prep 2.336.0 release

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:2": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.423"
+      "version": "8.0.422"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

.github/workflows/close-bugs-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v11
+      - uses: actions/stale@v10
         with:
           close-issue-message: "This issue does not seem to be a problem with the runner application, it concerns the GitHub actions platform more generally. Could you please post your feedback on the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which is actively monitored. Using the forum ensures that we route your problem to the correct team. 😃"
           exempt-issue-labels: "keep"

.github/workflows/close-features-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v11
+      - uses: actions/stale@v10
         with:
           close-issue-message: "Thank you for your interest in the runner application and taking the time to provide your valuable feedback. We kindly ask you to redirect this feedback to the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which our team actively monitors and would be a better place to start a discussion for new feature requests in GitHub Actions. For more information on this policy please [read our contribution guidelines](https://github.com/actions/runner#contribute). 😃"
           exempt-issue-labels: "keep"

.github/workflows/dependency-check.yml

@@ -31,7 +31,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
 

.github/workflows/npm-audit-typescript.yml

@@ -9,7 +9,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
       - name: NPM install and audit fix with TypeScript auto-repair

.github/workflows/npm-audit.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v7
       
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v6
         with:
           node-version: "20"
           

.github/workflows/stale-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v11
+      - uses: actions/stale@v10
         with:
           stale-issue-message: "This issue is stale because it has been open 365 days with no activity. Remove stale label or comment or this will be closed in 15 days."
           close-issue-message: "This issue was closed because it has been stalled for 15 days with no activity."

