Merge branch 'actions:main' into main

Author: ramil-bitrise

.devcontainer/devcontainer.json

@@ -4,7 +4,7 @@
   "features": {
     "ghcr.io/devcontainers/features/docker-in-docker:1": {},
     "ghcr.io/devcontainers/features/dotnet": {
-      "version": "8.0.417"
+      "version": "8.0.418"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

README.md

@@ -32,7 +32,7 @@ We are taking the following steps to better direct requests related to GitHub Ac
 
 2. High Priority bugs can be reported through Community Discussions or you can report these to our support team https://support.github.com/contact/bug-report.
 
-3. Security Issues should be handled as per our [security.md](security.md)
+3. Security Issues should be handled as per our [SECURITY.md](https://github.com/actions/runner?tab=security-ov-file)
 
 We will still provide security updates for this project and fix major breaking changes during this time.
 

src/Misc/externals.sh

@@ -7,7 +7,7 @@ NODE_ALPINE_URL=https://github.com/actions/alpine_nodejs/releases/download
 # When you update Node versions you must also create a new release of alpine_nodejs at that updated version.
 # Follow the instructions here: https://github.com/actions/alpine_nodejs?tab=readme-ov-file#getting-started
 NODE20_VERSION="20.20.0"
-NODE24_VERSION="24.13.0"
+NODE24_VERSION="24.13.1"
 
 get_abs_path() {
   # exploits the fact that pwd will print abs path when no args

src/Runner.Common/ConfigurationStore.cs

@@ -75,6 +75,41 @@ public bool IsHostedServer
                 {
                     return UrlUtil.IsHostedServer(new UriBuilder(GitHubUrl));
                 }
+                else
+                {
+                    // feature flag env in case the new logic is wrong.
+                    if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_FORCE_EMPTY_GITHUB_URL_IS_HOSTED")))
+                    {
+                        return true;
+                    }
+
+                    // GitHubUrl will be empty for jit configured runner
+                    // We will try to infer it from the ServerUrl/ServerUrlV2
+                    if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_FORCE_GHES")))
+                    {
+                        // Allow env to override and force GHES in case the inference logic is wrong.
+                        return false;
+                    }
+
+                    if (!string.IsNullOrEmpty(ServerUrl))
+                    {
+                        // pipelines services
+                        var serverUrl = new UriBuilder(ServerUrl);
+                        return serverUrl.Host.EndsWith(".actions.githubusercontent.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrl.Host.EndsWith(".codedev.ms", StringComparison.OrdinalIgnoreCase);
+                    }
+
+                    if (!string.IsNullOrEmpty(ServerUrlV2))
+                    {
+                        // broker-listener
+                        var serverUrlV2 = new UriBuilder(ServerUrlV2);
+                        return serverUrlV2.Host.EndsWith(".actions.githubusercontent.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".githubapp.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".ghe.com", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".actions.localhost", StringComparison.OrdinalIgnoreCase)
+                                || serverUrlV2.Host.EndsWith(".ghe.localhost", StringComparison.OrdinalIgnoreCase);
+                    }
+                }
 
                 // Default to true since Hosted runners likely don't have this property set.
                 return true;

src/Runner.Common/Constants.cs

@@ -190,6 +190,10 @@ public static class NodeMigration
                 // Feature flags for controlling the migration phases
                 public static readonly string UseNode24ByDefaultFlag = "actions.runner.usenode24bydefault";
                 public static readonly string RequireNode24Flag = "actions.runner.requirenode24";
+                public static readonly string WarnOnNode20Flag = "actions.runner.warnonnode20";
+
+                // Blog post URL for Node 20 deprecation
+                public static readonly string Node20DeprecationUrl = "https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/";
             }
 
             public static readonly string InternalTelemetryIssueDataKey = "_internal_telemetry";

src/Runner.Worker/ExecutionContext.cs

@@ -856,6 +856,9 @@ public void InitializeJob(Pipelines.AgentJobRequestMessage message, Cancellation
             // Job level annotations
             Global.JobAnnotations = new List<Annotation>();
 
