var githubApiUrl = "";
+            var gitHubUrlBuilder = new UriBuilder(githubUrl);
+            var path = gitHubUrlBuilder.Path.Split('/', '\\', StringSplitOptions.RemoveEmptyEntries);
+            var isOrgRunner = path.Length == 1;
+            var isRepoOrEnterpriseRunner = path.Length == 2;
+            var isRepoRunner = isRepoOrEnterpriseRunner && !string.Equals(path[0], "enterprises", StringComparison.OrdinalIgnoreCase);
+
+            if (isOrgRunner)
+            {
+                // org runner
+                if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/orgs/{path[0]}/actions";
+                }
+                else
+                {
+                    githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/orgs/{path[0]}/actions";
+                }
+            }
+            else if (isRepoOrEnterpriseRunner)
+            {
+                // Repository Runner
+                if (isRepoRunner)
+                {
+                    if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                    {
+                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/repos/{path[0]}/{path[1]}/actions";
+                    }
+                    else
+                    {
+                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/repos/{path[0]}/{path[1]}/actions";
+                    }
+                }
+                else
+                {
+                    // Enterprise Runner
+                    if (UrlUtil.IsHostedServer(gitHubUrlBuilder))
+                    {
+                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://api.{gitHubUrlBuilder.Host}/{path[0]}/{path[1]}/actions";
+                    }
+                    else
+                    {
+                        githubApiUrl = $"{gitHubUrlBuilder.Scheme}://{gitHubUrlBuilder.Host}/api/v3/{path[0]}/{path[1]}/actions";
+                    }
+                }
+            }
+            else
+            {
+                throw new ArgumentException($"'{githubUrl}' should point to an org or enterprise.");
+            }
+
+            return githubApiUrl;
+        }
     }
 }

src/Runner.Common/Util/NodeUtil.cs

@@ -1,10 +1,33 @@
 using System;
+using System.Collections.Generic;
 using System.Collections.ObjectModel;
+using GitHub.Runner.Sdk;
 
 namespace GitHub.Runner.Common.Util
 {
     public static class NodeUtil
     {
+        /// <summary>
+        /// Represents details about an environment variable, including its value and source
+        /// </summary>
+        private class EnvironmentVariableInfo
+        {
+            /// <summary>
+            /// Gets or sets whether the value evaluates to true
+            /// </summary>
+            public bool IsTrue { get; set; }
+
+            /// <summary>
+            /// Gets or sets whether the value came from the workflow environment
+            /// </summary>
+            public bool FromWorkflow { get; set; }
+
+            /// <summary>
+            /// Gets or sets whether the value came from the system environment
+            /// </summary>
+            public bool FromSystem { get; set; }
+        }
+
         private const string _defaultNodeVersion = "node20";
         public static readonly ReadOnlyCollection<string> BuiltInNodeVersions = new(new[] { "node20" });
         public static string GetInternalNodeVersion()
@@ -18,5 +41,122 @@ namespace GitHub.Runner.Common.Util
             }
             return _defaultNodeVersion;
         }
+        /// <summary>
+        /// Determines the appropriate Node version for Actions to use
+        /// </summary>
+        /// <param name="workflowEnvironment">Optional dictionary containing workflow-level environment variables</param>
+        /// <param name="useNode24ByDefault">Feature flag indicating if Node 24 should be the default</param>
+        /// <param name="requireNode24">Feature flag indicating if Node 24 is required</param>
+        /// <returns>The Node version to use (node20 or node24) and warning message if both env vars are set</returns>
+        public static (string nodeVersion, string warningMessage) DetermineActionsNodeVersion(
+            IDictionary<string, string> workflowEnvironment = null,
+            bool useNode24ByDefault = false,
+            bool requireNode24 = false)
+        {
+            // Phase 3: Always use Node 24 regardless of environment variables
+            if (requireNode24)
+            {
+                return (Constants.Runner.NodeMigration.Node24, null);
+            }
+            
+            // Get environment variable details with source information
+            var forceNode24Details = GetEnvironmentVariableDetails(
+                Constants.Runner.NodeMigration.ForceNode24Variable, workflowEnvironment);
+
+            var allowUnsecureNodeDetails = GetEnvironmentVariableDetails(
+                Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable, workflowEnvironment);
+
+            bool forceNode24 = forceNode24Details.IsTrue;
+            bool allowUnsecureNode = allowUnsecureNodeDetails.IsTrue;
+            string warningMessage = null;
+
+            // Check if both flags are set from the same source
+            bool bothFromWorkflow = forceNode24Details.IsTrue && allowUnsecureNodeDetails.IsTrue &&
+                                   forceNode24Details.FromWorkflow && allowUnsecureNodeDetails.FromWorkflow;
+
+            bool bothFromSystem = forceNode24Details.IsTrue && allowUnsecureNodeDetails.IsTrue &&
+                                 forceNode24Details.FromSystem && allowUnsecureNodeDetails.FromSystem;
+
+            // Handle the case when both are set in the same source
+            if (bothFromWorkflow || bothFromSystem)
+            {
+                string source = bothFromWorkflow ? "workflow" : "system";
+                string defaultVersion = useNode24ByDefault ? Constants.Runner.NodeMigration.Node24 : Constants.Runner.NodeMigration.Node20;
+                warningMessage = $"Both {Constants.Runner.NodeMigration.ForceNode24Variable} and {Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable} environment variables are set to true in the {source} environment. This is likely a configuration error. Using the default Node version: {defaultVersion}.";
+                return (defaultVersion, warningMessage);
+            }
+
+            // Phase 2: Node 24 is the default
+            if (useNode24ByDefault)
+            {
+                if (allowUnsecureNode)
+                {
+                    return (Constants.Runner.NodeMigration.Node20, null);
+                }
+
+                return (Constants.Runner.NodeMigration.Node24, null);
+            }
+
+            // Phase 1: Node 20 is the default
+            if (forceNode24)
+            {
+                return (Constants.Runner.NodeMigration.Node24, null);
+            }
+
+            return (Constants.Runner.NodeMigration.Node20, null);
+        }
+
+        /// <summary>
+        /// Checks if Node24 is requested but running on ARM32 Linux, and determines if fallback is needed.
+        /// </summary>
+        /// <param name="preferredVersion">The preferred Node version</param>
+        /// <returns>A tuple containing the adjusted node version and an optional warning message</returns>
+        public static (string nodeVersion, string warningMessage) CheckNodeVersionForLinuxArm32(string preferredVersion)
+        {
+            if (string.Equals(preferredVersion, Constants.Runner.NodeMigration.Node24, StringComparison.OrdinalIgnoreCase) &&
+                Constants.Runner.PlatformArchitecture.Equals(Constants.Architecture.Arm) &&
+                Constants.Runner.Platform.Equals(Constants.OSPlatform.Linux))
+            {
+                return (Constants.Runner.NodeMigration.Node20, "Node 24 is not supported on Linux ARM32 platforms. Falling back to Node 20.");
+            }
+
+            return (preferredVersion, null);
+        }
+
+        /// <summary>
+        /// Gets detailed information about an environment variable from both workflow and system environments
+        /// </summary>
+        /// <param name="variableName">The name of the environment variable</param>
+        /// <param name="workflowEnvironment">Optional dictionary containing workflow-level environment variables</param>
+        /// <returns>An EnvironmentVariableInfo object containing details about the variable from both sources</returns>
+        private static EnvironmentVariableInfo GetEnvironmentVariableDetails(string variableName, IDictionary<string, string> workflowEnvironment)
+        {
+            var info = new EnvironmentVariableInfo();
+
+            // Check workflow environment
+            bool foundInWorkflow = false;
+            string workflowValue = null;
+
+            if (workflowEnvironment != null && workflowEnvironment.TryGetValue(variableName, out workflowValue))
+            {
+                foundInWorkflow = true;
+                info.FromWorkflow = true;
+                info.IsTrue = StringUtil.ConvertToBoolean(workflowValue); // Workflow value takes precedence for the boolean value
+            }
+
+            // Also check system environment
+            string systemValue = Environment.GetEnvironmentVariable(variableName);
+            bool foundInSystem = !string.IsNullOrEmpty(systemValue);
+
+            info.FromSystem = foundInSystem;
+
+            // If not found in workflow, use system values
+            if (!foundInWorkflow)
+            {
+                info.IsTrue = StringUtil.ConvertToBoolean(systemValue);
+            }
+
+            return info;
+        }
     }
 }

