Add fallback install directory when default is not writable (#785)

* Add fallback install directory when default is not writable

* Refactor macOS install directory handling to warn when default is not writable

.eslintignore

@@ -1,6 +0,0 @@
-# Ignore list
-/*
-
-# Do not ignore these folders:
-!__tests__/
-!src/

.eslintrc.js

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  extends: [
-    'eslint:recommended',
-    'plugin:@typescript-eslint/recommended',
-    'plugin:eslint-plugin-jest/recommended',
-    'eslint-config-prettier'
-  ],
-  parser: '@typescript-eslint/parser',
-  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
-  rules: {
-    '@typescript-eslint/no-require-imports': 'error',
-    '@typescript-eslint/no-non-null-assertion': 'off',
-    '@typescript-eslint/no-explicit-any': 'off',
-    '@typescript-eslint/no-empty-function': 'off',
-    '@typescript-eslint/ban-ts-comment': [
-      'error',
-      {
-        'ts-ignore': 'allow-with-description'
-      }
-    ],
-    'no-console': 'error',
-    'yoda': 'error',
-    'prefer-const': [
-      'error',
-      {
-        destructuring: 'all'
-      }
-    ],
-    'no-control-regex': 'off',
-    'no-constant-condition': ['error', {checkLoops: false}],
-    'node/no-extraneous-import': 'error'
-  },
-  overrides: [
-    {
-      files: ['**/*{test,spec}.ts'],
-      rules: {
-        '@typescript-eslint/no-unused-vars': 'off',
-        'jest/no-standalone-expect': 'off',
-        'jest/no-conditional-expect': 'off',
-        'no-console': 'off',
-
-      }
-    }
-  ],
-  env: {
-    node: true,
-    es6: true,
-    'jest/globals': true
-  }
-};

.github/workflows/basic-validation.yml

@@ -14,6 +14,7 @@ on:
 jobs:
   call-basic-validation:
     name: Basic validation
+    cache-mode: read
     uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
     with:
       node-version: '24'

.github/workflows/check-dist.yml

@@ -14,6 +14,7 @@ on:
 jobs:
   call-check-dist:
     name: Check dist/
+    cache-mode: read
     uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
     with:
       node-version: '24'

.github/workflows/e2e-tests.yml

@@ -27,7 +27,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -57,7 +57,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -92,7 +92,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -123,7 +123,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -149,7 +149,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -180,7 +180,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -208,7 +208,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -239,7 +239,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -265,7 +265,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -290,7 +290,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -315,7 +315,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -347,7 +347,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -379,7 +379,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -410,7 +410,7 @@ jobs:
       NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -448,7 +448,7 @@ jobs:
       NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -482,7 +482,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -515,7 +515,7 @@ jobs:
           ]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -555,7 +555,7 @@ jobs:
       http_proxy: http://squid-proxy:3128
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -578,7 +578,7 @@ jobs:
       no_proxy: github.com,download.visualstudio.microsoft.com,api.nuget.org,builds.dotnet.microsoft.com,ci.dot.net
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -610,7 +610,7 @@ jobs:
         higher-version: ['10.0.101']
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -639,7 +639,7 @@ jobs:
           [ubuntu-latest, windows-latest, macos-15-intel, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -678,7 +678,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Clear toolcache
         shell: pwsh
@@ -706,7 +706,7 @@ jobs:
         operating-system: [ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -726,7 +726,7 @@ jobs:
         operating-system: [macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -738,3 +738,55 @@ jobs:
       - name: Verify dotnet
         shell: pwsh
         run: __tests__/verify-dotnet.ps1 -Patterns "^9\.0\.1\d{2}"
+
+  test-check-latest-false:
+    runs-on: ${{ matrix.operating-system }}
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Clear toolcache
+        shell: pwsh
+        run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
+      # Oldest 9.0.1xx SDK: resolving '9.0.1xx' online would return a newer patch.
+      - name: Setup dotnet 9.0.100
+        uses: ./
+        with:
+          dotnet-version: '9.0.100'
+      - name: Setup dotnet 9.0.1xx with check-latest false
+        id: reuse
+        uses: ./
+        with:
+          dotnet-version: '9.0.1xx'
+          check-latest: false
+      - name: Verify dotnet
+        shell: pwsh
+        run: |
+          if ('${{ steps.reuse.outputs.dotnet-version }}' -ne '9.0.100') {
+            throw "Expected 9.0.100 to be reused, got '${{ steps.reuse.outputs.dotnet-version }}'."
+          }
+          __tests__/verify-dotnet.ps1 -Patterns "^9\.0\.100$"
+
+  test-skip-lts-prepass:
+    runs-on: ${{ matrix.operating-system }}
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Clear toolcache
+        shell: pwsh
+        run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
+      - name: Setup dotnet 9.0.308 with skip-lts-prepass
+        uses: ./
+        with:
+          dotnet-version: 9.0.308
+          skip-lts-prepass: true
+      - name: Verify dotnet
+        shell: pwsh
+        run: __tests__/verify-dotnet.ps1 -Patterns "^9\.0\.308$"

.github/workflows/publish-immutable-actions.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checking out
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Publish
         id: publish
         uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4

.github/workflows/test-dotnet.yml

@@ -28,7 +28,7 @@ jobs:
         dotnet-version: ['8.0', '9.0', '10.0']
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}

.licensed.yml

@@ -10,8 +10,11 @@ allowed:
   - mit
   - cc0-1.0
   - unlicense
+  - blueoak-1.0.0
 
 reviewed:
   npm:
     - sax # ISC + MIT
     - "@actions/http-client" # MIT
+    - balanced-match # MIT
+    - brace-expansion # MIT

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.1.0
+version: 6.2.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@actions/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 2.0.3
+version: 3.0.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core

.licenses/npm/@actions/exec.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/exec"
-version: 2.0.0
+version: 3.0.0
 type: npm
 summary: Actions exec lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/exec

.licenses/npm/@actions/github.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/github"
-version: 6.0.1
+version: 9.1.1
 type: npm
 summary: Actions github lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/github

.licenses/npm/@actions/glob-0.6.1.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/glob"
-version: 0.5.1
+version: 0.6.1
 type: npm
 summary: Actions glob lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/glob

.licenses/npm/@actions/glob-0.7.0.dep.yml

@@ -1,20 +1,20 @@
 ---
-name: "@octokit/openapi-types"
+name: "@actions/glob"
-version: 20.0.0
+version: 0.7.0
 type: npm
-summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
+summary: Actions glob lib
-homepage:
+homepage: https://github.com/actions/toolkit/tree/main/packages/glob
 license: mit
 licenses:
-- sources: LICENSE
+- sources: LICENSE.md
   text: |-
-    Copyright 2020 Gregor Martynus
+    The MIT License (MIT)
+
+    Copyright 2019 GitHub
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
     The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
     THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
 notices: []

.licenses/npm/@actions/http-client-4.0.1.dep.yml

@@ -1,10 +1,10 @@
 ---
 name: "@actions/http-client"
-version: 2.2.3
+version: 4.0.1
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
-license: mit
+license: other
 licenses:
 - sources: LICENSE
   text: |

.licenses/npm/@actions/io.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/io"
-version: 2.0.0
+version: 3.0.2
 type: npm
 summary: Actions io lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/io

.licenses/npm/@azure/core-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-client"
-version: 1.10.1
+version: 1.10.2
 type: npm
 summary: Core library for interfacing with AutoRest generated code
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-client/

.licenses/npm/@azure/core-http-compat.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-http-compat"
-version: 2.3.1
+version: 2.4.0
 type: npm
 summary: Core HTTP Compatibility Library to bridge the gap between Core V1 & V2 packages.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-compat/

.licenses/npm/@azure/core-rest-pipeline.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/core-rest-pipeline"
-version: 1.22.2
+version: 1.24.0
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-rest-pipeline/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-rest-pipeline/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/core-xml.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-xml"
-version: 1.5.0
+version: 1.5.1
 type: npm
 summary: Core library for interacting with XML payloads
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-xml/

.licenses/npm/@azure/storage-blob.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-blob"
-version: 12.29.1
+version: 12.32.0
 type: npm
 summary: Microsoft Azure Storage SDK for JavaScript - Blob
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/storage-common.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-common"
-version: 12.1.1
+version: 12.4.1
 type: npm
 summary: Azure Storage Common Client Library for JavaScript
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-internal-avro/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-common/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@nodable/entities.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@nodable/entities"
-version: 2.2.0
+version: 3.0.0
 type: npm
 summary: Entity parser for XML, HTML, External entites with security and NCR control
 homepage:

.licenses/npm/@octokit/auth-token.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/auth-token"
-version: 4.0.0
+version: 6.0.0
 type: npm
 summary: GitHub API token authentication for browsers and Node.js
 homepage:

.licenses/npm/@octokit/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/core"
-version: 5.0.1
+version: 7.0.6
 type: npm
 summary: Extendable client for GitHub's REST & GraphQL APIs
 homepage:

.licenses/npm/@octokit/endpoint.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/endpoint"
-version: 9.0.6
+version: 11.0.3
 type: npm
 summary: Turns REST API endpoints into generic request options
 homepage:

.licenses/npm/@octokit/graphql.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/graphql"
-version: 7.0.2
+version: 9.0.3
 type: npm
 summary: GitHub GraphQL API client for browsers and Node
 homepage:

.licenses/npm/@octokit/openapi-types.dep.yml

@@ -1,14 +1,14 @@
 ---
 name: "@octokit/openapi-types"
-version: 24.2.0
+version: 27.0.0
 type: npm
 summary: Generated TypeScript definitions based on GitHub's OpenAPI spec for api.github.com
 homepage:
 license: mit
 licenses:
 - sources: LICENSE
-  text: |-
+  text: |
-    Copyright 2020 Gregor Martynus
+    Copyright (c) GitHub 2025 - Licensed as MIT.
 
     Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

.licenses/npm/@octokit/plugin-paginate-rest.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-paginate-rest"
-version: 9.2.2
+version: 14.0.0
 type: npm
 summary: Octokit plugin to paginate REST API endpoint responses
 homepage:

.licenses/npm/@octokit/plugin-rest-endpoint-methods.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/plugin-rest-endpoint-methods"
-version: 10.4.1
+version: 17.0.0
 type: npm
 summary: Octokit plugin adding one method for all of api.github.com REST API endpoints
 homepage:

.licenses/npm/@octokit/request-error.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request-error"
-version: 5.1.1
+version: 7.1.0
 type: npm
 summary: Error class for Octokit request errors
 homepage:

.licenses/npm/@octokit/request.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/request"
-version: 8.4.1
+version: 10.0.10
 type: npm
 summary: Send parameterized requests to GitHub's APIs with sensible defaults in browsers
   and Node

.licenses/npm/@octokit/types-13.10.0.dep.yml

@@ -1,20 +0,0 @@
----
-name: "@octokit/types"
-version: 13.10.0
-type: npm
-summary: Shared TypeScript definitions for Octokit projects
-homepage:
-license: mit
-licenses:
-- sources: LICENSE
-  text: |
-    MIT License Copyright (c) 2019 Octokit contributors
-
-    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-    The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
-
-    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-- sources: README.md
-  text: "[MIT](LICENSE)"
-notices: []

.licenses/npm/@octokit/types.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@octokit/types"
-version: 12.6.0
+version: 16.0.0
 type: npm
 summary: Shared TypeScript definitions for Octokit projects
 homepage:

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.2
+version: 0.3.6
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/ts-http-runtime/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/ts-http-runtime/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/balanced-match-4.0.4.dep.yml

@@ -0,0 +1,34 @@
+---
+name: balanced-match
+version: 4.0.4
+type: npm
+summary: Match balanced character pairs, like "{" and "}"
+homepage:
+license: other
+licenses:
+- sources: LICENSE.md
+  text: |
+    (MIT)
+
+    Original code Copyright Julian Gruber <julian@juliangruber.com>
+
+    Port to TypeScript Copyright Isaac Z. Schlueter <i@izs.me>
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+    of the Software, and to permit persons to whom the Software is furnished to do
+    so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/before-after-hook.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: before-after-hook
-version: 2.2.3
+version: 4.0.0
 type: npm
 summary: asynchronous before/error/after hooks for internal functionality
 homepage:

.licenses/npm/brace-expansion-1.1.21.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.15
+version: 1.1.21
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/brace-expansion-5.0.12.dep.yml

@@ -0,0 +1,34 @@
+---
+name: brace-expansion
+version: 5.0.12
+type: npm
+summary: Brace expansion as known from sh/bash
+homepage:
+license: other
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright Julian Gruber <julian@juliangruber.com>
+
+    TypeScript port Copyright Isaac Z. Schlueter <i@izs.me>
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/content-type.dep.yml

@@ -0,0 +1,47 @@
+---
+name: content-type
+version: 2.0.0
+type: npm
+summary: Create and parse HTTP Content-Type header
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    (The MIT License)
+
+    Copyright (c) 2015 Douglas Christopher Wilson
+
+    Permission is hereby granted, free of charge, to any person obtaining
+    a copy of this software and associated documentation files (the
+    'Software'), to deal in the Software without restriction, including
+    without limitation the rights to use, copy, modify, merge, publish,
+    distribute, sublicense, and/or sell copies of the Software, and to
+    permit persons to whom the Software is furnished to do so, subject to
+    the following conditions:
+
+    The above copyright notice and this permission notice shall be
+    included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+    EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+    MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+    IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+    CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+    TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+- sources: README.md
+  text: |-
+    [MIT](LICENSE)
+
+    [npm-image]: https://img.shields.io/npm/v/content-type
+    [npm-url]: https://npmjs.org/package/content-type
+    [downloads-image]: https://img.shields.io/npm/dm/content-type
+    [downloads-url]: https://npmjs.org/package/content-type
+    [build-image]: https://img.shields.io/github/actions/workflow/status/jshttp/content-type/ci.yml?branch=master
+    [build-url]: https://github.com/jshttp/content-type/actions/workflows/ci.yml?query=branch%3Amaster
+    [coverage-image]: https://img.shields.io/codecov/c/gh/jshttp/content-type
+    [coverage-url]: https://codecov.io/gh/jshttp/content-type
+    [license-image]: http://img.shields.io/npm/l/content-type.svg?style=flat
+    [license-url]: LICENSE
+notices: []

.licenses/npm/debug.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: debug
-version: 4.3.4
+version: 4.4.3
 type: npm
 summary: Lightweight debugging utility for Node.js and the browser
 homepage:

.licenses/npm/deprecation.dep.yml

@@ -1,28 +0,0 @@
----
-name: deprecation
-version: 2.3.1
-type: npm
-summary: Log a deprecation message with stack
-homepage: https://github.com/gr2m/deprecation#readme
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Gregor Martynus and contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-- sources: README.md
-  text: "[ISC](LICENSE)"
-notices: []