releaseNote.md

@@ -1,32 +1,40 @@
 ## What's Changed
-* Canceled background steps should not impact job result by @lokesh755 in https://github.com/actions/runner/pull/4482
-* Report actions archive size in telemetry. by @TingluoHuang in https://github.com/actions/runner/pull/4509
-* Bump actions/checkout from 6 to 7 by @dependabot[bot] in https://github.com/actions/runner/pull/4511
-* Update Docker to v29.6.0 and Buildx to v0.35.0 by @github-actions[bot] in https://github.com/actions/runner/pull/4516
-* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4519
-* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4530
-* feat: enhance telemetry for action download resolution and failures by @TingluoHuang in https://github.com/actions/runner/pull/4536
-* Update Docker version to 29.6.1 by @AllanGuigou in https://github.com/actions/runner/pull/4539
-* feat: add self-repository action reference syntax by @nodeselector in https://github.com/actions/runner/pull/4457
-* Update dotnet sdk to latest version @8.0.422 by @github-actions[bot] in https://github.com/actions/runner/pull/4504
-* Link config.sh and installdependencies.sh in docs by @Wuodan in https://github.com/actions/runner/pull/4526
-* Add support for $GITHUB_ARTIFACTS environment files by @bdehamer in https://github.com/actions/runner/pull/4527
-* feat: expose effective cache-mode to steps via ACTIONS_CACHE_MODE by @philip-gai in https://github.com/actions/runner/pull/4538
-* Setup Job: announce when running with locked dependencies by @nodeselector in https://github.com/actions/runner/pull/4546
-* Setup Job: reword locked-dependencies log line to use lockfile language by @nodeselector in https://github.com/actions/runner/pull/4550
-* Wait for worker to finish during cancel by @TingluoHuang in https://github.com/actions/runner/pull/4553
-* do not cap migrated setting retry is exception is session conflict by @aiqiaoy in https://github.com/actions/runner/pull/4557
-* Allow checking DNS with api.gihub.com. by @TingluoHuang in https://github.com/actions/runner/pull/4547
-* Exit ephemeral runners on broker acknowledge job-not-found by @rentziass in https://github.com/actions/runner/pull/4540
-* Cleanup session files on get message or session deleted error by @nikola-jokic in https://github.com/actions/runner/pull/4551
-* Recreate session on RunnerSessionInvalid from broker by @luketomlinson in https://github.com/actions/runner/pull/4556
+* Bump System.ServiceProcess.ServiceController from 10.0.6 to 10.0.7 by @dependabot[bot] in https://github.com/actions/runner/pull/4370
+* Bump @actions/glob from 0.6.1 to 0.7.0 in /src/Misc/expressionFunc/hashFiles by @dependabot[bot] in https://github.com/actions/runner/pull/4367
+* feat: propagate actions dependencies by @nodeselector in https://github.com/actions/runner/pull/4372
+* Not retry and report action download 403. by @TingluoHuang in https://github.com/actions/runner/pull/4391
+* Update setup job starting logs by @GitPaulo in https://github.com/actions/runner/pull/4383
+* fix: expand commit hash regex to support SHA-256 (64-char) hashes by @yaananth in https://github.com/actions/runner/pull/4347
+* Move dap setup to setup job step by @rentziass in https://github.com/actions/runner/pull/4403
+* Add support for Ubuntu 26.04 (liblttng-ust1t64, libicu77-80) by @dvaldivia in https://github.com/actions/runner/pull/4394
+* Update dotnet sdk to latest version @8.0.421 by @github-actions[bot] in https://github.com/actions/runner/pull/4428
+* Update Docker to v29.5.0 and Buildx to v0.34.0 by @github-actions[bot] in https://github.com/actions/runner/pull/4425
+* Execute debugger REPL commands inside job container by @rentziass in https://github.com/actions/runner/pull/4420
+* Send welcome message in debugger console on connect by @rentziass in https://github.com/actions/runner/pull/4419
+* Update snapshot-if context and functions by @drielenr in https://github.com/actions/runner/pull/4443
+* chore: update Node versions by @github-actions[bot] in https://github.com/actions/runner/pull/4452
+* Allow disable node v8 maglev jit compiler on node24. by @TingluoHuang in https://github.com/actions/runner/pull/4447
+* Update Node 24 default date to June 16th, 2026 by @salmanmkc in https://github.com/actions/runner/pull/4462
+* Populate telemetry for non-action post-job steps by @drielenr in https://github.com/actions/runner/pull/4463
+* Add SDK types and results plumbing for background step control by @lokesh755 in https://github.com/actions/runner/pull/4472
+* Add job execution view model by @rentziass in https://github.com/actions/runner/pull/4470
+* Add thread-safety locks to StepsContext by @lokesh755 in https://github.com/actions/runner/pull/4475
+* Add background step deferral infrastructure and metadata plumbing by @lokesh755 in https://github.com/actions/runner/pull/4479
+* Wire job execution view into DAP by @rentziass in https://github.com/actions/runner/pull/4471
+* Background steps execution engine by @lokesh755 in https://github.com/actions/runner/pull/4476
+* Update Docker to v29.5.2 and Buildx to v0.34.1 by @github-actions[bot] in https://github.com/actions/runner/pull/4451
+* BrokerServer should not retry on 401. by @TingluoHuang in https://github.com/actions/runner/pull/4445
+* Add new env var to allow single-prefix multiline logs on stdout by @nuclearpidgeon in https://github.com/actions/runner/pull/4424
+* Bump Microsoft.DevTunnels.Connections from 1.3.39 to 1.3.48 by @dependabot[bot] in https://github.com/actions/runner/pull/4441
+* Bump System.Formats.Asn1 and System.Security.Cryptography.Pkcs by @dependabot[bot] in https://github.com/actions/runner/pull/4369
 
 ## New Contributors
-* @Wuodan made their first contribution in https://github.com/actions/runner/pull/4526
-* @bdehamer made their first contribution in https://github.com/actions/runner/pull/4527
-* @philip-gai made their first contribution in https://github.com/actions/runner/pull/4538
+* @GitPaulo made their first contribution in https://github.com/actions/runner/pull/4383
+* @dvaldivia made their first contribution in https://github.com/actions/runner/pull/4394
+* @drielenr made their first contribution in https://github.com/actions/runner/pull/4443
+* @nuclearpidgeon made their first contribution in https://github.com/actions/runner/pull/4424
 
-**Full Changelog**: https://github.com/actions/runner/compare/v2.335.0...v2.336.0
+**Full Changelog**: https://github.com/actions/runner/compare/v2.334.0...v2.335.0
 
 _Note: Actions Runner follows a progressive release policy, so the latest release might not be available to your enterprise, organization, or repository yet.
 To confirm which version of the Actions Runner you should expect, please view the download instructions for your enterprise, organization, or repository.