src/Runner.Listener/Configuration/ConfigurationManager.cs

@@ -537,41 +537,50 @@ namespace GitHub.Runner.Listener.Configuration
                 if (isConfigured && hasCredentials)
                 {
                     RunnerSettings settings = _store.GetSettings();
-                    var credentialManager = HostContext.GetService<ICredentialManager>();
 
-                    // Get the credentials
+                    if (settings.UseV2Flow)
-                    VssCredentials creds = null;
-                    if (string.IsNullOrEmpty(settings.GitHubUrl))
-                    {
-                        var credProvider = GetCredentialProvider(command, settings.ServerUrl);
-                        creds = credProvider.GetVssCredentials(HostContext, allowAuthUrlV2: false);
-                        Trace.Info("legacy vss cred retrieved");
-                    }
-                    else
                     {
                         var deletionToken = await GetRunnerTokenAsync(command, settings.GitHubUrl, "remove");
-                        GitHubAuthResult authResult = await GetTenantCredential(settings.GitHubUrl, deletionToken, Constants.RunnerEvent.Remove);
+                        await _dotcomServer.DeleteRunnerAsync(settings.GitHubUrl, deletionToken, settings.AgentId);
-                        creds = authResult.ToVssCredentials();
-                        Trace.Info("cred retrieved via GitHub auth");
-                    }
-
-                    // Determine the service deployment type based on connection data. (Hosted/OnPremises)
-                    await _runnerServer.ConnectAsync(new Uri(settings.ServerUrl), creds);
-
-                    var agents = await _runnerServer.GetAgentsAsync(settings.AgentName);
-                    Trace.Verbose("Returns {0} agents", agents.Count);
-                    TaskAgent agent = agents.FirstOrDefault();
-                    if (agent == null)
-                    {
-                        _term.WriteLine("Does not exist. Skipping " + currentAction);
                     }
                     else
                     {
-                        await _runnerServer.DeleteAgentAsync(settings.AgentId);
+                        var credentialManager = HostContext.GetService<ICredentialManager>();
 