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.9.2
+version: 5.10.1
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/is-unsafe.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: is-unsafe
-version: 1.0.1
+version: 2.0.0
 type: npm
 summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
   HTML, XML, SVG, SQL, SHELL, and REGEX contexts

.licenses/npm/json-with-bigint.dep.yml

@@ -1,16 +1,17 @@
 ---
-name: "@azure/abort-controller"
+name: json-with-bigint
-version: 1.1.0
+version: 3.5.8
 type: npm
-summary: Microsoft Azure SDK for JavaScript - Aborter
+summary: JS library that allows you to easily serialize and deserialize data with
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/abort-controller/README.md
+  BigInt values
+homepage:
 license: mit
 licenses:
 - sources: LICENSE
   text: |
-    The MIT License (MIT)
+    MIT License
 
-    Copyright (c) 2020 Microsoft
+    Copyright (c) 2023 Ivan Korolenko
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/lru-cache.dep.yml

@@ -1,26 +0,0 @@
----
-name: lru-cache
-version: 6.0.0
-type: npm
-summary: A cache object that deletes the least-recently-used items.
-homepage:
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/minimatch-10.2.5.dep.yml

@@ -0,0 +1,66 @@
+---
+name: minimatch
+version: 10.2.5
+type: npm
+summary: a glob matcher in javascript
+homepage:
+license: blueoak-1.0.0
+licenses:
+- sources: LICENSE.md
+  text: |
+    # Blue Oak Model License
+
+    Version 1.0.0
+
+    ## Purpose
+
+    This license gives everyone as much permission to work with
+    this software as possible, while protecting contributors
+    from liability.
+
+    ## Acceptance
+
+    In order to receive this license, you must agree to its
+    rules. The rules of this license are both obligations
+    under that agreement and conditions to your license.
+    You must not do anything with this software that triggers
+    a rule that you cannot or will not follow.
+
+    ## Copyright
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe that contributor's
+    copyright in it.
+
+    ## Notices
+
+    You must ensure that everyone who gets a copy of
+    any part of this software from you, with or without
+    changes, also gets the text of this license or a link to
+    <https://blueoakcouncil.org/license/1.0.0>.
+
+    ## Excuse
+
+    If anyone notifies you in writing that you have not
+    complied with [Notices](#notices), you can keep your
+    license by taking all practical steps to comply within 30
+    days after the notice. If you do not do so, your license
+    ends immediately.
+
+    ## Patent
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe any patent claims
+    they can license or become able to license.
+
+    ## Reliability
+
+    No contributor can revoke this license.
+
+    ## No Liability
+
+    **_As far as the law allows, this software comes as is,
+    without any warranty or condition, and no contributor
+    will be liable to anyone for any damages related to this
+    software or this license, under any kind of legal claim._**
+notices: []

.licenses/npm/ms.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: ms
-version: 2.1.2
+version: 2.1.3
 type: npm
 summary: Tiny millisecond conversion utility
 homepage:
@@ -10,7 +10,7 @@ licenses:
   text: |
     The MIT License (MIT)
 
-    Copyright (c) 2016 Zeit, Inc.
+    Copyright (c) 2020 Vercel, Inc.
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal

.licenses/npm/once.dep.yml

@@ -1,26 +0,0 @@
----
-name: once
-version: 1.4.0
-type: npm
-summary: Run a function exactly one time
-homepage: https://github.com/isaacs/once#readme
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/path-expression-matcher.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: path-expression-matcher
-version: 1.5.0
+version: 1.6.2
 type: npm
 summary: Efficient path tracking and pattern matching for XML/JSON parsers
 homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme

.licenses/npm/semver-7.6.0.dep.yml

@@ -1,26 +0,0 @@
----
-name: semver
-version: 7.6.0
-type: npm
-summary: The semantic version parser used by npm.
-homepage:
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/semver.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: semver
-version: 6.3.1
+version: 7.8.5
 type: npm
 summary: The semantic version parser used by npm.
 homepage:

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.27.0
+version: 6.29.1
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

.licenses/npm/universal-user-agent.dep.yml

@@ -1,8 +1,8 @@
 ---
 name: universal-user-agent
-version: 6.0.1
+version: 7.0.3
 type: npm
-summary: Get a user agent string in both browser and node
+summary: Get a user agent string across all JavaScript Runtime Environments
 homepage:
 license: isc
 licenses:
@@ -10,7 +10,7 @@ licenses:
   text: |
     # [ISC License](https://spdx.org/licenses/ISC)
 
-    Copyright (c) 2018, Gregor Martynus (https://github.com/gr2m)
+    Copyright (c) 2018-2021, Gregor Martynus (https://github.com/gr2m)
 
     Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
 

.licenses/npm/wrappy.dep.yml

@@ -1,26 +0,0 @@
----
-name: wrappy
-version: 1.0.2
-type: npm
-summary: Callback wrapping utility
-homepage: https://github.com/npm/wrappy
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/xml-naming-0.3.0.dep.yml

@@ -0,0 +1,35 @@
+---
+name: xml-naming
+version: 0.3.0
+type: npm
+summary: Validates XML name productions — Name, NCName, QName, NMToken, NMTokens —
+  for XML 1.0 and 1.1
+homepage:
+license: mit
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright (c) 2026 Natural Intelligence
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+- sources: README.md
+  text: MIT
+notices: []

.licenses/npm/yallist.dep.yml

@@ -1,26 +0,0 @@
----
-name: yallist
-version: 4.0.0
-type: npm
-summary: Yet Another Linked List
-homepage:
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.prettierrc.js

@@ -1,11 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  printWidth: 80,
-  tabWidth: 2,
-  useTabs: false,
-  semi: true,
-  singleQuote: true,
-  trailingComma: 'none',
-  bracketSpacing: false,
-  arrowParens: 'avoid'
-};

.prettierrc.json

@@ -0,0 +1,10 @@
+{
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid"
+}

README.md

@@ -5,7 +5,7 @@
 
 This action sets up a [.NET CLI](https://github.com/dotnet/sdk) environment for use in actions by:
 
-- optionally downloading and caching a version(s) of dotnet by SDK version(s) and adding to PATH
+- optionally download and install the requested .NET SDK version(s) and add them to the PATH
 - registering problem matchers for error output
 - setting up authentication to private package sources like GitHub Packages
 
@@ -15,12 +15,16 @@ documentation:
 [Software installed on github hosted runners](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#supported-software)
 for .NET SDK versions that are currently available.
 
+## What's new in V6
+
+- Migrated action internals to ESM for compatibility with latest `@actions/*` packages. No changes to action inputs, outputs, or behavior.
+
 ## Breaking changes in V5
 
 - Upgraded action from node20 to node24
   > Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. see [Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
 
-For more details, see the full release notes on the [release page](https://github.com/actions/setup-dotnet/releases/tag/v5.0.0)
+For more details, see the full release notes on the [release page](https://github.com/actions/setup-dotnet/releases)
 
 ## Usage
 
@@ -29,8 +33,8 @@ See [action.yml](action.yml)
 **Basic**:
 ```yaml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '8.0.x'
 - run: dotnet build <my project>
@@ -40,9 +44,9 @@ steps:
 **Multiple version installation**:
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
 - name: Setup dotnet
-  uses: actions/setup-dotnet@v5
+  uses: actions/setup-dotnet@v6
   with:
     dotnet-version: | 
       8.0.x
@@ -75,22 +79,37 @@ The optional `dotnet-channel` input specifies the source channel for the install
 **Install latest LTS version:**
 ```yaml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: latest
     dotnet-channel: LTS
 ```
 
+## Using the `skip-lts-prepass` input
+
+By default, `setup-dotnet` installs a minimal LTS runtime before installing the requested `dotnet-version`, to guarantee a stable `dotnet` executable is available. If your workflow doesn't need this safeguard (for example, the runner image already has a `dotnet` executable, or you're on a clean self-hosted/container environment and want to avoid the extra download), set `skip-lts-prepass: true` to install only the requested version.
+
+```yaml
+steps:
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
+  with:
+    dotnet-version: '9.0.x'
+    skip-lts-prepass: true
+```
+
+> **Note**: Setting skip-lts-prepass: true skips the LTS runtime pre-pass, so the action won't proactively install the latest LTS runtime. The existing dotnet executable and host components will be used if present; on a clean machine, they will come from the requested SDK installation. Consequently, dotnet --info may report a different Host: Version than when the pre-pass runs.
+
 ## Using the `architecture` input
 Using the architecture input, it is possible to specify the required .NET SDK architecture. Possible values:  `x64`, `x86`, `arm64`, `amd64`, `arm`, `s390x`, `ppc64le`, `riscv64`. If the input is not specified, the architecture defaults to the host OS architecture (not all of the architectures are available on all platforms).
 
 **Example: Install multiple SDK versions for a specific architecture**
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
 - name: Setup dotnet (x86)
-  uses: actions/setup-dotnet@v5
+  uses: actions/setup-dotnet@v6
   with:
     dotnet-version: |
       8.0.x
@@ -101,14 +120,28 @@ steps:
 
 ## Using the `dotnet-quality` input
 
-The `dotnet-quality` input installs the latest build of the specified quality in the channel. Supported values: `daily`, `preview`, `ga`.
+The `dotnet-quality` input installs the latest build of the specified quality in the channel. Supported values: `daily`, `preview`, `ga`. For more details about quality options, see the [official .NET documentation](https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-install-script#options).
+
+> **Important**: `dotnet-quality` is a single input shared across all versions listed in `dotnet-version` for the same step (and is only applied where supported by the version format), so per-version quality is not supported. For example, setting `dotnet-quality: preview` for `10.0.x` and `11.0.x` resolves both versions as previews. To install a released SDK alongside a preview SDK, use separate steps:
+
+```yaml
+steps:
+- uses: actions/setup-dotnet@v6
+  with:
+    dotnet-version: '10.0.x'
+
+- uses: actions/setup-dotnet@v6
+  with:
+    dotnet-version: '11.0.x'
+    dotnet-quality: 'preview'
+```
 
 > **Note**: When used with a specific SDK version, `dotnet-quality` supports only `A.B`, `A.B.x`, `A`, `A.x`, and `A.B.Cxx` formats where the major version is higher than 5. For all other formats, `dotnet-quality` will be ignored.
 
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '8.0.x'
     dotnet-quality: 'preview'
@@ -119,8 +152,8 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: latest
     dotnet-channel: LTS
@@ -134,8 +167,8 @@ steps:
 
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     global-json-file: csharp/global.json
 - run: dotnet build <my project>
@@ -144,6 +177,8 @@ steps:
 
 > **Note**: The action supports `latest*` variants of the [rollForward](https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#rollforward) field in `global.json`. When set to `latestPatch`, `latestFeature`, `latestMinor`, or `latestMajor`, the action installs the appropriate SDK version. For prerelease versions, the exact pinned version is always installed regardless of the `rollForward` setting.
 
+> **Important**: When using `rollForward` in `global.json`, the `sdk.version` field must be a fully-qualified SDK version (e.g., `8.0.100`, `10.0.100`). Wildcard versions (e.g., `10.0.*`) and runtime-style versions (e.g., `8.0.0`) are not supported. See the [.NET SDK version specification](https://learn.microsoft.com/en-us/dotnet/core/tools/global-json#version) for details.
+
 ## Caching NuGet Packages
 The action has a built-in functionality for caching and restoring dependencies. It uses [toolkit/cache](https://github.com/actions/toolkit/tree/main/packages/cache) under the hood for caching global packages data but requires less configuration settings. The `cache` input is optional, and caching is turned off by default.
 
@@ -153,8 +188,8 @@ The action searches for [NuGet Lock files](https://learn.microsoft.com/nuget/con
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.x
     cache: true
@@ -178,8 +213,8 @@ steps:
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.x
     cache: true
@@ -192,8 +227,8 @@ steps:
 env:
   NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.x
     cache: true
@@ -212,9 +247,9 @@ jobs:
         dotnet: [ '8.0.x', '9.0.x', '10.0.x' ]
     name: Dotnet ${{ matrix.dotnet }} sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: ${{ matrix.dotnet }}
       - name: Execute dotnet
@@ -232,9 +267,9 @@ jobs:
         dotnet: [ '8.0.x', '9.0.x', '10.0.x' ]
     name: Dotnet ${{ matrix.dotnet }} sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@v6
         id: stepid
         with:
           dotnet-version: ${{ matrix.dotnet }}
@@ -250,8 +285,8 @@ jobs:
 ### Github Package Registry (GPR)
 ```yml
 steps:
-- uses: actions/checkout@v6
+- uses: actions/checkout@v7
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '8.0.x'
     source-url: https://nuget.pkg.github.com/<owner>/index.json
@@ -266,7 +301,7 @@ steps:
 
 ### Azure Artifacts
 ```yml
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     source-url: https://pkgs.dev.azure.com/<your-organization>/_packaging/<your-feed-name>/nuget/v3/index.json
   env:
@@ -277,7 +312,7 @@ steps:
 
 ### nuget.org
 ```yml
-- uses: actions/setup-dotnet@v5
+- uses: actions/setup-dotnet@v6
   with:
     dotnet-version: 8.0.x
 - name: Publish the package to nuget.org
@@ -294,7 +329,7 @@ The `workloads` input allows you to install .NET workloads as part of the SDK se
 steps:
 - uses: actions/checkout@v5
 - name: Setup .NET with workloads
-  uses: actions/setup-dotnet@v5
+  uses: actions/setup-dotnet@v6
   with:
     dotnet-version: '9.0.x'
     workloads: workload1, workload2  # Specify the workloads required for the project, such as wasm-tools, maui, etc.
@@ -303,6 +338,29 @@ steps:
 
 > **Note**: Ensure workloads are compatible with your runner's OS, architecture, and .NET SDK version before enabling workload installation. Some workloads may require additional installation time due to large toolchain downloads.
 