src/Misc/expressionFunc/hashFiles/package.json

@@ -38,10 +38,10 @@
     "@stylistic/eslint-plugin": "^5.10.0",
     "@types/node": "^22.0.0",
     "@typescript-eslint/eslint-plugin": "^8.59.0",
-    "@typescript-eslint/parser": "^8.65.0",
+    "@typescript-eslint/parser": "^8.59.0",
     "@vercel/ncc": "^0.38.3",
     "eslint": "^8.47.0",
-    "eslint-plugin-github": "^6.1.0",
+    "eslint-plugin-github": "^4.10.2",
     "eslint-plugin-prettier": "^5.0.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.4.0",

src/Runner.Worker/Dap/DapDebugger.cs

@@ -1026,9 +1026,7 @@ namespace GitHub.Runner.Worker.Dap
             {
                 if (!string.IsNullOrEmpty(debuggerConfig.WelcomeMessage))
                 {
-                    // The welcome message is server-supplied and never rendered verbatim:
-                    // mask secrets and strip control characters before it reaches the console.
-                    SendOutput("console", SanitizeConsoleText(MaskUserVisibleText(debuggerConfig.WelcomeMessage)));
+                    SendOutput("console", debuggerConfig.WelcomeMessage);
                     Trace.Info("Sent custom welcome message");
                 }
                 else
@@ -1774,30 +1772,6 @@ namespace GitHub.Runner.Worker.Dap
             return HostContext?.SecretMasker?.MaskSecrets(value) ?? value;
         }
 
-        /// <summary>
-        /// Removes C0/C1 control characters (except tab, carriage return and line feed) so
-        /// server-supplied text cannot inject ANSI escape sequences or terminal control codes
-        /// into the DAP console.
-        /// </summary>
-        internal static string SanitizeConsoleText(string value)
-        {
-            if (string.IsNullOrEmpty(value))
-            {
-                return value ?? string.Empty;
-            }
-
-            var builder = new StringBuilder(value.Length);
-            foreach (var character in value)
-            {
-                if (!char.IsControl(character) || character == '\t' || character == '\r' || character == '\n')
-                {
-                    builder.Append(character);
-                }
-            }
-
-            return builder.ToString();
-        }
-
         /// <summary>
         /// Creates a DAP response with common fields pre-populated.
         /// </summary>

src/Runner.Worker/Dap/DebuggerConfig.cs

@@ -36,11 +36,6 @@ namespace GitHub.Runner.Worker.Dap
         /// Optional welcome message content for the debugger console. Only used when
         /// <see cref="OverrideWelcomeMessage"/> is true.
         /// </summary>
-        /// <remarks>
-        /// Server-supplied and treated as untrusted: it is masked with the runner's
-        /// secret masker and stripped of control characters before being written to
-        /// the debugger console.
-        /// </remarks>
         public string WelcomeMessage { get; }
 
         /// <summary>Whether the tunnel configuration is complete and valid.</summary>

src/Runner.Worker/Runner.Worker.csproj

@@ -23,7 +23,7 @@
     <PackageReference Include="System.ServiceProcess.ServiceController" Version="10.0.3" />
     <PackageReference Include="System.Threading.Channels" Version="10.0.3" />
     <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
-    <PackageReference Include="Microsoft.DevTunnels.Connections" Version="1.3.50" />
+    <PackageReference Include="Microsoft.DevTunnels.Connections" Version="1.3.48" />
   </ItemGroup>
 
   <ItemGroup>

src/Sdk/DTPipelines/Pipelines/AgentJobRequestMessage.cs

@@ -271,7 +271,7 @@ namespace GitHub.DistributedTask.Pipelines
         /// Optional welcome message shown in the debugger console when a client connects.
         /// Only used when the <c>actions_runner_override_debugger_welcome_message</c>
         /// feature flag is set to <c>true</c> in the job variables. With the flag set,
-        /// a non-empty value is shown and a null or empty value suppresses the
+        /// a non-empty value is shown as-is and a null or empty value suppresses the
         /// default welcome message. When the flag is not set, the runner shows its
         /// built-in help text and this field is ignored.
         /// </summary>

src/Sdk/Sdk.csproj

@@ -18,19 +18,19 @@
     </ItemGroup>
 
     <ItemGroup>
-        <PackageReference Include="Azure.Storage.Blobs" Version="12.29.1" />
+        <PackageReference Include="Azure.Storage.Blobs" Version="12.27.0" />
         <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0" />
         <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
         <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
         <PackageReference Include="System.Security.Cryptography.Cng" Version="5.0.0" />
-        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.10" />
-        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.10" />
+        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.7" />
+        <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.3" />
         <PackageReference Include="Minimatch" Version="2.0.0" />
         <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
         <PackageReference Include="System.Net.Http" Version="4.3.4" />
         <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
         <PackageReference Include="System.Private.Uri" Version="4.3.2" />
-        <PackageReference Include="System.Formats.Asn1" Version="10.0.10" />
+        <PackageReference Include="System.Formats.Asn1" Version="10.0.7" />
     </ItemGroup>
 