-                        _term.WriteLine();
+                        // Get the credentials
-                        _term.WriteSuccessMessage("Runner removed successfully");
+                        VssCredentials creds = null;
+                        if (string.IsNullOrEmpty(settings.GitHubUrl))
+                        {
+                            var credProvider = GetCredentialProvider(command, settings.ServerUrl);
+                            creds = credProvider.GetVssCredentials(HostContext, allowAuthUrlV2: false);
+                            Trace.Info("legacy vss cred retrieved");
+                        }
+                        else
+                        {
+                            var deletionToken = await GetRunnerTokenAsync(command, settings.GitHubUrl, "remove");
+                            GitHubAuthResult authResult = await GetTenantCredential(settings.GitHubUrl, deletionToken, Constants.RunnerEvent.Remove);
+                            creds = authResult.ToVssCredentials();
+                            Trace.Info("cred retrieved via GitHub auth");
+                        }
+
+                        // Determine the service deployment type based on connection data. (Hosted/OnPremises)
+                        await _runnerServer.ConnectAsync(new Uri(settings.ServerUrl), creds);
+
+                        var agents = await _runnerServer.GetAgentsAsync(settings.AgentName);
+                        Trace.Verbose("Returns {0} agents", agents.Count);
+                        TaskAgent agent = agents.FirstOrDefault();
+                        if (agent == null)
+                        {
+                            _term.WriteLine("Does not exist. Skipping " + currentAction);
+                        }
+                        else
+                        {
+                            await _runnerServer.DeleteAgentAsync(settings.AgentId);
+                        }
                     }
+
+                    _term.WriteLine();
+                    _term.WriteSuccessMessage("Runner removed successfully");
                 }
                 else
                 {

src/Runner.Listener/JobDispatcher.cs

@@ -110,7 +110,12 @@ namespace GitHub.Runner.Listener
             {
                 var jwt = JsonWebToken.Create(accessToken);
                 var claims = jwt.ExtractClaims();
-                orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orchid", StringComparison.OrdinalIgnoreCase))?.Value;
+                orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orch_id", StringComparison.OrdinalIgnoreCase))?.Value;
+                if (string.IsNullOrEmpty(orchestrationId))
+                {
+                    orchestrationId = claims.FirstOrDefault(x => string.Equals(x.Type, "orchid", StringComparison.OrdinalIgnoreCase))?.Value;
+                }
+
                 if (!string.IsNullOrEmpty(orchestrationId))
                 {
                     Trace.Info($"Pull OrchestrationId {orchestrationId} from JWT claims");

src/Runner.Sdk/Runner.Sdk.csproj

@@ -15,6 +15,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.8" />
     <PackageReference Include="System.Text.Encoding.CodePages" Version="8.0.0" />
     <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
     <PackageReference Include="System.Threading.Channels" Version="8.0.0" />

src/Runner.Service/Windows/App.config

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8" ?>
 <configuration>
     <startup>
-        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
+        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7" />
     </startup>
 </configuration>

src/Runner.Service/Windows/RunnerService.csproj

@@ -18,7 +18,7 @@
       <TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(PackageRuntime)' != 'win-arm64' ">
-      <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+      <TargetFrameworkVersion>v4.7</TargetFrameworkVersion>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <PlatformTarget>AnyCPU</PlatformTarget>

src/Runner.Worker/ActionManifestManager.cs

@@ -450,7 +450,8 @@ namespace GitHub.Runner.Worker
                 }
                 else if (string.Equals(usingToken.Value, "node12", StringComparison.OrdinalIgnoreCase) ||
                          string.Equals(usingToken.Value, "node16", StringComparison.OrdinalIgnoreCase) ||
-                         string.Equals(usingToken.Value, "node20", StringComparison.OrdinalIgnoreCase))
+                         string.Equals(usingToken.Value, "node20", StringComparison.OrdinalIgnoreCase) ||
+                         string.Equals(usingToken.Value, "node24", StringComparison.OrdinalIgnoreCase))
                 {
                     if (string.IsNullOrEmpty(mainToken?.Value))
                     {
@@ -490,7 +491,7 @@ namespace GitHub.Runner.Worker
                 }
                 else
                 {
-                    throw new ArgumentOutOfRangeException($"'using: {usingToken.Value}' is not supported, use 'docker', 'node12', 'node16' or 'node20' instead.");
+                    throw new ArgumentOutOfRangeException($"'using: {usingToken.Value}' is not supported, use 'docker', 'node12', 'node16', 'node20' or 'node24' instead.");
                 }
             }
             else if (pluginToken != null)
@@ -501,7 +502,7 @@ namespace GitHub.Runner.Worker
                 };
             }
 
-            throw new NotSupportedException("Missing 'using' value. 'using' requires 'composite', 'docker', 'node12', 'node16' or 'node20'.");
+            throw new NotSupportedException("Missing 'using' value. 'using' requires 'composite', 'docker', 'node12', 'node16', 'node20' or 'node24'.");
         }
 
         private void ConvertInputs(

src/Runner.Worker/Handlers/HandlerFactory.cs

@@ -58,10 +58,41 @@ namespace GitHub.Runner.Worker.Handlers
                 var nodeData = data as NodeJSActionExecutionData;
 
                 // With node12 EoL in 04/2022 and node16 EoL in 09/23, we want to execute all JS actions using node20
+                // With node20 EoL approaching, we're preparing to migrate to node24
                 if (string.Equals(nodeData.NodeVersion, "node12", StringComparison.InvariantCultureIgnoreCase) ||
                     string.Equals(nodeData.NodeVersion, "node16", StringComparison.InvariantCultureIgnoreCase))
                 {
-                    nodeData.NodeVersion = "node20";
+                    nodeData.NodeVersion = Common.Constants.Runner.NodeMigration.Node20;
+                }
+
+                // Check if node20 was explicitly specified in the action
+                // We don't modify if node24 was explicitly specified
+                if (string.Equals(nodeData.NodeVersion, Constants.Runner.NodeMigration.Node20, StringComparison.InvariantCultureIgnoreCase))
+                {
+                    bool useNode24ByDefault = executionContext.Global.Variables?.GetBoolean(Constants.Runner.NodeMigration.UseNode24ByDefaultFlag) ?? false;
+                    bool requireNode24 = executionContext.Global.Variables?.GetBoolean(Constants.Runner.NodeMigration.RequireNode24Flag) ?? false;
+
+                    var (nodeVersion, configWarningMessage) = NodeUtil.DetermineActionsNodeVersion(environment, useNode24ByDefault, requireNode24);
+                    var (finalNodeVersion, platformWarningMessage) = NodeUtil.CheckNodeVersionForLinuxArm32(nodeVersion);
+                    nodeData.NodeVersion = finalNodeVersion;
+
+                    if (!string.IsNullOrEmpty(configWarningMessage))
+                    {
+                        executionContext.Warning(configWarningMessage);
+                    }
+
+                    if (!string.IsNullOrEmpty(platformWarningMessage))
+                    {
+                        executionContext.Warning(platformWarningMessage);
+                    }
+
+                    // Show information about Node 24 migration in Phase 2
+                    if (useNode24ByDefault && !requireNode24 && string.Equals(finalNodeVersion, Constants.Runner.NodeMigration.Node24, StringComparison.OrdinalIgnoreCase))
+                    {
+                        string infoMessage = "Node 20 is being deprecated. This workflow is running with Node 24 by default. " +
+                                             "If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable.";
+                        executionContext.Output(infoMessage);
+                    }
                 }
 