+## Using the `check-latest` input
+
+By default (`check-latest: true`) the action resolves and installs the latest version matching the request online, which is the historical behavior. With `check-latest: false` it first looks for an SDK already installed under [`DOTNET_INSTALL_DIR`](#environment-variables) and reuses it, skipping SDK resolution and download — useful for air-gapped or preloaded runners (the `cache` and `workloads` inputs still use the network). If none matches, it installs online as usual.
+
+```yaml
+steps:
+- uses: actions/checkout@v7
+- name: Reuse a preinstalled SDK when available
+  uses: actions/setup-dotnet@v6
+  with:
+    dotnet-version: '8.0.x'
+    check-latest: false
+- run: dotnet build <my project>
+```
+
+An installed SDK is reused only when it matches the requested spec (`A.B.C`, `A.B`, `A.B.x`, `A.B.Cxx`, `A`, `A.x` or `latest`; `x`, `X` and `*` interchange except in a feature band, which is lowercase `Cxx`), satisfies `dotnet-quality`, is not older than the `sdk.version` declared in `global.json`, and sits next to a runnable `dotnet` executable. As online, `dotnet-quality` is ignored for a full `A.B.C` request, so such a request always resolves to a GA SDK. Cross-architecture requests, `latest` with an `LTS` or `STS` channel, and a bare wildcard always install online.
+
+When the request comes from `global.json`, the SDK is picked the way the .NET resolver picks one: `latestPatch`, `latestFeature`, `latestMinor` and `latestMajor` take the **highest** SDK the policy allows, while `feature`, `minor` and `major` roll forward to the **nearest** higher feature band, minor or major and then take its latest patch. `patch` — the default when `rollForward` is omitted — prefers the declared version, otherwise the latest patch in its band. `disable` and a prerelease `sdk.version` require an exact match, and `allowPrerelease` is not used: `dotnet-quality` is the only prerelease control.
+
+### Setting `check-latest` from the environment
+
+When the input is not set, the action reads the `DOTNET_CHECK_LATEST` environment variable (`true` or `false`, case-insensitive; an unsupported value warns and is ignored), which covers workflows you cannot edit. Setting it on a self-hosted runner alongside SDKs preinstalled under [`DOTNET_INSTALL_DIR`](#environment-variables) lets those workflows run without reaching `aka.ms`, `builds.dotnet.microsoft.com` or `ci.dot.net`. It applies to every job on that runner, so a dedicated runner is recommended; any workflow can still override it with an explicit `check-latest` input.
+
 # Outputs and environment variables
 
 ## Outputs
@@ -316,7 +374,7 @@ Using the **dotnet-version** output it's possible to get the installed by the ac
 In case of a single version installation, the `dotnet-version` output contains the version that is installed by the action.
 
 ```yaml
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       id: stepid
       with:
         dotnet-version: 8.0.416
@@ -328,7 +386,7 @@ In case of a single version installation, the `dotnet-version` output contains t
 In case of a multiple version installation, the `dotnet-version` output contains the latest version that is installed by the action.
 
 ```yaml
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       id: stepid
       with:
         dotnet-version: | 
@@ -341,7 +399,7 @@ In case of a multiple version installation, the `dotnet-version` output contains
 When the `dotnet-version` input is used along with the `global-json-file` input, the `dotnet-version` output contains the version resolved from the `global.json`.
 
 ```yaml
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       id: stepid
       with:
         dotnet-version: | 
@@ -361,6 +419,7 @@ Some environment variables may be necessary for your particular case or to impro
 | **Env.variable**      | **Description** | **Default value** |
 | ----------- | ----------- | ----------- |
 | DOTNET_INSTALL_DIR      |Specifies a directory where .NET SDKs should be installed by the action.|*default value for each OS* |
+| DOTNET_CHECK_LATEST |Fallback for the [`check-latest`](#setting-check-latest-from-the-environment) input, for workflows that cannot set it. Ignored when the input is set.|*true*|
 | DOTNET_NOLOGO      |Removes logo and telemetry message from first run of dotnet cli|*false*|
 | DOTNET_CLI_TELEMETRY_OPTOUT   |Opt-out of telemetry being sent to Microsoft|*false*|
 | DOTNET_MULTILEVEL_LOOKUP   |Configures whether the global install location is used as a fall-back|*true*|
@@ -381,8 +440,8 @@ build:
     DOTNET_INSTALL_DIR: "path/to/directory"
     NUGET_PACKAGES: ${{ github.workspace }}/.nuget/packages
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
-    - uses: actions/setup-dotnet@v5
+    - uses: actions/setup-dotnet@v6
       with:
         dotnet-version: '8.0.x'
         cache: true
@@ -393,7 +452,13 @@ You can also set `DOTNET_INSTALL_DIR` to a value based on runtime variables, suc
     - name: Set DOTNET_INSTALL_DIR
       run: echo "DOTNET_INSTALL_DIR=$HOME/.dotnet" >> $GITHUB_ENV
 ```
-> **Note**: On some self-hosted or large Linux runners, installing .NET under the default `/usr/share/dotnet` location may fail due to insufficient permissions. To ensure successful installation, set `DOTNET_INSTALL_DIR` to a user-writable path.
+> **Note**: On some self-hosted, larger or containerized runners the default location is not writable by the current user, and the installation fails with a permission error. The action resolves the install directory in this order:
+>
+> 1. `DOTNET_INSTALL_DIR`, when set. It is always honored and never probed.
+> 2. The default location for the runner OS, when it is writable.
+> 3. `.dotnet` in the current user's home directory, for example `/home/runner/.dotnet` or `C:\Users\runneradmin\.dotnet`.
+>
+> Runners that can write to the default location are unaffected. When the fallback is used, `DOTNET_ROOT` and `PATH` point at the home directory, so .NET preinstalled under the system location is no longer picked up. Set `DOTNET_INSTALL_DIR` explicitly to pin the location. If no writable location is found, the action warns and keeps the default, so the installation is likely to fail.
 
 ## Recommended permissions
 

__tests__/__snapshots__/authutil.test.ts.snap

@@ -1,4 +1,4 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
 
 exports[`authutil tests existing config not in repo root, sets up a partial NuGet.config user/PAT for GPR 1`] = `
 "<?xml version="1.0"?>

__tests__/authutil.test.ts

@@ -1,6 +1,10 @@
+import {afterAll, beforeEach, describe, expect, it} from '@jest/globals';
 import * as io from '@actions/io';
 import fs from 'fs';
 import path from 'path';
+import {fileURLToPath} from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
 const fakeSourcesDirForTesting = path.join(
   __dirname,
@@ -71,7 +75,7 @@ const azureartifactsnugetorgNuGetConfig = `<?xml version="1.0" encoding="utf-8"?
 const nugetConfigFile = path.join(fakeSourcesDirForTesting, '../nuget.config');
 
 process.env['GITHUB_REPOSITORY'] = 'OwnerName/repo';
-import * as auth from '../src/authutil';
+import * as auth from '../src/authutil.js';
 
 describe('authutil tests', () => {
   beforeEach(async () => {

__tests__/cache-restore.test.ts

@@ -1,16 +1,40 @@
-import {readdir} from 'node:fs/promises';
+import {
-import * as cache from '@actions/cache';
+  afterEach,
-import * as core from '@actions/core';
+  beforeAll,
-import * as glob from '@actions/glob';
+  beforeEach,
-import {restoreCache} from '../src/cache-restore';
+  describe,
-import {getNuGetFolderPath} from '../src/cache-utils';
+  expect,
-import {lockFilePatterns} from '../src/constants';
+  it,
+  jest
+} from '@jest/globals';
 
-jest.mock('node:fs/promises');
+jest.unstable_mockModule('node:fs/promises', () => ({
-jest.mock('@actions/cache');
+  readdir: jest.fn()
-jest.mock('@actions/core');
+}));
-jest.mock('@actions/glob');
+jest.unstable_mockModule('@actions/cache', () => ({
-jest.mock('../src/cache-utils');
+  restoreCache: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  saveState: jest.fn(),
+  setOutput: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn()
+}));
+jest.unstable_mockModule('@actions/glob', () => ({
+  hashFiles: jest.fn()
+}));
+jest.unstable_mockModule('../src/cache-utils', () => ({
+  getNuGetFolderPath: jest.fn()
+}));
+
+const {readdir} = await import('node:fs/promises');
+const cache = await import('@actions/cache');
+const core = await import('@actions/core');
+const glob = await import('@actions/glob');
+const {restoreCache} = await import('../src/cache-restore.js');
+const {getNuGetFolderPath} = await import('../src/cache-utils.js');
+const {lockFilePatterns} = await import('../src/constants.js');
 
 describe('cache-restore tests', () => {
   describe.each(lockFilePatterns)('restoreCache("%s")', lockFilePattern => {
@@ -32,7 +56,9 @@ describe('cache-restore tests', () => {
       jest.mocked(core.setOutput).mockClear();
       jest.mocked(cache.restoreCache).mockClear();
     });
-    afterEach(() => (process.env.GITHUB_WORKSPACE = githubWorkspace));
+    afterEach(() => {
+      process.env.GITHUB_WORKSPACE = githubWorkspace;
+    });
 
     it('throws error when lock file is not found', async () => {
       jest.mocked(glob.hashFiles).mockResolvedValue('');

__tests__/cache-save.test.ts

@@ -1,14 +1,32 @@
-import * as cache from '@actions/cache';
+import {beforeAll, beforeEach, describe, expect, it, jest} from '@jest/globals';
-import * as core from '@actions/core';
-import fs from 'node:fs';
-import {run} from '../src/cache-save';
-import {getNuGetFolderPath} from '../src/cache-utils';
-import {State} from '../src/constants';
 
-jest.mock('@actions/cache');
+jest.unstable_mockModule('@actions/cache', () => ({
-jest.mock('@actions/core');
+  saveCache: jest.fn()
-jest.mock('node:fs');
+}));
-jest.mock('../src/cache-utils');
+jest.unstable_mockModule('@actions/core', () => ({
+  setFailed: jest.fn(),
+  getState: jest.fn(),
+  setOutput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  debug: jest.fn(),
+  info: jest.fn(),
+  warning: jest.fn()
+}));
+jest.unstable_mockModule('node:fs', () => ({
+  default: {
+    existsSync: jest.fn()
+  }
+}));
+jest.unstable_mockModule('../src/cache-utils', () => ({
+  getNuGetFolderPath: jest.fn()
+}));
+
+const cache = await import('@actions/cache');
+const core = await import('@actions/core');
+const fs = (await import('node:fs')).default;
+const {run} = await import('../src/cache-save.js');
+const {getNuGetFolderPath} = await import('../src/cache-utils.js');
+const {State} = await import('../src/constants.js');
 
 describe('cache-save tests', () => {
   beforeAll(() => {

__tests__/cache-utils.test.ts

@@ -1,11 +1,29 @@
-import * as cache from '@actions/cache';
+import {
-import * as exec from '@actions/exec';
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest
+} from '@jest/globals';
 
-import {getNuGetFolderPath, isCacheFeatureAvailable} from '../src/cache-utils';
+jest.unstable_mockModule('@actions/cache', () => ({
+  isFeatureAvailable: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  warning: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn()
+}));
+jest.unstable_mockModule('@actions/exec', () => ({
+  getExecOutput: jest.fn()
+}));
 
-jest.mock('@actions/cache');
+const cache = await import('@actions/cache');
-jest.mock('@actions/core');
+const exec = await import('@actions/exec');
-jest.mock('@actions/exec');
+const {getNuGetFolderPath, isCacheFeatureAvailable} =
+  await import('../src/cache-utils.js');
 
 describe('cache-utils tests', () => {
   describe('getNuGetFolderPath()', () => {
@@ -104,9 +122,15 @@ Options:
     url => {
       // Save & Restore env
       let serverUrlEnv: string | undefined;
-      beforeAll(() => (serverUrlEnv = process.env['GITHUB_SERVER_URL']));
+      beforeAll(() => {
-      beforeEach(() => (process.env['GITHUB_SERVER_URL'] = url));
+        serverUrlEnv = process.env['GITHUB_SERVER_URL'];
-      afterEach(() => (process.env['GITHUB_SERVER_URL'] = serverUrlEnv));
+      });
+      beforeEach(() => {
+        process.env['GITHUB_SERVER_URL'] = url;
+      });
+      afterEach(() => {
+        process.env['GITHUB_SERVER_URL'] = serverUrlEnv;
+      });
 
       it('returns true when cache.isFeatureAvailable() === true', () => {
         jest.mocked(cache.isFeatureAvailable).mockReturnValue(true);

__tests__/csc.test.ts

@@ -1,4 +1,5 @@
-import cscFile from '../.github/csc.json';
+import {describe, expect, test} from '@jest/globals';
+import cscFile from '../.github/csc.json' with {type: 'json'};
 describe('csc tests', () => {
   const regexPattern = cscFile['problemMatcher'][0]['pattern'][0]['regexp'];
   const regexResultsMap = cscFile['problemMatcher'][0]['pattern'][0];
@@ -85,7 +86,7 @@ describe('csc tests', () => {
       expect(matchedResultsArray).not.toBeNull();
 
       for (const propName in results) {
-        const propertyIndex = regexResultsMap[propName];
+        const propertyIndex = (regexResultsMap as any)[propName];
         const expectedPropValue = results[propName];
         const matchedPropValue = matchedResultsArray![propertyIndex];
         expect(matchedPropValue).toEqual(expectedPropValue);

__tests__/installation-scripts.test.ts

@@ -1,7 +1,11 @@
+import {describe, expect, it} from '@jest/globals';
 import path from 'path';
 import fs from 'fs';
+import {fileURLToPath} from 'url';
 import * as hc from '@actions/http-client';
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
 const HTTP_CLIENT_OPTIONS = {allowRetries: true, maxRetries: 10} as const;
 const TEST_TIMEOUT = 30000;
 

__tests__/latest-version.test.ts

@@ -1,22 +1,31 @@
-import {DotnetVersionResolver} from '../src/installer';
+import {afterEach, beforeEach, describe, expect, it, jest} from '@jest/globals';
-import * as hc from '@actions/http-client';
-import * as core from '@actions/core';
 
