feat: update actions/github-script to v9.0.0 with builtin getOctokit#25553
feat: update actions/github-script to v9.0.0 with builtin getOctokit#25553
Conversation
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/84e9557d-f909-4012-a12e-9dc2d949603f Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
🥳 |
There was a problem hiding this comment.
Pull request overview
This PR upgrades actions/github-script usage from v8 to v9 across the project and updates the generated GitHub Actions scripts to use the new built-in getOctokit injection (removing the prior runtime dependency on dynamically importing/installing @actions/github).
Changes:
- Bump the default github-script major version to v9 and update action pin/lock data accordingly.
- Extend
setupGlobals(...)to acceptgetOctokitand update generated JS snippets / golden workflow outputs to pass it. - Remove “custom tokens” runtime-install path for
@actions/githuband adjust compilation logic and tests accordingly.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/threat_detection.go | Updates generated require snippets to pass getOctokit; adjusts setup step signature usage. |
| pkg/workflow/threat_detection_test.go | Updates assertions for the new setupGlobals(..., getOctokit) call. |
| pkg/workflow/testdata/wasm_golden/WasmBinary/with-imports.golden | Updates pinned github-script SHA to v9 and updates setupGlobals call signature in golden output. |
| pkg/workflow/testdata/wasm_golden/WasmBinary/basic-copilot.golden | Same: v9 pin + getOctokit argument in golden output. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden | Same: v9 pin + getOctokit argument in golden output. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-test-tools.golden | Same: v9 pin + getOctokit argument in golden output. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden | Same: v9 pin + getOctokit argument in golden output. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/claude-with-network.golden | Same: v9 pin + getOctokit argument in golden output. |
| pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden | Same: v9 pin + getOctokit argument in golden output. |
| pkg/workflow/template.go | Updates template rendering step to call setupGlobals(..., getOctokit). |
| pkg/workflow/template_rendering_test.go | Updates test expectations for setupGlobals(..., getOctokit). |
| pkg/workflow/safe_outputs_steps.go | Updates generated safe-output github-script steps to pass getOctokit. |
| pkg/workflow/safe_outputs_runs_on_test.go | Removes test tied to custom-token Node.js setup logic (now removed). |
| pkg/workflow/safe_output_helpers_test.go | Updates tests to expect the v9 pinned SHA. |
| pkg/workflow/repo_memory.go | Updates setup step signature usage and setupGlobals(..., getOctokit) in generated JS. |
| pkg/workflow/redact_secrets.go | Updates redact-secrets step to pass getOctokit. |
| pkg/workflow/redact_secrets_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/publish_assets.go | Updates setup step signature usage (custom-tokens parameter removed). |
| pkg/workflow/pr.go | Updates PR checkout script snippets to pass getOctokit. |
| pkg/workflow/pr_ready_for_review_checkout_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/pr_checkout_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/notify_comment.go | Updates setup step signature usage (custom-tokens parameter removed). |
| pkg/workflow/maintenance_workflow.go | Updates maintenance workflow script snippets to pass getOctokit. |
| pkg/workflow/detection_success_test.go | Updates assertion for setupGlobals(..., getOctokit). |
| pkg/workflow/data/action_pins.json | Adds v9 pin entry for actions/github-script@v9. |
| pkg/workflow/compute_text_lazy_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/compiler_yaml.go | Updates various generated YAML steps to pass getOctokit. |
| pkg/workflow/compiler_yaml_step_generation.go | Removes custom-token support from generateSetupStep signature and YAML emission. |
| pkg/workflow/compiler_yaml_main_job.go | Updates generated step to pass getOctokit. |
| pkg/workflow/compiler_yaml_ai_execution.go | Updates log parsing / summaries steps to pass getOctokit. |
| pkg/workflow/compiler_unlock_job.go | Updates setup step signature usage. |
| pkg/workflow/compiler_safe_outputs_steps.go | Updates safe-output step generation to pass getOctokit. |
| pkg/workflow/compiler_safe_outputs_job.go | Removes custom-token path + Node.js setup logic; updates setup step signature usage. |