                 (handler as INodeScriptActionHandler).Data = nodeData;

src/Runner.Worker/Handlers/StepHost.cs

@@ -1,6 +1,5 @@
 using System;
 using System.Collections.Generic;
-using GitHub.DistributedTask.Pipelines.ContextData;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -9,7 +8,6 @@ using GitHub.Runner.Common;
 using GitHub.Runner.Sdk;
 using System.Linq;
 using GitHub.Runner.Worker.Container.ContainerHooks;
-using System.IO;
 using System.Threading.Channels;
 
 namespace GitHub.Runner.Worker.Handlers
@@ -60,7 +58,14 @@ namespace GitHub.Runner.Worker.Handlers
 
         public Task<string> DetermineNodeRuntimeVersion(IExecutionContext executionContext, string preferredVersion)
         {
-            return Task.FromResult<string>(preferredVersion);
+            // Use NodeUtil to check if Node24 is requested but we're on ARM32 Linux
+            var (nodeVersion, warningMessage) = Common.Util.NodeUtil.CheckNodeVersionForLinuxArm32(preferredVersion);
+            if (!string.IsNullOrEmpty(warningMessage))
+            {
+                executionContext.Warning(warningMessage);
+            }
+            
+            return Task.FromResult(nodeVersion);
         }
 
         public async Task<int> ExecuteAsync(IExecutionContext context,
@@ -137,8 +142,12 @@ namespace GitHub.Runner.Worker.Handlers
 
         public async Task<string> DetermineNodeRuntimeVersion(IExecutionContext executionContext, string preferredVersion)
         {
-            // Optimistically use the default
+            // Use NodeUtil to check if Node24 is requested but we're on ARM32 Linux
-            string nodeExternal = preferredVersion;
+            var (nodeExternal, warningMessage) = Common.Util.NodeUtil.CheckNodeVersionForLinuxArm32(preferredVersion);
+            if (!string.IsNullOrEmpty(warningMessage))
+            {
+                executionContext.Warning(warningMessage);
+            }
 
             if (FeatureManager.IsContainerHooksEnabled(executionContext.Global.Variables))
             {
@@ -264,7 +273,14 @@ namespace GitHub.Runner.Worker.Handlers
 
         private string CheckPlatformForAlpineContainer(IExecutionContext executionContext, string preferredVersion)
         {
-            string nodeExternal = preferredVersion;
+            // Use NodeUtil to check if Node24 is requested but we're on ARM32 Linux
+            var (nodeExternal, warningMessage) = Common.Util.NodeUtil.CheckNodeVersionForLinuxArm32(preferredVersion);
+            if (!string.IsNullOrEmpty(warningMessage))
+            {
+                executionContext.Warning(warningMessage);
+            }
+
+            // Check for Alpine container compatibility
             if (!Constants.Runner.PlatformArchitecture.Equals(Constants.Architecture.X64))
             {
                 var os = Constants.Runner.Platform.ToString();

src/Runner.Worker/JobRunner.cs

@@ -50,8 +50,11 @@ namespace GitHub.Runner.Worker
             if (message.Variables.TryGetValue(Constants.Variables.System.OrchestrationId, out VariableValue orchestrationId) &&
                 !string.IsNullOrEmpty(orchestrationId.Value))
             {
-                // make the orchestration id the first item in the user-agent header to avoid get truncated in server log.
+                if (!HostContext.UserAgents.Any(x => string.Equals(x.Product?.Name, "OrchestrationId", StringComparison.OrdinalIgnoreCase)))
-                HostContext.UserAgents.Insert(0, new ProductInfoHeaderValue("OrchestrationId", orchestrationId.Value));
+                {
+                    // make the orchestration id the first item in the user-agent header to avoid get truncated in server log.
+                    HostContext.UserAgents.Insert(0, new ProductInfoHeaderValue("OrchestrationId", orchestrationId.Value));
+                }
 