-// Mock http-client
+jest.unstable_mockModule('@actions/http-client', () => ({
-jest.mock('@actions/http-client');
+  HttpClient: jest.fn()
+}));
+jest.unstable_mockModule('@actions/core', () => ({
+  warning: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn()
+}));
+
+const hc = await import('@actions/http-client');
+const core = await import('@actions/core');
+const {DotnetVersionResolver} = await import('../src/installer.js');
 
 describe('DotnetVersionResolver with latest', () => {
-  let getJsonMock: jest.Mock;
+  let getJsonMock: jest.Mock<(...args: any[]) => Promise<any>>;
-  let warningSpy: jest.SpyInstance;
+  let warningSpy: jest.Mock;
 
   beforeEach(() => {
-    getJsonMock = jest.fn();
+    getJsonMock = jest.fn<(...args: any[]) => Promise<any>>();
-    (hc.HttpClient as any).mockImplementation(() => {
+    (hc.HttpClient as jest.Mock).mockImplementation(() => {
       return {
         getJson: getJsonMock
       };
     });
-    warningSpy = jest.spyOn(core, 'warning').mockImplementation(() => {});
+    warningSpy = core.warning as jest.Mock;
+    warningSpy.mockImplementation(() => {});
   });
 
   afterEach(() => {

__tests__/setup-dotnet.test.ts

@@ -1,26 +1,72 @@
-import * as core from '@actions/core';
+import {
-import fs from 'fs';
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+  test
+} from '@jest/globals';
 import semver from 'semver';
-import * as auth from '../src/authutil';
 import os from 'os';
-import * as setup from '../src/setup-dotnet';
+
-import {DotnetCoreInstaller, DotnetInstallDir} from '../src/installer';
+jest.unstable_mockModule('@actions/core', () => ({
-import * as cacheUtils from '../src/cache-utils';
+  getInput: jest.fn(),
-import * as cacheRestore from '../src/cache-restore';
+  getMultilineInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  setFailed: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  info: jest.fn(),
+  setOutput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn()
+}));
+jest.unstable_mockModule('fs', () => {
+  const actual = jest.requireActual('fs') as typeof import('fs');
+  const existsSync = jest.fn(actual.existsSync);
+  const readFileSync = jest.fn(actual.readFileSync);
+  return {
+    ...actual,
+    existsSync,
+    readFileSync,
+    default: {...actual, existsSync, readFileSync}
+  };
+});
+jest.unstable_mockModule('../src/authutil', () => ({
+  configAuthentication: jest.fn()
+}));
+jest.unstable_mockModule('../src/cache-utils', () => ({
+  isCacheFeatureAvailable: jest.fn(),
+  getNuGetFolderPath: jest.fn()
+}));
+jest.unstable_mockModule('../src/cache-restore', () => ({
+  restoreCache: jest.fn()
+}));
+
+const core = await import('@actions/core');
+const fs = await import('fs');
+const auth = await import('../src/authutil.js');
+const cacheUtils = await import('../src/cache-utils.js');
+const cacheRestore = await import('../src/cache-restore.js');
+const setup = await import('../src/setup-dotnet.js');
+const {DotnetCoreInstaller, DotnetInstallDir} =
+  await import('../src/installer.js');
 
 describe('setup-dotnet tests', () => {
   const inputs = {} as any;
 
-  const getInputSpy = jest.spyOn(core, 'getInput');
+  const getInputSpy = core.getInput as jest.Mock;
-  const getMultilineInputSpy = jest.spyOn(core, 'getMultilineInput');
+  const getMultilineInputSpy = core.getMultilineInput as jest.Mock;
-  const getBooleanInputSpy = jest.spyOn(core, 'getBooleanInput');
+  const getBooleanInputSpy = core.getBooleanInput as jest.Mock;
-  const setFailedSpy = jest.spyOn(core, 'setFailed');
+  const setFailedSpy = core.setFailed as jest.Mock;
-  const warningSpy = jest.spyOn(core, 'warning');
+  const warningSpy = core.warning as jest.Mock;
-  const debugSpy = jest.spyOn(core, 'debug');
+  const debugSpy = core.debug as jest.Mock;
-  const infoSpy = jest.spyOn(core, 'info');
+  const infoSpy = core.info as jest.Mock;
-  const setOutputSpy = jest.spyOn(core, 'setOutput');
+  const setOutputSpy = core.setOutput as jest.Mock;
 
-  const existsSyncSpy = jest.spyOn(fs, 'existsSync');
+  const existsSyncSpy = fs.existsSync as jest.Mock;
+  const readFileSyncSpy = fs.readFileSync as jest.Mock;
 
   const maxSatisfyingSpy = jest.spyOn(semver, 'maxSatisfying');
 
@@ -29,12 +75,10 @@ describe('setup-dotnet tests', () => {
     'installDotnet'
   );
 
-  const isCacheFeatureAvailableSpy = jest.spyOn(
+  const isCacheFeatureAvailableSpy =
-    cacheUtils,
+    cacheUtils.isCacheFeatureAvailable as jest.Mock;
-    'isCacheFeatureAvailable'
+  const restoreCacheSpy = cacheRestore.restoreCache as jest.Mock;
-  );
+  const configAuthenticationSpy = auth.configAuthentication as jest.Mock;
-  const restoreCacheSpy = jest.spyOn(cacheRestore, 'restoreCache');
-  const configAuthenticationSpy = jest.spyOn(auth, 'configAuthentication');
   const addToPathOriginal = DotnetInstallDir.addToPath;
 
   describe('run() tests', () => {
@@ -42,11 +86,17 @@ describe('setup-dotnet tests', () => {
       DotnetInstallDir.addToPath = jest.fn();
       getMultilineInputSpy.mockImplementation(input => inputs[input as string]);
       getInputSpy.mockImplementation(input => inputs[input as string]);
-      getBooleanInputSpy.mockImplementation(input => inputs[input as string]);
+      getBooleanInputSpy.mockImplementation(input => {
+        const value = inputs[input as string];
+        return typeof value === 'string'
+          ? value.toLowerCase() === 'true'
+          : !!value;
+      });
     });
 
     afterEach(() => {
       DotnetInstallDir.addToPath = addToPathOriginal;
+      delete process.env['DOTNET_CHECK_LATEST'];
       jest.clearAllMocks();
       jest.resetAllMocks();
     });
@@ -246,6 +296,115 @@ describe('setup-dotnet tests', () => {
       expect(DotnetInstallDir.addToPath).toHaveBeenCalledTimes(1);
     });
 
+    it("should read the 'check-latest' input and pass it to DotnetCoreInstaller", async () => {
+      inputs['dotnet-version'] = ['10.0.101'];
+      inputs['dotnet-quality'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+
+      let capturedCheckLatest: boolean | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedCheckLatest = this.checkLatest;
+        return Promise.resolve('');
+      });
+
+      await setup.run();
+
+      expect(getBooleanInputSpy).toHaveBeenCalledWith('check-latest');
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedCheckLatest).toBe(false);
+    });
+
+    it("should read the 'skip-lts-prepass' input and pass it to DotnetCoreInstaller", async () => {
+      inputs['dotnet-version'] = ['10.0.101'];
+      inputs['dotnet-quality'] = '';
+      inputs['architecture'] = '';
+      inputs['skip-lts-prepass'] = 'true';
+
+      let capturedSkipLtsPrepass: boolean | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedSkipLtsPrepass = this.skipLtsPrepass;
+        return Promise.resolve('');
+      });
+
+      await setup.run();
+
+      expect(getBooleanInputSpy).toHaveBeenCalledWith('skip-lts-prepass');
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedSkipLtsPrepass).toBe(true);
+    });
+
+    it("should default 'skip-lts-prepass' to false when the input isn't set", async () => {
+      inputs['dotnet-version'] = ['10.0.101'];
+      inputs['dotnet-quality'] = '';
+      inputs['architecture'] = '';
+      inputs['skip-lts-prepass'] = '';
+
+      let capturedSkipLtsPrepass: boolean | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedSkipLtsPrepass = this.skipLtsPrepass;
+        return Promise.resolve('');
+      });
+
+      await setup.run();
+
+      expect(getBooleanInputSpy).toHaveBeenCalledWith('skip-lts-prepass');
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedSkipLtsPrepass).toBe(false);
+    });
+
+    describe("'check-latest' resolution", () => {
+      const captureCheckLatest = async () => {
+        inputs['dotnet-version'] = ['10.0.101'];
+        inputs['dotnet-quality'] = '';
+        inputs['architecture'] = '';
+
+        let capturedCheckLatest: boolean | undefined;
+        installDotnetSpy.mockImplementation(function (this: any) {
+          capturedCheckLatest = this.checkLatest;
+          return Promise.resolve('');
+        });
+
+        await setup.run();
+        return capturedCheckLatest;
+      };
+
+      it('defaults to true when neither the input nor the environment variable is set', async () => {
+        inputs['check-latest'] = '';
+
+        expect(await captureCheckLatest()).toBe(true);
+        expect(getBooleanInputSpy).not.toHaveBeenCalledWith('check-latest');
+      });
+
+      it.each(['false', 'FALSE', 'False'])(
+        "reads 'check-latest' from the DOTNET_CHECK_LATEST environment variable ('%s')",
+        async envValue => {
+          inputs['check-latest'] = '';
+          process.env['DOTNET_CHECK_LATEST'] = envValue;
+
+          expect(await captureCheckLatest()).toBe(false);
+        }
+      );
+
+      it('lets an explicit input win over the environment variable', async () => {
+        inputs['check-latest'] = 'true';
+        process.env['DOTNET_CHECK_LATEST'] = 'false';
+
+        expect(await captureCheckLatest()).toBe(true);
+      });
+
+      it('warns and falls back to true when the environment variable is not a boolean', async () => {
+        inputs['check-latest'] = '';
+        process.env['DOTNET_CHECK_LATEST'] = 'yes';
+
+        expect(await captureCheckLatest()).toBe(true);
+        expect(warningSpy).toHaveBeenCalledWith(
+          `Value 'yes' is not supported for the DOTNET_CHECK_LATEST environment variable. Supported values are: true, false. The 'check-latest' option falls back to 'true'.`
+        );
+        expect(setFailedSpy).not.toHaveBeenCalled();
+      });
+    });
+
     it('should fail the action if unsupported architecture is provided', async () => {
       inputs['dotnet-version'] = ['10.0.101'];
       inputs['dotnet-quality'] = '';
@@ -346,5 +505,241 @@ describe('setup-dotnet tests', () => {
         `The 'dotnet-channel' input is only supported when 'dotnet-version' is set to 'latest'.`
       );
     });
+
+    it('should pass the global.json rollForward minimum version to DotnetCoreInstaller', async () => {
+      inputs['dotnet-version'] = [];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({
+          sdk: {version: '8.0.400', rollForward: 'latestFeature'}
+        })
+      );
+
+      let capturedVersion: string | undefined;
+      let capturedMinimumVersion: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedVersion = this.version;
+        capturedMinimumVersion = this.minimumVersion;
+        return Promise.resolve('8.0.412');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(capturedVersion).toBe('8.0');
+      expect(capturedMinimumVersion).toBe('8.0.400');
+    });
+
+    it('should pass non-latest rollForward policies to DotnetCoreInstaller', async () => {
+      inputs['dotnet-version'] = [];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({sdk: {version: '8.0.100', rollForward: 'feature'}})
+      );
+
+      let capturedVersion: string | undefined;
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedVersion = this.version;
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.200');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(capturedVersion).toBe('8.0.100');
+      expect(capturedMinimumVersion).toBe('8.0.100');
+      expect(capturedRollForward).toBe('feature');
+    });
+
+    it('should default an omitted rollForward to patch', async () => {
+      inputs['dotnet-version'] = [];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({sdk: {version: '8.0.100'}})
+      );
+
+      let capturedVersion: string | undefined;
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedVersion = this.version;
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.100');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(capturedVersion).toBe('8.0.100');
+      expect(capturedMinimumVersion).toBe('8.0.100');
+      expect(capturedRollForward).toBe('patch');
+    });
+
+    it('should not default to patch for a prerelease sdk version', async () => {
+      inputs['dotnet-version'] = [];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({sdk: {version: '8.0.100-preview.1'}})
+      );
+
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.100-preview.1');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(capturedMinimumVersion).toBeUndefined();
+      expect(capturedRollForward).toBeUndefined();
+    });
+
+    it('should not default to patch for a version that is not a full SDK version', async () => {
+      inputs['dotnet-version'] = [];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({sdk: {version: '8.0.0'}})
+      );
+
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.0');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(capturedMinimumVersion).toBeUndefined();
+      expect(capturedRollForward).toBeUndefined();
+    });
+
+    it('should not roll forward a version pinned by the dotnet-version input', async () => {
+      inputs['dotnet-version'] = ['8.0.100'];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({sdk: {version: '8.0.100'}})
+      );
+
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.100');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedMinimumVersion).toBeUndefined();
+      expect(capturedRollForward).toBeUndefined();
+    });
+
+    it('should keep the global.json floor when a floating dotnet-version matches', async () => {
+      inputs['dotnet-version'] = ['8.0'];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({
+          sdk: {version: '8.0.400', rollForward: 'latestFeature'}
+        })
+      );
+
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.400');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedMinimumVersion).toBe('8.0.400');
+      expect(capturedRollForward).toBe('latestFeature');
+    });
+
+    it('should not set a rollForward policy for disable', async () => {
+      inputs['dotnet-version'] = [];
+      inputs['dotnet-quality'] = '';
+      inputs['dotnet-channel'] = '';
+      inputs['architecture'] = '';
+      inputs['check-latest'] = 'false';
+      inputs['global-json-file'] = 'global.json';
+
+      existsSyncSpy.mockReturnValue(true);
+      readFileSyncSpy.mockReturnValue(
+        JSON.stringify({sdk: {version: '8.0.100', rollForward: 'disable'}})
+      );
+
+      let capturedMinimumVersion: string | undefined;
+      let capturedRollForward: string | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedMinimumVersion = this.minimumVersion;
+        capturedRollForward = this.rollForward;
+        return Promise.resolve('8.0.100');
+      });
+
+      await setup.run();
+      inputs['global-json-file'] = '';
+
+      expect(capturedMinimumVersion).toBeUndefined();
+      expect(capturedRollForward).toBeUndefined();
+    });
   });
 });

__tests__/verify-dotnet.ps1

@@ -74,6 +74,7 @@ $targetFrameworkVersionMap = @{
   "8.0" = "net8.0";
   "9.0" = "net9.0";
   "10.0" = "net10.0";
+  "11.0" = "net11.0";
  }
 
 foreach ($version in $Versions)

action.yml

@@ -14,6 +14,10 @@ inputs:
   dotnet-channel:
     description: 'Optional channel for the installation. The possible values are: STS, LTS, A.B (e.g. 8.0), A.B.Cxx (e.g. 8.0.1xx, available since 5.0). To be used with "dotnet-version: latest".'
     required: false
+  skip-lts-prepass:
+    description: 'Optional. When true, skips the LTS runtime pre-pass and installs only the requested dotnet-version. Default: false.'
+    required: false
+    default: false
   global-json-file:
     description: 'Optional global.json location, if your global.json isn''t located in the root of the repo.'
     required: false
@@ -39,6 +43,9 @@ inputs:
   architecture:
     description: 'Optional architecture for the .NET install. Supported values: x64, x86, arm64, amd64, arm, s390x, ppc64le, riscv64. If not set, the installer auto-detects the current system architecture.'
     required: false
+  check-latest:
+    description: 'Optional, defaults to true. When false, a locally installed SDK that satisfies the requested version is reused without any network calls, otherwise the latest matching version is installed online. Cross-architecture requests always install online. Falls back to the DOTNET_CHECK_LATEST environment variable when this input is not set.'
+    required: false
 outputs:
   cache-hit:
     description: 'A boolean value to indicate if a cache was hit.'