     <ItemGroup>

src/Test/L0/Worker/DapDebuggerL0.cs

@@ -1422,96 +1422,6 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public async Task WelcomeMessageMasksSecrets()
-        {
-            using (var hc = CreateTestContext())
-            {
-                hc.SecretMasker.AddValue("super-secret-token");
-
-                var port = GetFreePort();
-                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
-                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
-                    overrideWelcomeMessage: true,
-                    welcomeMessage: "Welcome! Token: super-secret-token");
-                await _debugger.StartAsync(jobContext.Object);
-
-                using var client = await ConnectClientAsync(port);
-                var stream = client.GetStream();
-
-                await SendRequestAsync(stream, new Request
-                {
-                    Seq = 1,
-                    Type = "request",
-                    Command = "configurationDone"
-                });
-
-                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
-                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
-
-                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
-                Assert.Contains("\"event\":\"output\"", welcomeMsg);
-                Assert.DoesNotContain("super-secret-token", welcomeMsg);
-                Assert.Contains("***", welcomeMsg);
-
-                await _debugger.StopAsync();
-            }
-        }
-
-        [Fact]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        public async Task WelcomeMessageStripsControlCharacters()
-        {
-            using (CreateTestContext())
-            {
-                var port = GetFreePort();
-                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
-                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
-                    overrideWelcomeMessage: true,
-                    welcomeMessage: "Wel\u001b[31mcome\u0007\u0000\u009bhere\nnext\tline");
-                await _debugger.StartAsync(jobContext.Object);
-
-                using var client = await ConnectClientAsync(port);
-                var stream = client.GetStream();
-
-                await SendRequestAsync(stream, new Request
-                {
-                    Seq = 1,
-                    Type = "request",
-                    Command = "configurationDone"
-                });
-
-                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
-                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
-
-                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
-                Assert.Contains("\"event\":\"output\"", welcomeMsg);
-
-                var output = JObject.Parse(welcomeMsg)["body"]["output"].ToString();
-                Assert.Equal("Wel[31mcomehere\nnext\tline", output);
-
-                await _debugger.StopAsync();
-            }
-        }
-
-        [Theory]
-        [Trait("Level", "L0")]
-        [Trait("Category", "Worker")]
-        [InlineData(null, "")]
-        [InlineData("", "")]
-        [InlineData("plain text", "plain text")]
-        [InlineData("keep\r\nnewlines\tand tabs", "keep\r\nnewlines\tand tabs")]
-        [InlineData("esc\u001bape", "escape")]
-        [InlineData("bell\u0007null\u0000del\u007f", "bellnulldel")]
-        [InlineData("c1\u0080\u009fchars", "c1chars")]
-        public void SanitizeConsoleTextRemovesControlCharacters(string input, string expected)
-        {
-            Assert.Equal(expected, DapDebugger.SanitizeConsoleText(input));
-        }
-
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]

src/dev.sh

@@ -17,7 +17,7 @@ LAYOUT_DIR="$SCRIPT_DIR/../_layout"
 DOWNLOAD_DIR="$SCRIPT_DIR/../_downloads/netcore2x"
 PACKAGE_DIR="$SCRIPT_DIR/../_package"
 DOTNETSDK_ROOT="$SCRIPT_DIR/../_dotnetsdk"
-DOTNETSDK_VERSION="8.0.423"
+DOTNETSDK_VERSION="8.0.422"
 DOTNETSDK_INSTALLDIR="$DOTNETSDK_ROOT/$DOTNETSDK_VERSION"
 RUNNER_VERSION=$(cat runnerversion)
 

src/global.json

@@ -1,5 +1,5 @@
 {
   "sdk": {
-    "version": "8.0.423"
+    "version": "8.0.422"
   }
 }