                 // make sure orchestration id is in the user-agent header.
                 VssUtil.InitializeVssClientSettings(HostContext.UserAgents, HostContext.WebProxy);

src/Sdk/Sdk.csproj

@@ -14,13 +14,13 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="Azure.Storage.Blobs" Version="12.24.0" />
+        <PackageReference Include="Azure.Storage.Blobs" Version="12.25.0" />
         <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
         <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
         <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
         <PackageReference Include="System.Security.Cryptography.Cng" Version="5.0.0" />
         <PackageReference Include="System.Security.Cryptography.Pkcs" Version="8.0.0" />
-        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="8.0.0" />
+        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.8" />
         <PackageReference Include="Minimatch" Version="2.0.0" />
         <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
         <PackageReference Include="System.Net.Http" Version="4.3.4" />

src/Sdk/WebApi/WebApi/ResultsHttpClient.cs

@@ -520,8 +520,8 @@ namespace GitHub.Services.Results.Client
                 Number = r.Order.GetValueOrDefault(),
                 Name = r.Name,
                 Status = ConvertStateToStatus(r.State.GetValueOrDefault()),
-                StartedAt = r.StartTime?.ToString(Constants.TimestampFormat),
+                StartedAt = r.StartTime?.ToString(Constants.TimestampFormat, CultureInfo.InvariantCulture),
-                CompletedAt = r.FinishTime?.ToString(Constants.TimestampFormat),
+                CompletedAt = r.FinishTime?.ToString(Constants.TimestampFormat, CultureInfo.InvariantCulture),
                 Conclusion = ConvertResultToConclusion(r.Result)
             };
         }

src/Test/L0/Listener/RunnerL0.cs

@@ -978,7 +978,7 @@ namespace GitHub.Runner.Common.Tests.Listener
                 _messageListener.Verify(x => x.GetNextMessageAsync(It.IsAny<CancellationToken>()), Times.AtLeast(2));
                 _messageListener.Verify(x => x.DeleteMessageAsync(It.IsAny<TaskAgentMessage>()), Times.AtLeast(2));
                 _messageListener.Verify(x => x.DeleteSessionAsync(), Times.Once());
-                _credentialManager.Verify(x => x.LoadCredentials(true), Times.Exactly(2));
+                _credentialManager.Verify(x => x.LoadCredentials(true), Times.AtLeast(2));
 
                 Assert.False(hc.AllowAuthMigration);
             }

src/Test/L0/Util/NodeUtilL0.cs

@@ -0,0 +1,120 @@
+using System;
+using System.Collections.Generic;
+using GitHub.Runner.Common;
+using GitHub.Runner.Common.Util;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Util
+{
+    public class NodeUtilL0
+    {
+        // We're testing the logic with feature flags
+        [Theory]
+        [InlineData(false, false, false, false, "node20", false)] // Phase 1: No env vars
+        [InlineData(false, false, false, true, "node20", false)]  // Phase 1: Allow unsecure (redundant)
+        [InlineData(false, false, true, false, "node24", false)]  // Phase 1: Force node24
+        [InlineData(false, false, true, true, "node20", true)]    // Phase 1: Both flags (use phase default + warning)
+        [InlineData(false, true, false, false, "node24", false)]  // Phase 2: No env vars
+        [InlineData(false, true, false, true, "node20", false)]   // Phase 2: Allow unsecure
+        [InlineData(false, true, true, false, "node24", false)]   // Phase 2: Force node24 (redundant)
+        [InlineData(false, true, true, true, "node24", true)]     // Phase 2: Both flags (use phase default + warning)
+        [InlineData(true, false, false, false, "node24", false)]  // Phase 3: Always Node 24 regardless of env vars
+        [InlineData(true, false, false, true, "node24", false)]   // Phase 3: Always Node 24 regardless of env vars
+        [InlineData(true, false, true, false, "node24", false)]   // Phase 3: Always Node 24 regardless of env vars
+        [InlineData(true, false, true, true, "node24", false)]     // Phase 3: Always Node 24 regardless of env vars, no warnings in Phase 3
+        public void TestNodeVersionLogic(bool requireNode24, bool useNode24ByDefault, bool forceNode24, bool allowUnsecureNode, string expectedVersion, bool expectWarning)
+        {
+            try
+            {
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.ForceNode24Variable, forceNode24 ? "true" : null);
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable, allowUnsecureNode ? "true" : null);
+
+                // Call the actual method
+                var (actualVersion, warningMessage) = NodeUtil.DetermineActionsNodeVersion(null, useNode24ByDefault, requireNode24);
+
+                // Assert
+                Assert.Equal(expectedVersion, actualVersion);
+
+                if (expectWarning)
+                {
+                    Assert.NotNull(warningMessage);
+                    Assert.Contains("Both", warningMessage);
+                    Assert.Contains("are set to true", warningMessage);
+                }
+                else
+                {
+                    Assert.Null(warningMessage);
+                }
+            }
+            finally
+            {
+                // Cleanup
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.ForceNode24Variable, null);
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable, null);
+            }
+        }
+
+        [Theory]
+        [InlineData(false, false, false, false, false, true, "node20", false)]   // Phase 1: System env: none, Workflow env: allow=true
+        [InlineData(false, false, true, false, false, false, "node24", false)]   // Phase 1: System env: force node24, Workflow env: none
+        [InlineData(false, true, false, false, true, false, "node24", false)]    // Phase 1: System env: none, Workflow env: force node24
+        [InlineData(false, false, false, true, false, true, "node20", false)]    // Phase 1: System env: allow=true, Workflow env: allow=true (workflow takes precedence)
+        [InlineData(false, false, true, true, false, false, "node20", true)]    // Phase 1: System env: both true, Workflow env: none (use phase default + warning)
+        [InlineData(false, false, false, false, true, true, "node20", true)]     // Phase 1: System env: none, Workflow env: both (use phase default + warning)
+        [InlineData(true, false, false, false, false, false, "node24", false)]   // Phase 2: System env: none, Workflow env: none
+        [InlineData(true, false, false, true, false, false, "node20", false)]    // Phase 2: System env: allow=true, Workflow env: none
+        [InlineData(true, false, false, false, false, true, "node20", false)]    // Phase 2: System env: none, Workflow env: allow unsecure
+        [InlineData(true, false, true, false, false, true, "node20", false)]     // Phase 2: System env: force node24, Workflow env: allow unsecure
+        [InlineData(true, false, true, true, false, false, "node24", true)]    // Phase 2: System env: both true, Workflow env: none (use phase default + warning)
+        [InlineData(true, false, false, false, true, true, "node24", true)]      // Phase 2: System env: none, Workflow env: both (phase default + warning)
+        [InlineData(false, true, false, false, false, true, "node24", false)]    // Phase 3: System env: none, Workflow env: allow=true (always Node 24 in Phase 3)
+        [InlineData(false, true, true, true, false, false, "node24", false)]     // Phase 3: System env: both true, Workflow env: none (always Node 24 in Phase 3, no warning)
+        [InlineData(false, true, false, false, true, true, "node24", false)]      // Phase 3: System env: none, Workflow env: both (always Node 24 in Phase 3, no warning)
+        public void TestNodeVersionLogicWithWorkflowEnvironment(bool useNode24ByDefault, bool requireNode24,
+            bool systemForceNode24, bool systemAllowUnsecure,
+            bool workflowForceNode24, bool workflowAllowUnsecure,
+            string expectedVersion, bool expectWarning)
+        {
+            try
+            {
+                // Set system environment variables
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.ForceNode24Variable, systemForceNode24 ? "true" : null);
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable, systemAllowUnsecure ? "true" : null);
+
+                // Set workflow environment variables
+                var workflowEnv = new Dictionary<string, string>();
+                if (workflowForceNode24)
+                {
+                    workflowEnv[Constants.Runner.NodeMigration.ForceNode24Variable] = "true";
+                }
+                if (workflowAllowUnsecure)
+                {
+                    workflowEnv[Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable] = "true";
+                }
+
+                // Call the actual method with our test parameters
+                var (actualVersion, warningMessage) = NodeUtil.DetermineActionsNodeVersion(workflowEnv, useNode24ByDefault, requireNode24);
+
+                // Assert
+                Assert.Equal(expectedVersion, actualVersion);
+
+                if (expectWarning)
+                {
+                    Assert.NotNull(warningMessage);
+                    Assert.Contains("Both", warningMessage);
+                    Assert.Contains("are set to true", warningMessage);
+                }
+                else
+                {
+                    Assert.Null(warningMessage);
+                }
+            }
+            finally
+            {
+                // Cleanup
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.ForceNode24Variable, null);
+                Environment.SetEnvironmentVariable(Constants.Runner.NodeMigration.AllowUnsecureNodeVersionVariable, null);
+            }
+        }
+    }
+}