dist/cache-save/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

dist/setup/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

eslint.config.mjs

@@ -0,0 +1,74 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+import js from '@eslint/js';
+import tsParser from '@typescript-eslint/parser';
+import tsPlugin from '@typescript-eslint/eslint-plugin';
+import jest from 'eslint-plugin-jest';
+import n from 'eslint-plugin-n';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+
+export default [
+  {
+    ignores: ['**/*', '!src/**', '!__tests__/**']
+  },
+  js.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      globals: {
+        ...globals.node,
+        ...globals.es2015
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tsPlugin,
+      n
+    },
+    rules: {
+      ...tsPlugin.configs.recommended.rules,
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-empty-function': 'off',
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        {
+          'ts-ignore': 'allow-with-description'
+        }
+      ],
+      'no-console': 'error',
+      yoda: 'error',
+      'prefer-const': [
+        'error',
+        {
+          destructuring: 'all'
+        }
+      ],
+      'no-control-regex': 'off',
+      'no-constant-condition': ['error', {checkLoops: false}],
+      'no-undef': 'off',
+      'no-useless-assignment': 'off',
+      'n/no-extraneous-import': 'error'
+    }
+  },
+  {
+    files: ['**/*{test,spec}.ts'],
+    plugins: {jest},
+    languageOptions: {
+      globals: {
+        ...globals.jest
+      }
+    },
+    rules: {
+      ...jest.configs['flat/recommended'].rules,
+      '@typescript-eslint/no-unused-vars': 'off',
+      'jest/no-standalone-expect': 'off',
+      'jest/no-conditional-expect': 'off',
+      'no-console': 'off'
+    }
+  },
+  prettier
+];

externals/install-dotnet.ps1

@@ -939,7 +939,7 @@ function Extract-Dotnet-Package-Tar([string]$TarPath, [string]$OutPath) {
 
     foreach ($dir in $versionedDirs.GetEnumerator()) {
         if ($dir.Value) {
-            # This versioned directory already exists — exclude it from extraction
+            # This versioned directory already exists - exclude it from extraction
             $pattern = $dir.Key + '*'
             $excludeArgs += '--exclude'
             $excludeArgs += $pattern
@@ -956,7 +956,7 @@ function Extract-Dotnet-Package-Tar([string]$TarPath, [string]$OutPath) {
             if ($normalizedEntry.EndsWith('/')) { continue }
             $match = [regex]::Match($normalizedEntry, $versionRegex)
             if (-not $match.Success) {
-                # Non-versioned file — exclude if it already exists locally
+                # Non-versioned file - exclude if it already exists locally
                 $localPath = Join-Path -Path $OutPath -ChildPath $normalizedEntry
                 if (Test-Path $localPath) {
                     $excludeArgs += '--exclude'
@@ -1487,8 +1487,8 @@ Say "Installation finished"
 # SIG # Begin signature block
 # MIIncQYJKoZIhvcNAQcCoIInYjCCJ14CAQExDzANBglghkgBZQMEAgEFADB5Bgor
 # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
-# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDmNI7+9b4lSWsX
+# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDbixcRHZx4cmqV
-# 2kYVvqQHpZeXB6Kt5BepNOcmIqEK1aCCDMkwggYEMIID7KADAgECAhMzAAACHPrN
+# 58QdPY+XiwQw34JjAyv8LsJIGTKYs6CCDMkwggYEMIID7KADAgECAhMzAAACHPrN
 # xZvoL37EAAAAAAIcMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNVBAYTAlVTMR4wHAYD
 # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBD
 # b2RlIFNpZ25pbmcgUENBIDIwMjQwHhcNMjYwNDE2MTg1OTQxWhcNMjcwNDE1MTg1
@@ -1561,62 +1561,62 @@ Say "Installation finished"
 # KDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMjQCEzMAAAIc
 # +s3Fm+gvfsQAAAAAAhwwDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwG
 # CisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZI
-# hvcNAQkEMSIEIB5Na9P++kVnSeIy27N4IyRD4N0sjfWHRS1ht0NHdoK/MEIGCisG
+# hvcNAQkEMSIEIPGYOwqjbYcPpGhrXbJoGwiSMzNy0DFg1wPuMKjzUFU3MEIGCisG
 # AQQBgjcCAQwxNDAyoBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3
-# Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEAx05EI+Kk4hoAKG/8oVdr
+# Lm1pY3Jvc29mdC5jb20wDQYJKoZIhvcNAQEBBQAEggEATEc7CdUQlF9ad/L6EImG
-# UIq/+sv+E0vpSyWQMTq/yrkfnPWqT2TxNVtcG3ZcQT5/36cjMe1umi1zzy178VRP
+# GP+g++vMy0R/Hg4c+MlO/1U5MYfOdh4p0OSk0R3D9KhIvGy0pmPFjbCovy8OT1o0
-# HKH2jxMOzMqtJPsAI/yAd46EOyTBwayS+27NOvz2r3v8WV0YjuplJb1teHmJtoIf
+# /SmlfLvdZi71NTu7USS9IBaGa34XbhtETx7bqyEuFVyJi3Q6kem+/FX4X9Yy1uKa
-# UVC1va6H668UMrR2Mm5l8GvtcrGmDLjq3FLTLeidco7aj7xtkwUhyXvCS/HzoF9G
+# raasZebqi0W5Bwmm/l2W2vJoRejOf73LY/JVDJDoqC6Euy0ygFMRcXKuy0JapfNW
-# yrYW3NKqIy+KbNXTD8RbwDxKvx3ED9C1SfZi3fi/t1a2wjNsxVqf4XNsO2+JvuuO
+# uzhOnMSTeEhxSnJulIJT9WJ27C0C3xCs15Zxog1pTCIyrUdZ+1wztImKRG6ckOMs
-# SGTZOoo/3jqtS22IcV5Z3In0D3+C/rigq0179KhwPtztz4+J9MU5gtGmVayF1MH1
+# stSyISi+BDDDZlEIrqW28uhS3y1NamvJ8ParfgUUMWE6IVMfXyU3UNX9CffZlZUu
-# M6GCF7AwghesBgorBgEEAYI3AwMBMYIXnDCCF5gGCSqGSIb3DQEHAqCCF4kwgheF
+# G6GCF7AwghesBgorBgEEAYI3AwMBMYIXnDCCF5gGCSqGSIb3DQEHAqCCF4kwgheF
 # AgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFaBgsqhkiG9w0BCRABBKCCAUkEggFFMIIB
-# QQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCDhOUY7jtQW2mTHjZaf
+# QQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCAKISNs7txQuaBSV3EX
-# zhylI7IWKlybklUpfwDq0GnW8AIGaeuhCndSGBMyMDI2MDUxNzAwNDk0OC4wNzFa
+# ZialoNXK4+PNZXnxI6CUNBDKJwIGajVNcfmeGBMyMDI2MDcxOTAxMTk1MS40NTVa
 # MASAAgH0oIHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
 # bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
 # aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0
-# ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjoyQTFBLTA1RTAtRDk0NzElMCMG
+# ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo0MDFBLTA1RTAtRDk0NzElMCMG
 # A1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEf4wggcoMIIFEKAD
-# AgECAhMzAAACEKvN5BYY7zmwAAEAAAIQMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNV
+# AgECAhMzAAACGV6y2FR19LGNAAEAAAIZMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNV
 # BAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4w
 # HAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29m
-# dCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgxMloXDTI2MTExMzE4
+# dCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgyNloXDTI2MTExMzE4
-# NDgxMlowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD
+# NDgyNlowgdMxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD
 # VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTAr
 # BgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEnMCUG
-# A1UECxMeblNoaWVsZCBUU1MgRVNOOjJBMUEtMDVFMC1EOTQ3MSUwIwYDVQQDExxN
+# A1UECxMeblNoaWVsZCBUU1MgRVNOOjQwMUEtMDVFMC1EOTQ3MSUwIwYDVQQDExxN
 # aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEFAAOC
-# Ag8AMIICCgKCAgEAjcc4q057ZwIgpKu4pTXWLejvYEduRf+1mIpbiJEMFWWmU2xp
+# Ag8AMIICCgKCAgEApqFIyUkzIyxpL3Q03WmLuy4G9YIUScznhKr+cHOT+/u7Parx
-# ip+zK7xFxKGB1CclUXBU0/ZQZ6LG8H0gI7yvosrsPEI1DPB/XccGCvswKbAKckng
+# I96gxxb1WrWuAxB8qjGLfsbImx8V3ouK1nUcf+R/nsnXas5/iTgV/Tl3QTRGT0De
-# OuGTEPGk7K/vEZa9h0Xt02b7m2n9MdIjkLrFl0pDriKyz0QHGpdh93X6+NApfE1T
+# uXBNbpHqc+wC1NiTyA76gLnirvSBEoBzlrpNQFEnuwdbPLCLpTS3KWSCu5J02b+R
-# L24Vo0xkeoFGpL3rX9gXhIOF59EMnTd2o45FW/oxMgY9q0y0jGO0HrCLTCZr50e7
+# FWR/kcFzVxnhoE3gIaeURtrGKGBZGKLBXvqggkDENtKkvtvRT32xLvAvL/RpReu5
-# TZRSNYAy2lyKbvKI2MKlN1wLzJvZbbc//L3s1q3J6KhS0KC2VNEImYdFgVkJej4z
+# z18ZojCs72ZSoa74Dy8YbaWsDm3OZOpJRZxZsPKCHZ6xNqgFKf0xNHj0t9v0Q3W+
-# ZqHfScTbx9hjFgFpVkJl4xH5VJ8tyJdXE9+vU0k9AaT2QP1Zm3WQmXedSoLjjI7L
+# 2z5gAVaasJJCvR52Sl0XJ2AOf3l0LSetXgUA5gD5IQ1RvEslTmNnSouTrGID3D1n
-# WznuHwnoGIXLiJMQzPqKqRIFL3wzcrDrZeWgtAdBPbipglZ5CQns6Baj5Mb6a/EZ
+# jY7mBu0puiIdPK2jK/1Weef2+YR4cQpWQkeBZmXidh9AuWdlwxKQL15LJ6K2dw8y
-# C9G3faJYK5QVHeE6eLoSEwp1dz5WurLXNPsp0VWplpl/FJb8jrRT/jOoHu85qRcd
+# /t/PBhmLyt6QAf0CepWRdgZnMytVAUuWHwlZRV9JLY7aX8D55eL9+cOLpX3bGNOm
-# YpgByU9W7IWPdrthmyfqeAw0omVWN5JxcogYbLo2pANJHlsMdWnxIpN5YwHbGEPC
+# N24UpIW8qtZaqXaesFvIOW23JNLhaaQVvObr1eu7GE/5Mn43e+/DbtdYl/bLP2IQ
-# uosBHPk2Xd9+E/pZPQUR6v+D85eEN5A/ZM/xiPpxa8dJZ87BpTvui7/2uflUMJf2
+# 1xYEJdSbcUkDFfW3KlZEh+nBKDtaRnNRkbgIgxIbKdT38OKQwZ/aA4uSsiAg6nEP
-# Yc9ZLPgEdhQQo0LwMDSTDT48y3sV7Pdo+g5q+MqnJztN/6qt1cgUTe9u+ykCAwEA
+# iWBHGuytIo5wU75M5VdjhEqqTHfXYu8BJi6GTzvWT+9ekfMXezqCkksxaG8CAwEA
-# AaOCAUkwggFFMB0GA1UdDgQWBBSe42+FrpdF2avbUhlk86BLSH5kejAfBgNVHSME
+# AaOCAUkwggFFMB0GA1UdDgQWBBSAaOo5HWatNzqZn1IF1fcD6nr3ITAfBgNVHSME
 # GDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5odHRw
 # Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUaW1l
 # LVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsG
 # AQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01p
 # Y3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMB
 # Af8EAjAAMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIHgDAN
-# BgkqhkiG9w0BAQsFAAOCAgEAvs4rO3oo8czOrxPqnnSEkUVq718QzlrIiy7/EW7J
+# BgkqhkiG9w0BAQsFAAOCAgEAXxzVZLLXBFfoCCCTiY7MHXdb7civJSTfrHYJC5Ok
-# mQXsJoFxHWUF0Ux0PDyKFDRXPJVv29F7kpJkBJJmcQg5HQV7blUXIMWQ1qX0KdtF
+# 2NN75NpzTMT9V2TcIQjfQ3AFUbh1NBAYtMUuwxC6D4ceEXG5lXAnbvkC9YjeLVDR
-# QXI/MRL77Z+pK5x1jX+tbRkA7a5Ft7vWuRoAEi02HpFH5m/Akh/dfsbx8wOpecJb
+# yImXYYmft7z+Qpl9t3C/8a0tiqnOz8Ue8/DYLtMTgvWMnsqLNjILDaImOfnHI36T
-# YvuHuy4aG0/tGzOWFCxMMNhGAIJ4qdV87JnY/uMBmiodlm+Gz357XWW5tg3HrtNZ
+# LCjGFe8RYLXGdCUdOLlfAdMGePxSTA3TAAOc+GQbmPWjrguLWbxvnl3NVjRvrBZV
-# XuQ0tWUv26ud4nGKJo/oLZHP75p4Rpt7dMdYKUF9AuVFBwxYZYpvgk12tfK+/yOw
+# kxFMoVZH0f7qGwDOShjpnv5nYnQ48ufL0uBz52RbPGdX4Fv9+UGOrBprmcHzmIut
-# q84/fjXVCdM83Qnawtbenbk/lnbc9KsZom+GnvA4itAMUpSXFWrcRkqdUQLN+JrG
+# FtJec2Y4kujNtTK2wBGgWscEOVhFiaVdje8VLJ7MVNKE5TmsuGM3jTLr1nuR5AFG
-# 6fPBoV8+D8U2Q2F4XkiCR6EU9JzYKwTuvL6t3nFuxnkLdNjbTg2/yv2j3WaDuCK5
+# s3UKkP7g3cQD4cHK7XdLiTm7e606QJ+WqeQsADYE9dvU9wIUbI9Dl4UcIErFw+FH
-# lSPgsndIiH6Bku2Ui3A0aUo6D9z9v+XEuBs9ioVJaOjf/z+Urqg7ESnxG0/T1dKc
+# aWSTrkfJ4SvLmhKnl5khhpJ1sF3z6e1BxepUliXHqzRLiHWihWIWESF8IHElF3PO
-# i7vLQ2XNgWFYO+/OlDjtGoma1ijX4m14N9qgrXTuWEGwgC7hhBgp3id/LAOf9BST
+# xbP4VJqHBiYvaXMV0SyRgwoD6zXddbUnX9WR6JL2BlqAjjHxINwelsp/VhxAWThz
-# WA5lBrilsEoexXBrOn/1wM3rjG0hIsxvF5/YOK78mVRGY6Y7zYJ+uXt4OTOFBwad
+# uMA58LxvE/VAzjfFF4Wm7a1ZALmJVw3oL/s/uxo1Op4tcT+hfZ9uN1htC1JN4DuR
-# Pv8MklreQZLPnQPtiwop4rlLUYaPCiD4YUqRNbLp8Sgyo9g0iAcZYznTuc+8Q8ZI
+# qFfLttjuoAmUQobO5zUFRzvCn8Ck/hiO+bzR15sqkjlxLMyMjpkc/ef4SUUikD46
-# rgwwggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3DQEB
+# 8vUwggdxMIIFWaADAgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3DQEB
 # CwUAMIGIMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
 # BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD
 # VQQDEylNaWNyb3NvZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAxMDAe
@@ -1659,41 +1659,41 @@ Say "Installation finished"
 # AQEwggEBoYHZpIHWMIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
 # bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
 # aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0
-# ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjoyQTFBLTA1RTAtRDk0NzElMCMG
+# ZWQxJzAlBgNVBAsTHm5TaGllbGQgVFNTIEVTTjo0MDFBLTA1RTAtRDk0NzElMCMG
 # A1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsOAwIa
-# AxUAOsyf2b6riPKnnXlIgIL2f53PUsKggYMwgYCkfjB8MQswCQYDVQQGEwJVUzET
+# AxUAMXYp/Wqqdyb0enigrLfxl0InAz6ggYMwgYCkfjB8MQswCQYDVQQGEwJVUzET
 # MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV
 # TWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1T
-# dGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIFAO2zHvgwIhgPMjAyNjA1MTYx
+# dGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQsFAAIFAO4FXKYwIhgPMjAyNjA3MTgw
-# NjUxMDRaGA8yMDI2MDUxNzE2NTEwNFowdzA9BgorBgEEAYRZCgQBMS8wLTAKAgUA
+# MjAwMDZaGA8yMDI2MDcxOTAyMDAwNlowdzA9BgorBgEEAYRZCgQBMS8wLTAKAgUA
-# 7bMe+AIBADAKAgEAAgIhcwIB/zAHAgEAAgISqjAKAgUA7bRweAIBADA2BgorBgEE
+# 7gVcpgIBADAKAgEAAgIYywIB/zAHAgEAAgITSDAKAgUA7gauJgIBADA2BgorBgEE
 # AYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYag
-# MA0GCSqGSIb3DQEBCwUAA4IBAQBjb6eELCy7c+QKNzPmI4O0riW248wi0uSI0DKx
+# MA0GCSqGSIb3DQEBCwUAA4IBAQBq2r0gOT1OxJNWazOFyx2xCpcFbnegtTJkQ4PQ
-# /ZRwZgOShcyQUcjn6Q/SGMTQ9cqeJe/IhyZbzUCTATtImhIybXreibtT2cAMO4M6
+# VcbdTaxlE7ksYBeZ0zXLWiv/fSnhonUmp9ORGV6+2phlj6xeV4AyH4dVsmyRBiLN
-# 3gGHvd96iu8Q49zOYR182At7wmlUTeMrsj51LpZkWCUy4ZSeOSri83Aong5MKGMF
+# +Fb7Q5qNxhG3ciablIePFBPSFxOxJ33x6wjJF9CLx7iuhmaykYlp5jhWQ3OQerd2
-# Kt2xnKiSYL2tXIm0zcTpX8xjXMMWFb7wa0CBnHn5ZMYJVtuntxE1B4wJyMZktBS6
+# FB5vO417JsgGhZscrvZeeamXMWU6LvuPSX02oWth8FbfnIuty1OAtQh9iQwmllq4
-# WkP9XpGCXB1X7VhYM3vvtBFq2vA5neloI7waPPPTU+0hK6IX7+c1U776yDnJW4jc
+# T+dLJJSkC9Mh0gqKo+v5EBAIQ1fS5TsvfMW73Pt3lydMrZjRhdnTsQ4nge+iE8CN
-# OUJsj8rjwrS+Gc/gPt98V3kMoGvxG0eGEzdjkmblUlhT1FwpMYIEDTCCBAkCAQEw
+# XrKtIO0esovriWQVcDVYcu9DM/2P1UovTKoZ44pcxDz1zk4VMYIEDTCCBAkCAQEw
 # gZMwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT
 # B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE
-# AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIQq83kFhjvObAA
+# AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIZXrLYVHX0sY0A
-# AQAAAhAwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0B
+# AQAAAhkwDQYJYIZIAWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0B
-# CRABBDAvBgkqhkiG9w0BCQQxIgQgn7/AUpcQFhG3OcHi0Aeq56NC1uclpcmcCkGu
+# CRABBDAvBgkqhkiG9w0BCQQxIgQg1hCY9TskS/ocjoNgKVJVguEsAjqzxBlDPM+r
-# +HK5un4wgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCDD1SHufsjzY59S1iHU
+# Bb91Lt8wgfoGCyqGSIb3DQEJEAIvMYHqMIHnMIHkMIG9BCDckX633E1y1EF32V18
-# QY9hnsKSrJPg5a9Mc4YnGmPHxjCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD
+# zQcrsgjzI9+3Le7mlvk2OebthjCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYD
 # VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
 # b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w
-# IFBDQSAyMDEwAhMzAAACEKvN5BYY7zmwAAEAAAIQMCIEIC5b102d224evVIH68x9
+# IFBDQSAyMDEwAhMzAAACGV6y2FR19LGNAAEAAAIZMCIEIDjz74g3CBfNc6GVJRjf
-# lEf8Au5vChR0bDNP4SViDwl6MA0GCSqGSIb3DQEBCwUABIICAHMgBiQOozDAIR+S
+# Y0YVIg76oCasifagFFulpBDbMA0GCSqGSIb3DQEBCwUABIICADak0YxE5whyHvYr
-# O28IjquhCukrxIucbxjLUxu4ltpxavA+cedbwkdNPAMFAYEaLHeEYutciK6N5f4R
+# Zukn9brxBTp9erdA6poINujmoiK5ZrTv6SZYaJbSI0HnDxbxp9QchY3BwpI19ix5
-# VIJX/OSx2ZL6ac/xB5A/7rdoaHV7PK+F1y807INXMA2HPnJGDVbi7HD7nJp26Fuz
+# +excveLH8i0oQWql3XyZcBDcwBi9sfFDv+yuJfd1CE27X8YxGy5OJeKCK9QoQiXs
-# P2K3aGE3kK06C2jXsjdqWsAZv32k1daX+OqFGJdOsmmua/qlF0AMWTXL7rsBStOH
+# b0MgT35WaxPxvRwcUArXf8qwkP+CO4EkL9x+ZCznyvutSebHKS5fRRPgVreJKRg2
-# 5YI/KXtAsd9vvUbqcCMGeGmnRk6V7NmsKbQIkZ3kDk6YfKoZWmSknCKHF6LzCPkI
+# vNh4J2lujjEIsOduZs8o5U7woRCBgN/v6lDl9x35WHgoHSzxSwQz7HZea/gcbXa6
-# bZSI8PNhcn19VUl9VS4WXGyWeGG5zBkOXnImAIKlaLMxR8Z9/kQVx84TrsDBl6Yh
+# GRezjA7bCzS1H99feDX3KiTi1kIxtKilQOVzOO9XqrTYoZGak7NeNW12IqbmeYHF
-# 34t6ISVDkQtre8SBG6fdjyWKmCOSntciVUlEom8ZwkadixIaf8nOoUJSYq5fl+4J
+# ZVW8XkBg5U8BdPpS/3/wD7Y8K1429YSIrJLdccR16TCwlItiqbnFrPt1+qPUH64K
-# HkcUaY79lJKL5DiENwdC4Lt6eNabRo3SPbQE7IQWbWx5h3et1QDitsZ7Gg9yAHaZ
+# okrklXX5tYZMe9cXKCC6GlP8oSw1mBf3i85h7YkQf7MgLMbhuBKPBndY7PYfeXNY
-# LS/t/SIAy+OXLXNxyttcyrbDvFI8A8tFE9P1w+3MC1n2cveqd6Wu07Z4l74Mj0LX
+# zjiH4lwKswYlJHqagmw2xYvT00Ekchjo9k6HGaUK1gzCK/ISGOiNb1pr6xf5hK6K
-# yR+0h/KjfE6SPaL+N20E4CjM0bxRKZ+CuFj/A3tykEADdzFtsEfzUzTDkD3cJpOj
+# TL9zvNOvRxOr6L/fBLjzRFCy4TiBmOAn6uq50hl/7H7hwuoxIXVHcPqZbgRfng7z
-# fojWQNX1ly8Tu3G/WdAFqzrln2y8jCbVdPIqo1ntbu+BbYom1VQqAihYQB855+pG
+# PXEyYpUtVfNMlrFfD0u6mXTp9Ez+1W0hs55SVN4CuwKAO9g1nVBc5i+7KwEpYVfU
-# D8bOWbnrvhUua7gDFFDA762iZMxD
+# kJuzixuLkM8/Hhm7X6wRAwAqpA7P
 # SIG # End signature block