| pkg/workflow/compiler_safe_outputs_core.go | Removes helper functions used only for custom-token detection logic. |
| pkg/workflow/compiler_pre_activation_job.go | Updates setup step signature usage. |
| pkg/workflow/compiler_main_job.go | Updates setup step signature usage. |
| pkg/workflow/compiler_github_actions_steps.go | Updates shared helper-generated scripts to pass getOctokit. |
| pkg/workflow/compiler_activation_job.go | Updates setup step signature usage. |
| pkg/workflow/compile_outputs_pr_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/compile_outputs_label_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/compile_outputs_issue_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/compile_outputs_comment_test.go | Updates expectations for v9 pinned SHA. |
| pkg/workflow/cjs_require_validation_test.go | Removes handler_auth.cjs exception for @actions/github require/import. |
| pkg/workflow/cache.go | Updates generated scripts and setup step signature usage to pass getOctokit. |
| pkg/workflow/aw_info_tmp_test.go | Updates assertion for setupGlobals(..., getOctokit). |
| pkg/workflow/action_sha_validation_test.go | Updates forbidden pattern to actions/github-script@v9. |
| pkg/workflow/action_sha_checker_test.go | Updates fixture SHA to v9. |
| pkg/workflow/action_pins_logging_test.go | Updates test fixtures to use the new github-script SHA. |
| pkg/workflow/action_cache_test.go | Updates test fixtures to use the new github-script SHA. |
| pkg/constants/version_constants.go | Sets DefaultGitHubScriptVersion to v9. |
| actions/setup/setup.sh | Removes runtime npm install @actions/github path for custom tokens. |
| actions/setup/js/setup_globals.cjs | Adds getOctokit parameter and stores it on global.getOctokit. |
| actions/setup/js/package.json | Pins @actions/github-script dev dependency to #v9.0.0 for types. |
| actions/setup/js/handler_auth.test.cjs | Switches mocking from @actions/github to global.getOctokit. |
| actions/setup/js/handler_auth.cjs | Removes dynamic import of @actions/github and uses getOctokit directly. |
| actions/setup/js/create_pull_request.cjs | Removes dynamic import of @actions/github and uses getOctokit directly. |
| actions/setup/js/create_issue.cjs | Removes dynamic import of @actions/github and uses getOctokit directly. |
| actions/setup/js/assign_to_agent.cjs | Removes dynamic import of @actions/github and uses getOctokit directly. |
| actions/setup/js/assign_agent_helpers.cjs | Updates comment referencing github-script v9 compatibility. |
| actions/setup/action.yml | Removes safe-output-custom-tokens input. |
| .github/workflows/test-workflow.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/metrics-collector.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/issue-triage-agent.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/gpclean.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/firewall.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/example-permissions-warning.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/daily-malicious-code-scan.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/codex-github-remote-mcp-test.lock.yml | Recompiled lockfile: v9 pin + setupGlobals(..., getOctokit). |
| .github/workflows/bot-detection.lock.yml | Partially updated lockfile; still contains v8 references per search results. |
| .github/workflows/agentics-maintenance.yml | Updates github-script pin to v9 and passes getOctokit into setupGlobals. |
| .github/workflows/ace-editor.lock.yml | Partially updated lockfile; still contains v8 references per search results. |
| .github/aw/actions-lock.json | Adds v9 pin entry for actions/github-script@v9. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 50/250 changed files
- Comments generated: 9
| return github; | ||
| } | ||
| core.info("Using per-handler github-token for cross-repository authentication"); | ||
| const { getOctokit } = await import("@actions/github"); | ||
| return getOctokit(token); | ||
| } |
There was a problem hiding this comment.
getOctokit is referenced as a free variable, but it is not defined in this module scope. Since setup_globals.cjs stores it on global.getOctokit, this call will throw ReferenceError: getOctokit is not defined at runtime. Update this to use global.getOctokit(token) (or destructure from global) and ensure setupGlobals(..., getOctokit) was called before requiring this module.