src/Test/L0/Worker/ActionManagerL0.cs

@@ -1659,6 +1659,76 @@ runs:
                 Teardown();
             }
         }
+
+         [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void LoadsNode24ActionDefinition()
+        {
+            try
+            {
+                // Arrange.
+                Setup();
+                const string Content = @"
+# Container action
+name: 'Hello World'
+description: 'Greet the world and record the time'
+author: 'GitHub'
+inputs:
+  greeting: # id of input
+    description: 'The greeting we choose - will print ""{greeting}, World!"" on stdout'
+    required: true
+    default: 'Hello'
+  entryPoint: # id of input
+    description: 'optional docker entrypoint overwrite.'
+    required: false
+outputs:
+  time: # id of output
+    description: 'The time we did the greeting'
+icon: 'hello.svg' # vector art to display in the GitHub Marketplace
+color: 'green' # optional, decorates the entry in the GitHub Marketplace
+runs:
+  using: 'node24'
+  main: 'task.js'
+";
+                Pipelines.ActionStep instance;
+                string directory;
+                CreateAction(yamlContent: Content, instance: out instance, directory: out directory);
+
+                // Act.
+                Definition definition = _actionManager.LoadAction(_ec.Object, instance);
+
+                // Assert.
+                Assert.NotNull(definition);
+                Assert.Equal(directory, definition.Directory);
+                Assert.NotNull(definition.Data);
+                Assert.NotNull(definition.Data.Inputs); // inputs
+                Dictionary<string, string> inputDefaults = new(StringComparer.OrdinalIgnoreCase);
+                foreach (var input in definition.Data.Inputs)
+                {
+                    var name = input.Key.AssertString("key").Value;
+                    var value = input.Value.AssertScalar("value").ToString();
+
+                    _hc.GetTrace().Info($"Default: {name} = {value}");
+                    inputDefaults[name] = value;
+                }
+
+                Assert.Equal(2, inputDefaults.Count);
+                Assert.True(inputDefaults.ContainsKey("greeting"));
+                Assert.Equal("Hello", inputDefaults["greeting"]);
+                Assert.True(string.IsNullOrEmpty(inputDefaults["entryPoint"]));
+                Assert.NotNull(definition.Data.Execution); // execution
+
+                Assert.NotNull(definition.Data.Execution as NodeJSActionExecutionData);
+                Assert.Equal("task.js", (definition.Data.Execution as NodeJSActionExecutionData).Script);
+                Assert.Equal("node24", (definition.Data.Execution as NodeJSActionExecutionData).NodeVersion);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+        
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]