jest.config.js

@@ -1,11 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: true
-}

jest.config.ts

@@ -0,0 +1,28 @@
+import type {JestConfigWithTsJest} from 'ts-jest';
+
+const jestConfig: JestConfigWithTsJest = {
+  clearMocks: true,
+  testEnvironment: 'node',
+  moduleFileExtensions: ['js', 'ts'],
+  testMatch: ['**/*.test.ts'],
+  testRunner: 'jest-circus/runner',
+  extensionsToTreatAsEsm: ['.ts'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
+  transform: {
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        useESM: true,
+        diagnostics: {
+          ignoreCodes: [151002]
+        }
+      }
+    ]
+  },
+  transformIgnorePatterns: ['node_modules/(?!(@actions)/)'],
+  verbose: true
+};
+
+export default jestConfig;

package.json

@@ -1,6 +1,7 @@
 {
   "name": "setup-dotnet",
-  "version": "5.4.0",
+  "version": "6.0.0",
+  "type": "module",
   "private": true,
   "description": "setup dotnet action",
   "main": "dist/setup/index.js",
@@ -9,12 +10,12 @@
   },
   "scripts": {
     "build": "ncc build -o dist/setup src/setup-dotnet.ts && ncc build -o dist/cache-save src/cache-save.ts",
-    "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
+    "format": "prettier --no-error-on-unmatched-pattern --write \"**/*.{ts,yml,yaml}\"",
-    "format-check": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --check \"**/*.{ts,yml,yaml}\"",
+    "format-check": "prettier --no-error-on-unmatched-pattern --check \"**/*.{ts,yml,yaml}\"",
-    "lint": "eslint --config ./.eslintrc.js \"**/*.ts\"",
+    "lint": "eslint \"**/*.ts\"",
-    "lint:fix": "eslint --config ./.eslintrc.js \"**/*.ts\" --fix",
+    "lint:fix": "eslint \"**/*.ts\" --fix",
     "prepare": "husky install",
-    "test": "jest --coverage --config ./jest.config.js",
+    "test": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --coverage",
     "update-installers": "nwget https://dot.net/v1/dotnet-install.ps1 -O externals/install-dotnet.ps1 && nwget https://dot.net/v1/dotnet-install.sh -O externals/install-dotnet.sh"
   },
   "repository": {
@@ -29,41 +30,37 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^5.1.0",
+    "@actions/cache": "^6.2.0",
-    "@actions/core": "^2.0.3",
+    "@actions/core": "^3.0.1",
-    "@actions/exec": "^2.0.0",
+    "@actions/exec": "^3.0.0",
-    "@actions/github": "^6.0.0",
+    "@actions/github": "^9.1.1",
-    "@actions/glob": "^0.5.1",
+    "@actions/glob": "^0.7.0",
-    "@actions/http-client": "^3.0.2",
+    "@actions/http-client": "^4.0.1",
-    "@actions/io": "^2.0.0",
+    "@actions/io": "^3.0.2",
-    "fast-xml-parser": "^5.9.2",
+    "fast-xml-parser": "^5.9.3",
     "json5": "^2.2.3",
-    "semver": "^7.6.0"
+    "semver": "^7.8.5"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.12",
+    "@eslint/js": "^10.0.1",
-    "@types/node": "^24.1.0",
+    "@jest/globals": "^30.4.1",
-    "@types/semver": "^7.5.8",
+    "@types/node": "^24.13.2",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
+    "@types/semver": "^7.7.0",
-    "@typescript-eslint/parser": "^8.0.0",
+    "@typescript-eslint/eslint-plugin": "^8.62.0",
-    "@vercel/ncc": "^0.38.1",
+    "@typescript-eslint/parser": "^8.62.0",
-    "eslint": "^8.57.0",
+    "@vercel/ncc": "^0.44.0",
-    "eslint-config-prettier": "^10.1.5",
+    "eslint": "^10.11.0",
-    "eslint-plugin-jest": "^29.0.1",
+    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-node": "^11.1.0",
+    "eslint-plugin-jest": "^29.16.6",
+    "eslint-plugin-n": "^18.1.0",
+    "globals": "^17.7.0",
     "husky": "^9.1.7",
-    "jest": "^29.7.0",
+    "jest": "^30.4.2",
-    "jest-circus": "^29.7.0",
+    "jest-circus": "^30.4.2",
-    "jest-each": "^29.7.0",
+    "jest-each": "^30.0.0",
-    "prettier": "^3.2.5",
+    "prettier": "^3.8.4",
-    "ts-jest": "^29.1.2",
+    "ts-jest": "^29.4.11",
-    "typescript": "^5.9.2",
+    "typescript": "^6.0.3",
     "wget-improved": "^3.2.1"
-  },
-  "overrides": {
-    "undici": "^6.24.1"
-  },
-  "jest": {
-    "testEnvironment": "node"
   }
 }

src/cache-restore.ts

@@ -4,8 +4,8 @@ import * as cache from '@actions/cache';
 import * as core from '@actions/core';
 import * as glob from '@actions/glob';
 
-import {getNuGetFolderPath} from './cache-utils';
+import {getNuGetFolderPath} from './cache-utils.js';
-import {lockFilePatterns, State, Outputs} from './constants';
+import {lockFilePatterns, State, Outputs} from './constants.js';
 
 export const restoreCache = async (cacheDependencyPath?: string) => {
   const lockFilePath = cacheDependencyPath || (await findLockFile());

src/cache-save.ts

@@ -1,8 +1,8 @@
 import * as core from '@actions/core';
 import * as cache from '@actions/cache';
 import fs from 'node:fs';
-import {getNuGetFolderPath} from './cache-utils';
+import {getNuGetFolderPath} from './cache-utils.js';
-import {State} from './constants';
+import {State} from './constants.js';
 