+            // Track Node.js 20 actions for deprecation warning
+            Global.DeprecatedNode20Actions = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
             // Job Outputs
             JobOutputs = new Dictionary<string, VariableValue>(StringComparer.OrdinalIgnoreCase);
 

src/Runner.Worker/GlobalContext.cs

@@ -33,5 +33,6 @@ public sealed class GlobalContext
         public bool HasActionManifestMismatch { get; set; }
         public bool HasDeprecatedSetOutput { get; set; }
         public bool HasDeprecatedSaveState { get; set; }
+        public HashSet<string> DeprecatedNode20Actions { get; set; }
     }
 }

src/Runner.Worker/Handlers/HandlerFactory.cs

@@ -65,6 +65,20 @@ public IHandler Create(
                     nodeData.NodeVersion = Common.Constants.Runner.NodeMigration.Node20;
                 }
 
+                // Track Node.js 20 actions for deprecation annotation
+                if (string.Equals(nodeData.NodeVersion, Constants.Runner.NodeMigration.Node20, StringComparison.InvariantCultureIgnoreCase))
+                {
+                    bool warnOnNode20 = executionContext.Global.Variables?.GetBoolean(Constants.Runner.NodeMigration.WarnOnNode20Flag) ?? false;
+                    if (warnOnNode20)
+                    {
+                        string actionName = GetActionName(action);
+                        if (!string.IsNullOrEmpty(actionName))
+                        {
+                            executionContext.Global.DeprecatedNode20Actions?.Add(actionName);
+                        }
+                    }
+                }
+
                 // Check if node20 was explicitly specified in the action
                 // We don't modify if node24 was explicitly specified
                 if (string.Equals(nodeData.NodeVersion, Constants.Runner.NodeMigration.Node20, StringComparison.InvariantCultureIgnoreCase))
@@ -90,7 +104,8 @@ public IHandler Create(
                     if (useNode24ByDefault && !requireNode24 && string.Equals(finalNodeVersion, Constants.Runner.NodeMigration.Node24, StringComparison.OrdinalIgnoreCase))
                     {
                         string infoMessage = "Node 20 is being deprecated. This workflow is running with Node 24 by default. " +
-                                             "If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable.";
+                                             "If you need to temporarily use Node 20, you can set the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true environment variable. " +
+                                             $"For more information see: {Constants.Runner.NodeMigration.Node20DeprecationUrl}";
                         executionContext.Output(infoMessage);
                     }
                 }
@@ -129,5 +144,25 @@ public IHandler Create(
             handler.LocalActionContainerSetupSteps = localActionContainerSetupSteps;
             return handler;
         }
+
+        private static string GetActionName(Pipelines.ActionStepDefinitionReference action)
+        {
+            if (action is Pipelines.RepositoryPathReference repoRef)
+            {
+                var pathString = string.Empty;
+                if (!string.IsNullOrEmpty(repoRef.Path))
+                {
+                    pathString = string.IsNullOrEmpty(repoRef.Name)
+                        ? repoRef.Path
+                        : $"/{repoRef.Path}";
+                }
+                var repoString = string.IsNullOrEmpty(repoRef.Ref)
+                    ? $"{repoRef.Name}{pathString}"
+                    : $"{repoRef.Name}{pathString}@{repoRef.Ref}";
+                return string.IsNullOrEmpty(repoString) ? null : repoString;
+            }
+
+            return null;
+        }
     }
 }

src/Runner.Worker/JobExtension.cs

@@ -735,6 +735,15 @@ public async Task FinalizeJob(IExecutionContext jobContext, Pipelines.AgentJobRe
                             context.Global.JobTelemetry.Add(new JobTelemetry() { Type = JobTelemetryType.ConnectivityCheck, Message = $"Fail to check service connectivity. {ex.Message}" });
                         }
                     }
+
+                    // Add deprecation warning annotation for Node.js 20 actions
+                    if (context.Global.DeprecatedNode20Actions?.Count > 0)
+                    {
+                        var sortedActions = context.Global.DeprecatedNode20Actions.OrderBy(a => a, StringComparer.OrdinalIgnoreCase);
+                        var actionsList = string.Join(", ", sortedActions);
+                        var deprecationMessage = $"Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: {actionsList}. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: {Constants.Runner.NodeMigration.Node20DeprecationUrl}";
+                        context.Warning(deprecationMessage);
+                    }
                 }
                 catch (Exception ex)
                 {