src/Test/L0/Worker/ActionManifestManagerL0.cs

@@ -502,6 +502,49 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
+         [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Load_Node24Action()
+        {
+            try
+            {
+                //Arrange
+                Setup();
+
+                var actionManifest = new ActionManifestManager();
+                actionManifest.Initialize(_hc);
+
+                //Act
+                var result = actionManifest.Load(_ec.Object, Path.Combine(TestUtil.GetTestDataPath(), "node24action.yml"));
+
+                //Assert
+                Assert.Equal("Hello World", result.Name);
+                Assert.Equal("Greet the world and record the time", result.Description);
+                Assert.Equal(2, result.Inputs.Count);
+                Assert.Equal("greeting", result.Inputs[0].Key.AssertString("key").Value);
+                Assert.Equal("Hello", result.Inputs[0].Value.AssertString("value").Value);
+                Assert.Equal("entryPoint", result.Inputs[1].Key.AssertString("key").Value);
+                Assert.Equal("", result.Inputs[1].Value.AssertString("value").Value);
+                Assert.Equal(1, result.Deprecated.Count);
+
+                Assert.True(result.Deprecated.ContainsKey("greeting"));
+                result.Deprecated.TryGetValue("greeting", out string value);
+                Assert.Equal("This property has been deprecated", value);
+
+                Assert.Equal(ActionExecutionType.NodeJS, result.Execution.ExecutionType);
+
+                var nodeAction = result.Execution as NodeJSActionExecutionData;
+
+                Assert.Equal("main.js", nodeAction.Script);
+                Assert.Equal("node24", nodeAction.NodeVersion);
+            }
+            finally
+            {
+                Teardown();
+            }
+        }
+
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]
@@ -758,7 +801,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 //Assert
                 var err = Assert.Throws<ArgumentException>(() => actionManifest.Load(_ec.Object, action_path));
                 Assert.Contains($"Failed to load {action_path}", err.Message);
-                _ec.Verify(x => x.AddIssue(It.Is<Issue>(s => s.Message.Contains("Missing 'using' value. 'using' requires 'composite', 'docker', 'node12', 'node16' or 'node20'.")), It.IsAny<ExecutionContextLogOptions>()), Times.Once);
+                _ec.Verify(x => x.AddIssue(It.Is<Issue>(s => s.Message.Contains("Missing 'using' value. 'using' requires 'composite', 'docker', 'node12', 'node16', 'node20' or 'node24'.")), It.IsAny<ExecutionContextLogOptions>()), Times.Once);
             }
             finally
             {

src/Test/L0/Worker/HandlerFactoryL0.cs

@@ -33,6 +33,7 @@ namespace GitHub.Runner.Common.Tests.Worker
         [InlineData("node12", "node20")]
         [InlineData("node16", "node20")]
         [InlineData("node20", "node20")]
+        [InlineData("node24", "node24")]
         public void IsNodeVersionUpgraded(string inputVersion, string expectedVersion)
         {
             using (TestHostContext hc = CreateTestContext())
@@ -41,7 +42,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var hf = new HandlerFactory();
                 hf.Initialize(hc);
 
-                // Server Feature Flag
+                // Setup variables
                 var variables = new Dictionary<string, VariableValue>();
                 Variables serverVariables = new(hc, variables);
 
@@ -72,5 +73,48 @@ namespace GitHub.Runner.Common.Tests.Worker
                 Assert.Equal(expectedVersion, handler.Data.NodeVersion);
             }
         }
+
+      
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void Node24ExplicitlyRequested_HonoredByDefault()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var hf = new HandlerFactory();
+                hf.Initialize(hc);
+
+                // Basic variables setup
+                var variables = new Dictionary<string, VariableValue>();
+                Variables serverVariables = new(hc, variables);
+
+                _ec.Setup(x => x.Global).Returns(new GlobalContext()
+                {
+                    Variables = serverVariables,
+                    EnvironmentVariables = new Dictionary<string, string>()
+                });
+
+                // Act - Node 24 explicitly requested in action.yml
+                var data = new NodeJSActionExecutionData();
+                data.NodeVersion = "node24";
+                var handler = hf.Create(
+                    _ec.Object,
+                    new ScriptReference(),
+                    new Mock<IStepHost>().Object,
+                    data,
+                    new Dictionary<string, string>(),
+                    new Dictionary<string, string>(),
+                    new Variables(hc, new Dictionary<string, VariableValue>()),
+                    "",
+                    new List<JobExtensionRunner>()
+                ) as INodeScriptActionHandler;
+
+                // Assert - should be node24 as requested
+                Assert.Equal("node24", handler.Data.NodeVersion);
+            }
+        }
     }
 }

src/Test/L0/Worker/Handlers/NodeHandlerL0.cs

@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.CompilerServices;
+using System.Threading;
+using System.Threading.Tasks;
+using GitHub.DistributedTask.WebApi;
+using GitHub.Runner.Sdk;
+using GitHub.Runner.Worker;
+using GitHub.Runner.Worker.Handlers;
+using Moq;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Worker.Handlers
+{
+    public sealed class NodeHandlerL0
+    {
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void NodeJSActionExecutionDataSupportsNode24()
+        {
+            // Create NodeJSActionExecutionData with node24
+            var nodeJSData = new NodeJSActionExecutionData
+            {
+                NodeVersion = "node24",
+                Script = "test.js"
+            };
+            
+            // Act & Assert
+            Assert.Equal("node24", nodeJSData.NodeVersion);
+            Assert.Equal(ActionExecutionType.NodeJS, nodeJSData.ExecutionType);
+        }
+    }
+}