 // Catch and log any unhandled exceptions.  These exceptions can leak out of the uploadChunk method in
 // @actions/toolkit when a failed upload closes the file descriptor causing any in-process reads to

src/cache-utils.ts

@@ -2,7 +2,7 @@ import * as cache from '@actions/cache';
 import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 
-import {cliCommand} from './constants';
+import {cliCommand} from './constants.js';
 
 type NuGetFolderName =
   | 'http-cache'

src/installer.ts

@@ -3,12 +3,22 @@ import * as core from '@actions/core';
 import * as exec from '@actions/exec';
 import * as io from '@actions/io';
 import * as hc from '@actions/http-client';
-import {chmodSync} from 'fs';
+import {
+  accessSync,
+  chmodSync,
+  constants as fsConstants,
+  lstatSync,
+  mkdtempSync,
+  readdirSync,
+  rmSync,
+  statSync
+} from 'fs';
 import path from 'path';
+import {fileURLToPath} from 'url';
 import os from 'os';
 import semver from 'semver';
-import {IS_WINDOWS, PLATFORM} from './utils';
+import {IS_WINDOWS, PLATFORM} from './utils.js';
-import {QualityOptions} from './setup-dotnet';
+import type {QualityOptions} from './setup-dotnet.js';
 
 export interface DotnetVersion {
   type: string;
@@ -28,6 +38,22 @@ interface ReleaseIndexResponse {
 
 const QUALITY_INPUT_MINIMAL_MAJOR_TAG = 6;
 const LATEST_PATCH_SYNTAX_MINIMAL_MAJOR_TAG = 5;
+
+function channelForMajor(major: string): string {
+  // Starting with .NET 5, the minor version is always zero.
+  // Hardcode the earlier versions because they will not get new releases.
+  switch (major) {
+    case '1':
+      return '1.1';
+    case '2':
+      return '2.2';
+    case '3':
+      return '3.1';
+    default:
+      return `${major}.0`;
+  }
+}
+
 export class DotnetVersionResolver {
   private inputVersion: string;
   private resolvedArgument: DotnetVersion;
@@ -125,22 +151,7 @@ export class DotnetVersionResolver {
     } else if (this.isNumericTag(major) && this.isNumericTag(minor)) {
       this.resolvedArgument.value = `${major}.${minor}`;
     } else if (this.isNumericTag(major)) {
-      // Starting with .NET 5, the minor version is always zero.
+      this.resolvedArgument.value = channelForMajor(major);
-      // Hardcode the earlier versions because they will not get new releases.
-      switch (major) {
-        case '1':
-          this.resolvedArgument.value = '1.1';
-          break;
-        case '2':
-          this.resolvedArgument.value = '2.2';
-          break;
-        case '3':
-          this.resolvedArgument.value = '3.1';
-          break;
-        default:
-          this.resolvedArgument.value = `${major}.0`;
-          break;
-      }
     } else {
       // If "dotnet-version" is specified as *, x or X resolve latest version of .NET explicitly from LTS channel. The version argument will default to "latest" by install-dotnet script.
       this.resolvedArgument.value = 'LTS';
@@ -233,7 +244,13 @@ export class DotnetInstallScript {
 
   constructor() {
     this.escapedScript = path
-      .join(__dirname, '..', '..', 'externals', this.scriptName)
+      .join(
+        path.dirname(fileURLToPath(import.meta.url)),
+        '..',
+        '..',
+        'externals',
+        this.scriptName
+      )
       .replace(/'/g, "''");
 
     if (IS_WINDOWS) {
@@ -333,11 +350,97 @@ export abstract class DotnetInstallDir {
     windows: path.join(process.env['PROGRAMFILES'] + '', 'dotnet')
   };
 
-  public static readonly dirPath = process.env['DOTNET_INSTALL_DIR']
+  private static resolvedDirPath: string | undefined;
-    ? DotnetInstallDir.convertInstallPathToAbsolute(
+
+  // Resolved on first use so a job that installs nothing never touches the disk.
+  public static get dirPath(): string {
+    DotnetInstallDir.resolvedDirPath ??= DotnetInstallDir.resolveDirPath();
+    return DotnetInstallDir.resolvedDirPath;
+  }
+
+  private static resolveDirPath(): string {
+    if (process.env['DOTNET_INSTALL_DIR']) {
+      return DotnetInstallDir.convertInstallPathToAbsolute(
         process.env['DOTNET_INSTALL_DIR']
-      )
+      );
-    : DotnetInstallDir.default[PLATFORM];
+    }
+
+    const systemPath = DotnetInstallDir.default[PLATFORM];
+    const homePath = DotnetInstallDir.homeInstallPath();
+
+    // A relative default (unset HOME/PROGRAMFILES) would probe the cwd.
+    if (
+      path.isAbsolute(systemPath) &&
+      DotnetInstallDir.isWritableLocation(systemPath)
+    ) {
+      return systemPath;
+    }
+
+    // On macOS both candidates are the same path, already probed above.
+    const hasFallback = !!homePath && homePath !== systemPath;
+
+    if (hasFallback && DotnetInstallDir.isWritableLocation(homePath!)) {
+      core.warning(
+        `The default .NET install directory '${systemPath}' is not writable by the current user. Falling back to '${homePath}'; .NET preinstalled in the default location will no longer be used. Set the DOTNET_INSTALL_DIR environment variable to override this location.`
+      );
+      return homePath!;
+    }
+
+    // Not setFailed: the install may still succeed, so let it report the error.
+    core.warning(
+      hasFallback
+        ? `Neither the default .NET install directory '${systemPath}' nor '${homePath}' is writable by the current user. Keeping '${systemPath}', but the installation is likely to fail. Set the DOTNET_INSTALL_DIR environment variable to a writable location.`
+        : `The default .NET install directory '${systemPath}' is not writable by the current user. Keeping it, but the installation is likely to fail. Set the DOTNET_INSTALL_DIR environment variable to a writable location.`
+    );
+    return systemPath;
+  }
+
+  private static homeInstallPath(): string | undefined {
+    try {
+      const home = os.homedir();
+      // An empty HOME resolves against the cwd; a root HOME gives '/.dotnet'.
+      if (!path.isAbsolute(home) || home === path.parse(home).root) {
+        return undefined;
+      }
+      return path.join(home, '.dotnet');
+    } catch {
+      return undefined;
+    }
+  }
+
+  // Writability is tested by creating a directory. accessSync is not enough: it
+  // ignores Windows ACLs, so it reports success where the install would fail.
+  private static isWritableLocation(installDir: string): boolean {
+    let existingPath = path.resolve(installDir);
+
+    try {
+      // lstat also matches a broken symlink. existsSync does not, and the walk
+      // would skip past it to a writable parent and wrongly report success.
+      while (!lstatSync(existingPath, {throwIfNoEntry: false})) {
+        const parentPath = path.dirname(existingPath);
+        if (parentPath === existingPath) return false;
+        existingPath = parentPath;
+      }
+    } catch {
+      return false;
+    }
+
+    let probeDir: string | undefined;
+    try {
+      probeDir = mkdtempSync(path.join(existingPath, '.setup-dotnet-probe-'));
+      return true;
+    } catch {
+      return false;
+    } finally {
+      if (probeDir) {
+        try {
+          rmSync(probeDir, {recursive: true, force: true});
+        } catch {
+          // Throwing here would discard the result already returned above.
+        }
+      }
+    }
+  }
 
   private static convertInstallPathToAbsolute(installDir: string): string {
     if (path.isAbsolute(installDir)) return path.normalize(installDir);
@@ -370,19 +473,325 @@ export function normalizeArch(arch: string): string {
   }
 }
 
-export class DotnetCoreInstaller {
+function isFile(filePath: string): boolean {
-  static {
+  try {
-    DotnetInstallDir.setEnvironmentVariable();
+    return statSync(filePath).isFile();
+  } catch {
+    return false;
   }
+}
+
+function isExecutableFile(filePath: string): boolean {
+  if (!isFile(filePath)) {
+    return false;
+  }
+  if (IS_WINDOWS) {
+    return true;
+  }
+  try {
+    accessSync(filePath, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export class DotnetCoreInstaller {
+  private static readonly FeatureBandSyntax = /^(\d+)\.(\d+)\.(\d)xx$/;
 
   constructor(
     private version: string,
     private quality: QualityOptions,
     private architecture?: string,
-    private dotnetChannel?: string
+    private dotnetChannel?: string,
-  ) {}
+    private checkLatest: boolean = true,
+    private minimumVersion?: string,
+    private rollForward?: string,
+    private skipLtsPrepass: boolean = false
+  ) {
+    this.version = version.trim();
+  }
+
+  private getInstalledSdkVersions(): string[] {
+    const sdkDir = path.join(DotnetInstallDir.dirPath, 'sdk');
+    try {
+      const versions = readdirSync(sdkDir, {withFileTypes: true})
+        .filter(entry => entry.isDirectory() || entry.isSymbolicLink())
+        .map(entry => entry.name)
+        .filter(name => semver.valid(name) !== null)
+        .filter(name => isFile(path.join(sdkDir, name, 'dotnet.dll')));
+      core.debug(
+        `Locally installed .NET SDKs in '${sdkDir}': ${
+          versions.join(', ') || '<none>'
+        }`
+      );
+      return versions;
+    } catch {
+      core.debug(`Unable to read the SDK directory '${sdkDir}'.`);
+      return [];
+    }
+  }
+
+  private hasDotnetMuxer(): boolean {
+    return isExecutableFile(
+      path.join(DotnetInstallDir.dirPath, IS_WINDOWS ? 'dotnet.exe' : 'dotnet')
+    );
+  }
+
+  private qualityApplies(): boolean {
+    if (this.version.toLowerCase() === 'latest') {
+      const major = (this.dotnetChannel || '').trim().match(/^(\d+)/)?.[1];
+      return major ? Number(major) >= QUALITY_INPUT_MINIMAL_MAJOR_TAG : true;
+    }
+    if (semver.valid(this.version)) {
+      return false;
+    }
+    const major = this.version.match(/^(\d+)/)?.[1];
+    return major ? Number(major) >= QUALITY_INPUT_MINIMAL_MAJOR_TAG : false;
+  }
+
+  private findByScope(
+    candidates: string[],
+    major: string,
+    minor: string,
+    band?: string
+  ): string | null {
+    return (
+      candidates.find(version => {
+        const parsed = semver.parse(version);
+        return (
+          parsed &&
+          parsed.major === Number(major) &&
+          parsed.minor === Number(minor) &&
+          (band === undefined ||
+            Math.floor(parsed.patch / 100) === Number(band))
+        );
+      }) ?? null
+    );
+  }
+
+  private static isInRollForwardScope(
+    version: string,
+    policy: string,
+    declared: semver.SemVer
+  ): boolean {
+    const parsed = semver.parse(version);
+    if (!parsed) {
+      return false;
+    }
+    switch (policy) {
+      case 'patch':
+      case 'latestPatch':
+        return (
+          parsed.major === declared.major &&
+          parsed.minor === declared.minor &&
+          Math.floor(parsed.patch / 100) === Math.floor(declared.patch / 100)
+        );
+      case 'feature':
+      case 'latestFeature':
+        return (
+          parsed.major === declared.major && parsed.minor === declared.minor
+        );
+      case 'minor':
+      case 'latestMinor':
+        return parsed.major === declared.major;
+      case 'major':
+      case 'latestMajor':
+        return true;
+      default:
+        return false;
+    }
+  }
+
+  private static highestVersion(versions: string[]): string {
+    return versions.reduce((best, version) =>
+      semver.gt(version, best) ? version : best
+    );
+  }
+
+  private static nearestBandVersion(versions: string[]): string {
+    return versions.reduce((best, version) => {
+      const delta =
+        semver.major(version) - semver.major(best) ||
+        semver.minor(version) - semver.minor(best) ||
+        Math.floor(semver.patch(version) / 100) -
+          Math.floor(semver.patch(best) / 100);
+      return delta < 0 || (delta === 0 && semver.gt(version, best))
+        ? version
+        : best;
+    });
+  }
+
+  private findByRollForward(
+    candidates: string[],
+    policy: string,
+    declaredVersion: string
+  ): string | null {
+    const declared = semver.parse(declaredVersion);
+    if (!declared) {
+      return null;
+    }
+
+    const scoped = candidates.filter(version =>
+      DotnetCoreInstaller.isInRollForwardScope(version, policy, declared)
+    );
+    if (!scoped.length) {
+      return null;
+    }
+
+    switch (policy) {
+      case 'patch':
+        return (
+          scoped.find(version => semver.eq(version, declared)) ??
+          DotnetCoreInstaller.highestVersion(scoped)
+        );
+      case 'feature':
+      case 'minor':
+      case 'major':
+        return DotnetCoreInstaller.nearestBandVersion(scoped);
+      default:
+        return DotnetCoreInstaller.highestVersion(scoped);
+    }
+  }
+
+  private filterByQuality(allowed: string[]): string[] {
+    const wantsPrerelease =
+      ['preview', 'daily'].includes((this.quality || '').toLowerCase()) &&
+      this.qualityApplies();
+    return allowed
+      .filter(version =>
+        wantsPrerelease
+          ? semver.prerelease(version) !== null
+          : semver.prerelease(version) === null
+      )
+      .sort(semver.rcompare);
+  }
+
+  private findLocalSdkVersion(): string | null {
+    const installed = this.getInstalledSdkVersions();
+    if (!installed.length) {
+      return null;
+    }
+
+    if (!this.hasDotnetMuxer()) {
+      core.debug(
+        `The 'dotnet' executable was not found in '${DotnetInstallDir.dirPath}'. Locally installed SDKs are ignored.`
+      );
+      return null;
+    }
+
+    const minimumVersion = this.minimumVersion;
+    const allowed = minimumVersion
+      ? installed.filter(version => semver.gte(version, minimumVersion))
+      : installed;
+
+    if (!allowed.length) {
+      core.debug(
+        `No locally installed .NET SDK satisfies the global.json minimum version '${minimumVersion}'.`
+      );
+      return null;
+    }
+
+    if (this.rollForward && minimumVersion) {
+      return this.findByRollForward(
+        this.filterByQuality(allowed),
+        this.rollForward,
+        minimumVersion
+      );
+    }
+
+    if (semver.valid(this.version)) {
+      return allowed.find(version => version === this.version) ?? null;
+    }
+
+    if (
+      this.version.toLowerCase() !== 'latest' &&
+      !DotnetCoreInstaller.FeatureBandSyntax.test(this.version) &&
+      !semver.validRange(this.version)
+    ) {
+      core.debug(
+        `The requested version '${this.version}' is not a valid version spec. Locally installed SDKs are ignored.`
+      );
+      return null;
+    }
+
+    const candidates = this.filterByQuality(allowed);
+
+    if (!candidates.length) {
+      return null;
+    }
+
+    const input = this.version.toLowerCase();
+
+    if (input === 'latest') {
+      const channel = (this.dotnetChannel || '').trim();
+      if (!channel) {
+        return candidates[0];
+      }
+      const channelMinor = channel.match(/^(\d+)\.(\d+)$/);
+      if (channelMinor) {
+        return this.findByScope(candidates, channelMinor[1], channelMinor[2]);
+      }
+      const channelBand = channel.match(/^(\d+)\.(\d+)\.(\d)xx$/);
+      if (channelBand) {
+        return this.findByScope(
+          candidates,
+          channelBand[1],
+          channelBand[2],
+          channelBand[3]
+        );
+      }
+      return null;
+    }
+
+    const bandMatch = this.version.match(DotnetCoreInstaller.FeatureBandSyntax);
+    if (bandMatch) {
+      if (Number(bandMatch[1]) < LATEST_PATCH_SYNTAX_MINIMAL_MAJOR_TAG) {
+        return null;
+      }
+      return this.findByScope(
+        candidates,
+        bandMatch[1],
+        bandMatch[2],
+        bandMatch[3]
+      );
+    }
+
+    const minorMatch = this.version.match(/^(\d+)\.(\d+)(?:\.[xX*])?$/);
+    if (minorMatch) {
+      return this.findByScope(candidates, minorMatch[1], minorMatch[2]);
+    }
+
+    const majorMatch = this.version.match(/^(\d+)(?:\.[xX*])?$/);
+    if (majorMatch) {
+      const [major, minor] = channelForMajor(majorMatch[1]).split('.');
+      return this.findByScope(candidates, major, minor);
+    }
+
+    return null;
+  }
 