src/Test/L0/Worker/StepHostL0.cs

@@ -162,6 +162,60 @@ namespace GitHub.Runner.Common.Tests.Worker
                 Assert.Equal("node20", nodeVersion);
             }
         }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task DetermineNode24RuntimeVersionInAlpineContainerAsync()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var sh = new ContainerStepHost();
+                sh.Initialize(hc);
+                sh.Container = new ContainerInfo() { ContainerId = "1234abcd" };
+
+                _dc.Setup(d => d.DockerExec(_ec.Object, It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<List<string>>()))
+                    .Callback((IExecutionContext ec, string id, string options, string command, List<string> output) =>
+                    {
+                        output.Add("alpine");
+                    })
+                    .ReturnsAsync(0);
+
+                // Act.
+                var nodeVersion = await sh.DetermineNodeRuntimeVersion(_ec.Object, "node24");
+
+                // Assert.
+                Assert.Equal("node24_alpine", nodeVersion);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task DetermineNode24RuntimeVersionInUnknownContainerAsync()
+        {
+            using (TestHostContext hc = CreateTestContext())
+            {
+                // Arrange.
+                var sh = new ContainerStepHost();
+                sh.Initialize(hc);
+                sh.Container = new ContainerInfo() { ContainerId = "1234abcd" };
+
+                _dc.Setup(d => d.DockerExec(_ec.Object, It.IsAny<string>(), It.IsAny<string>(), It.IsAny<string>(), It.IsAny<List<string>>()))
+                    .Callback((IExecutionContext ec, string id, string options, string command, List<string> output) =>
+                    {
+                        output.Add("github");
+                    })
+                    .ReturnsAsync(0);
+
+                // Act.
+                var nodeVersion = await sh.DetermineNodeRuntimeVersion(_ec.Object, "node24");
+
+                // Assert.
+                Assert.Equal("node24", nodeVersion);
+            }
+        }
 #endif
     }
 }

src/Test/L0/Worker/StepHostNodeVersionL0.cs

@@ -0,0 +1,63 @@
+using GitHub.Runner.Worker;
+using GitHub.Runner.Worker.Handlers;
+using Moq;
+using System;
+using System.Runtime.InteropServices;
+using Xunit;
+
+namespace GitHub.Runner.Common.Tests.Worker
+{
+    public sealed class StepHostNodeVersionL0
+    {
+        private Mock<IExecutionContext> _ec;
+        private DefaultStepHost _defaultStepHost;
+
+        public StepHostNodeVersionL0()
+        {
+            _ec = new Mock<IExecutionContext>();
+            _defaultStepHost = new DefaultStepHost();
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CheckNodeVersionForArm32_Node24OnArm32Linux()
+        {
+            // Test via NodeUtil directly
+            string preferredVersion = "node24";
+            var (nodeVersion, warningMessage) = Common.Util.NodeUtil.CheckNodeVersionForLinuxArm32(preferredVersion);
+
+            // On ARM32 Linux, we should fall back to node20
+            bool isArm32 = RuntimeInformation.ProcessArchitecture == Architecture.Arm ||
+                          Environment.GetEnvironmentVariable("PROCESSOR_ARCHITECTURE")?.Contains("ARM") == true;
+            bool isLinux = RuntimeInformation.IsOSPlatform(OSPlatform.Linux);
+
+            if (isArm32 && isLinux)
+            {
+                // Should downgrade to node20 on ARM32 Linux
+                Assert.Equal("node20", nodeVersion);
+                Assert.NotNull(warningMessage);
+                Assert.Contains("Node 24 is not supported on Linux ARM32 platforms", warningMessage);
+            }
+            else
+            {
+                // On non-ARM32 platforms, should pass through the version unmodified
+                Assert.Equal("node24", nodeVersion);
+                Assert.Null(warningMessage);
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public void CheckNodeVersionForArm32_PassThroughNonNode24Versions()
+        {
+            string preferredVersion = "node20";
+            var (nodeVersion, warningMessage) = Common.Util.NodeUtil.CheckNodeVersionForLinuxArm32(preferredVersion);
+
+            // Should never modify the version for non-node24 inputs
+            Assert.Equal("node20", nodeVersion);
+            Assert.Null(warningMessage);
+        }
+    }
+}

src/Test/Test.csproj

@@ -15,7 +15,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.13.0" />
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
         <PackageReference Include="xunit" Version="2.7.1" />
         <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
         <PackageReference Include="System.Reflection.TypeExtensions" Version="4.7.0" />

src/Test/TestData/node24action.yml

@@ -0,0 +1,20 @@
+name: 'Hello World'
+description: 'Greet the world and record the time'
+author: 'Test Corporation'
+inputs: 
+  greeting: # id of input
+    description: 'The greeting we choose - will print ""{greeting}, World!"" on stdout'
+    required: true
+    default: 'Hello'
+    deprecationMessage: 'This property has been deprecated'
+  entryPoint: # id of input
+    description: 'optional docker entrypoint overwrite.'
+    required: false
+outputs:
+  time: # id of output
+    description: 'The time we did the greeting'
+icon: 'hello.svg' # vector art to display in the GitHub Marketplace
+color: 'green' # optional, decorates the entry in the GitHub Marketplace
+runs:
+  using: 'node24'
+  main: 'main.js'

src/dev.sh

@@ -17,7 +17,7 @@ LAYOUT_DIR="$SCRIPT_DIR/../_layout"
 DOWNLOAD_DIR="$SCRIPT_DIR/../_downloads/netcore2x"
 PACKAGE_DIR="$SCRIPT_DIR/../_package"
 DOTNETSDK_ROOT="$SCRIPT_DIR/../_dotnetsdk"
-DOTNETSDK_VERSION="8.0.410"
+DOTNETSDK_VERSION="8.0.412"
 DOTNETSDK_INSTALLDIR="$DOTNETSDK_ROOT/$DOTNETSDK_VERSION"
 RUNNER_VERSION=$(cat runnerversion)
 

src/global.json

@@ -1,5 +1,5 @@
 {
   "sdk": {
-    "version": "8.0.410"
+    "version": "8.0.412"
   }
 }

src/runnerversion

@@ -1 +1 @@
-2.325.0
+2.327.0