   public async installDotnet(): Promise<string | null> {
+    // Before findLocalSdkVersion(), which looks under the resolved directory.
+    DotnetInstallDir.setEnvironmentVariable();
+
+    const isCrossArch =
+      !!this.architecture &&
+      normalizeArch(this.architecture) !== normalizeArch(os.arch());
+
+    if (!this.checkLatest && !isCrossArch) {
+      const localVersion = this.findLocalSdkVersion();
+      if (localVersion) {
+        core.info(
+          `'check-latest' is false and a locally installed .NET SDK (${localVersion}) satisfies the '${this.version}' request. Skipping download.`
+        );
+        return localVersion;
+      }
+      core.info(
+        `'check-latest' is false but no locally installed .NET SDK satisfies the '${this.version}' request. Falling back to online installation.`
+      );
+    }
+
     const versionResolver = new DotnetVersionResolver(
       this.version,
       this.quality,
@@ -390,41 +799,44 @@ export class DotnetCoreInstaller {
     );
     const dotnetVersion = await versionResolver.createDotnetVersion();
 
-    const architectureArguments =
+    const architectureArguments = isCrossArch
-      this.architecture &&
+      ? [
-      normalizeArch(this.architecture) !== normalizeArch(os.arch())
+          IS_WINDOWS ? '-InstallDir' : '--install-dir',
-        ? [
+          IS_WINDOWS
-            IS_WINDOWS ? '-InstallDir' : '--install-dir',
+            ? `"${path.join(DotnetInstallDir.dirPath, this.architecture!)}"`
-            IS_WINDOWS
+            : path.join(DotnetInstallDir.dirPath, this.architecture!)
-              ? `"${path.join(DotnetInstallDir.dirPath, this.architecture)}"`
+        ]
-              : path.join(DotnetInstallDir.dirPath, this.architecture)
+      : [];
-          ]
-        : [];
     /**
      * Install dotnet runtime first in order to get
-     * the latest stable version of dotnet CLI
+     * the latest stable version of dotnet CLI.
+     * Opt-out via skip-lts-prepass when this safeguard isn't needed.
      */
-    const runtimeInstallOutput = await new DotnetInstallScript()
+    if (!this.skipLtsPrepass) {
-      .useArchitecture(this.architecture)
+      const runtimeInstallOutput = await new DotnetInstallScript()
-      // If dotnet CLI is already installed - avoid overwriting it
+        .useArchitecture(this.architecture)
-      .useArguments(
+        // If dotnet CLI is already installed - avoid overwriting it
-        IS_WINDOWS ? '-SkipNonVersionedFiles' : '--skip-non-versioned-files'
+        .useArguments(
-      )
+          IS_WINDOWS ? '-SkipNonVersionedFiles' : '--skip-non-versioned-files'
-      // Install only runtime + CLI
+        )
-      .useArguments(IS_WINDOWS ? '-Runtime' : '--runtime', 'dotnet')
+        // Install only runtime + CLI
-      // Use latest stable version
+        .useArguments(IS_WINDOWS ? '-Runtime' : '--runtime', 'dotnet')
-      .useArguments(IS_WINDOWS ? '-Channel' : '--channel', 'LTS')
+        // Use latest stable version
-      .useArguments(...architectureArguments)
+        .useArguments(IS_WINDOWS ? '-Channel' : '--channel', 'LTS')
-      .execute();
+        .useArguments(...architectureArguments)
+        .execute();
 
-    if (runtimeInstallOutput.exitCode) {
+      if (runtimeInstallOutput.exitCode) {
-      /**
+        /**
-       * dotnetInstallScript will install CLI and runtime even if previous script haven't succeded,
+         * dotnetInstallScript will install CLI and runtime even if previous script haven't succeded,
-       * so at this point it's too early to throw an error
+         * so at this point it's too early to throw an error
-       */
+         */
-      core.warning(
+        core.warning(
-        `Failed to install dotnet runtime + cli, exit code: ${runtimeInstallOutput.exitCode}. ${runtimeInstallOutput.stderr}`
+          `Failed to install dotnet runtime + cli, exit code: ${runtimeInstallOutput.exitCode}. ${runtimeInstallOutput.stderr}`
-      );
+        );
+      }
+    } else {
+      core.info('Skipping LTS runtime pre-pass (skip-lts-prepass: true).');
     }
 
     /**

src/setup-dotnet.ts

@@ -4,15 +4,16 @@ import {
   DotnetCoreInstaller,
   DotnetInstallDir,
   normalizeArch
-} from './installer';
+} from './installer.js';
 import * as fs from 'fs';
 import path from 'path';
+import {fileURLToPath} from 'url';
 import semver from 'semver';
 import os from 'os';
-import * as auth from './authutil';
+import * as auth from './authutil.js';
-import {isCacheFeatureAvailable} from './cache-utils';
+import {isCacheFeatureAvailable} from './cache-utils.js';
-import {restoreCache} from './cache-restore';
+import {restoreCache} from './cache-restore.js';
-import {Outputs} from './constants';
+import {Outputs} from './constants.js';
 import JSON5 from 'json5';
 
 const qualityOptions = ['daily', 'preview', 'ga'] as const;
@@ -30,6 +31,8 @@ type SupportedArchitecture = (typeof supportedArchitectures)[number];
 
 export type QualityOptions = (typeof qualityOptions)[number] | '';
 
+const CHECK_LATEST_ENV_VAR = 'DOTNET_CHECK_LATEST';
+
 function isValidChannel(channel: string): boolean {
   const upper = channel.toUpperCase();
   if (upper === 'LTS' || upper === 'STS') return true;
@@ -53,8 +56,24 @@ export async function run() {
     // Proxy, auth, (etc) are still set up, even if no version is identified
     //
     const versions = core.getMultilineInput('dotnet-version');
+    const explicitVersions = new Set(versions);
+    const globalJsonConstraints = new Map<
+      string,
+      {minimumVersion: string; rollForward?: string}
+    >();
+    const addVersionFromGlobalJson = (globalJsonPath: string) => {
+      const {version, minimumVersion, rollForward} =
+        getVersionFromGlobalJson(globalJsonPath);
+      versions.push(version);
+      const isRedundantExplicitPin =
+        explicitVersions.has(version) && version === minimumVersion;
+      if (minimumVersion && !isRedundantExplicitPin) {
+        globalJsonConstraints.set(version, {minimumVersion, rollForward});
+      }
+    };
     const installedDotnetVersions: (string | null)[] = [];
     const architecture = getArchitectureInput();
+    const checkLatest = getCheckLatestInput();
     let dotnetChannel = core.getInput('dotnet-channel');
 
     const isLatestRequested = versions.some(
@@ -86,7 +105,7 @@ export async function run() {
           `The specified global.json file '${globalJsonFileInput}' does not exist`
         );
       }
-      versions.push(getVersionFromGlobalJson(globalJsonPath));
+      addVersionFromGlobalJson(globalJsonPath);
     }
 
     if (!versions.length) {
@@ -94,7 +113,7 @@ export async function run() {
       core.debug('No version found, trying to find version from global.json');
       const globalJsonPath = path.join(process.cwd(), 'global.json');
       if (fs.existsSync(globalJsonPath)) {
-        versions.push(getVersionFromGlobalJson(globalJsonPath));
+        addVersionFromGlobalJson(globalJsonPath);
       } else {
         core.info(
           `The global.json wasn't found in the root directory. No .NET version will be installed.`
@@ -111,16 +130,23 @@ export async function run() {
         );
       }
 
+      const skipLtsPrepass = core.getBooleanInput('skip-lts-prepass');
+
       let dotnetInstaller: DotnetCoreInstaller;
       const uniqueVersions = new Set<string>(
         versions.map(v => (v.toLowerCase() === 'latest' ? 'latest' : v))
       );
       for (const version of uniqueVersions) {
+        const constraint = globalJsonConstraints.get(version);
         dotnetInstaller = new DotnetCoreInstaller(
           version,
           quality,
           architecture,
-          version.toLowerCase() === 'latest' ? dotnetChannel : undefined
+          version.toLowerCase() === 'latest' ? dotnetChannel : undefined,
+          checkLatest,
+          constraint?.minimumVersion,
+          constraint?.rollForward,
+          skipLtsPrepass
         );
         const installedVersion = await dotnetInstaller.installDotnet();
         installedDotnetVersions.push(installedVersion);
@@ -152,7 +178,8 @@ export async function run() {
             await exec.exec('dotnet', ['workload', 'install', ...workloads]);
           } catch (err) {
             throw new Error(
-              `Failed to install workloads [${workloads.join(', ')}]: ${err}`
+              `Failed to install workloads [${workloads.join(', ')}]: ${err}`,
+              {cause: err}
             );
           }
         }
@@ -172,7 +199,12 @@ export async function run() {
       await restoreCache(cacheDependencyPath);
     }
 
-    const matchersPath = path.join(__dirname, '..', '..', '.github');
+    const matchersPath = path.join(
+      path.dirname(fileURLToPath(import.meta.url)),
+      '..',
+      '..',
+      '.github'
+    );
     core.info(`##[add-matcher]${path.join(matchersPath, 'csc.json')}`);
   } catch (error) {
     core.setFailed(error.message);
@@ -193,8 +225,51 @@ function getArchitectureInput(): SupportedArchitecture | '' {
   );
 }
 
-function getVersionFromGlobalJson(globalJsonPath: string): string {
+function getCheckLatestInput(): boolean {
+  if ((core.getInput('check-latest') || '').trim()) {
+    return core.getBooleanInput('check-latest');
+  }
+
+  const rawEnvValue = (process.env[CHECK_LATEST_ENV_VAR] || '').trim();
+  if (rawEnvValue) {
+    const envValue = rawEnvValue.toLowerCase();
+    if (envValue === 'true' || envValue === 'false') {
+      core.debug(
+        `The 'check-latest' option is set to '${envValue}' by the ${CHECK_LATEST_ENV_VAR} environment variable.`
+      );
+      return envValue === 'true';
+    }
+    core.warning(
+      `Value '${rawEnvValue}' is not supported for the ${CHECK_LATEST_ENV_VAR} environment variable. Supported values are: true, false. The 'check-latest' option falls back to 'true'.`
+    );
+  }
+
+  return true;
+}
+
+interface GlobalJsonVersion {
+  version: string;
+  minimumVersion?: string;
+  rollForward?: string;
+}
+
+const ROLL_FORWARD_POLICIES = [
+  'patch',
+  'feature',
+  'minor',
+  'major',
+  'latestPatch',
+  'latestFeature',
+  'latestMinor',
+  'latestMajor'
+];
+
+const versionPattern = /^\d+\.\d+\.[1-9]\d{2,}$/;
+
+function getVersionFromGlobalJson(globalJsonPath: string): GlobalJsonVersion {
   let version = '';
+  let minimumVersion: string | undefined;
+  let rollForwardPolicy: string | undefined;
   const globalJson = JSON5.parse(
     // .trim() is necessary to strip BOM https://github.com/nodejs/node/issues/20649
     fs.readFileSync(globalJsonPath, {encoding: 'utf8'}).trim(),
@@ -208,7 +283,6 @@ function getVersionFromGlobalJson(globalJsonPath: string): string {
     version = globalJson.sdk.version;
     const rollForward = globalJson.sdk.rollForward;
     if (rollForward && !semver.prerelease(version)) {
-      const versionPattern = /^\d+\.\d+\.[1-9]\d{2,}$/;
       if (!versionPattern.test(version)) {
         throw new Error(
           `Version '${version}' is not valid for the 'sdk.version' value in global.json. ` +
@@ -237,9 +311,21 @@ function getVersionFromGlobalJson(globalJsonPath: string): string {
           version = `${major}.${minor}.${feature}xx`;
           break;
       }
+
+      if (ROLL_FORWARD_POLICIES.includes(rollForward)) {
+        minimumVersion = globalJson.sdk.version;
+        rollForwardPolicy = rollForward;
+      }
+    } else if (
+      !rollForward &&
+      !semver.prerelease(version) &&
+      versionPattern.test(version)
+    ) {
+      minimumVersion = version;
+      rollForwardPolicy = 'patch';
     }
   }
-  return version;
+  return {version, minimumVersion, rollForward: rollForwardPolicy};
 }
 
 function outputInstalledVersion(

tsconfig.json

@@ -3,7 +3,7 @@
     /* Basic Options */
     // "incremental": true,                   /* Enable incremental compilation */
     "target": "ES2022",                          /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs",                     /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
+    "module": "NodeNext",                     /* Specify module code generation. */
     "lib": [
       "ES2022"
     ],
@@ -64,5 +64,5 @@
     // "experimentalDecorators": true,        /* Enables experimental support for ES7 decorators. */
     // "emitDecoratorMetadata": true,         /* Enables experimental support for emitting type metadata for decorators. */
   },
-  "exclude": ["node_modules", "**/*.test.ts"]
+  "exclude": ["node_modules", "**/*.test.ts", "jest.config.ts"]
 }