| return github; | ||
| } | ||
| core.info("Using dedicated github client for assign-to-agent operations"); | ||
| const { getOctokit } = await import("@actions/github"); | ||
| return getOctokit(token); | ||
| } |
There was a problem hiding this comment.
getOctokit is referenced as a free variable in this CJS module, but it is not defined here. With the new approach, getOctokit is stored on global.getOctokit by setup_globals.cjs, so this should call global.getOctokit(token) (or equivalent) to avoid a runtime ReferenceError.
| @@ -73,7 +73,6 @@ async function createCopilotAssignmentClient(config) { | |||
| return github; | |||
| } | |||
| core.info("Using dedicated github client for copilot assignment"); | |||
| const { getOctokit } = await import("@actions/github"); | |||
| return getOctokit(token); | |||
| } | |||
There was a problem hiding this comment.
getOctokit is not defined in this module scope. Because setup_globals.cjs attaches it as global.getOctokit, this should use global.getOctokit(token) (or destructure from global) to avoid a runtime ReferenceError when a dedicated client is needed.
| @@ -56,7 +56,6 @@ async function createCopilotAssignmentClient(config) { | |||
| return github; | |||
| } | |||
| core.info("Using dedicated github client for copilot assignment"); | |||
| const { getOctokit } = await import("@actions/github"); | |||
| return getOctokit(token); | |||
| } | |||
There was a problem hiding this comment.
getOctokit is referenced directly but is not defined in this module scope. After setup_globals.cjs runs, it will be available as global.getOctokit; use that (or destructure from global) to avoid ReferenceError: getOctokit is not defined when creating the dedicated client.
| * @param {typeof getOctokit} getOctokitFn - The getOctokit function (builtin in actions/github-script@v9) | ||
| */ | ||
| function setupGlobals(coreModule, githubModule, contextModule, execModule, ioModule) { | ||
| function setupGlobals(coreModule, githubModule, contextModule, execModule, ioModule, getOctokitFn) { | ||
| // @ts-expect-error - Assigning to global properties that are declared as const | ||
| global.core = coreModule; |
There was a problem hiding this comment.
setupGlobals now requires a 6th getOctokit argument, but there are still workflows/lockfiles in the repo calling the 5-arg form (e.g. .github/workflows/copilot-maintenance.yml:46, pkg/cli/workflows/example-blocked-domains.lock.yml:104, pkg/workflow/test-yaml-import.lock.yml:66). Those will leave global.getOctokit unset and break any handler code that needs per-token clients. Update the remaining call sites (or make the 6th parameter backward-compatible).
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"fd48550f1cc134361d5d1824e474b278a25c7d7713560fdb20546fc3c63eaf58","strict":true,"agent_id":"copilot"} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"ed597411d8f924073f98dfc5c65a23a2325f34cd","version":"v8"},{"repo":"actions/upload-artifact","sha":"bbbca2ddaa5d8feaa63e36b76fdaad77386f024f","version":"v7"}]} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9"},{"repo":"actions/github-script","sha":"ed597411d8f924073f98dfc5c65a23a2325f34cd","version":"v8"},{"repo":"actions/upload-artifact","sha":"bbbca2ddaa5d8feaa63e36b76fdaad77386f024f","version":"v7"}]} | ||
| # ___ _ _ | ||
| # / _ \ | | (_) | ||
| # | |_| | __ _ ___ _ __ | |_ _ ___ |
There was a problem hiding this comment.
This lock file still references actions/github-script v8 alongside v9 (see the manifest on this line, plus remaining uses: actions/github-script@...ed597411... later in the file). If the intent is to fully bump to v9, update the remaining v8 steps so the manifest and pinned SHAs are consistent.
| # gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"27465bad2a2328fd5f4ea18e00881a4996ec1ccb258079f63b922025c714470f","agent_id":"copilot"} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"ed597411d8f924073f98dfc5c65a23a2325f34cd","version":"v8"},{"repo":"actions/upload-artifact","sha":"bbbca2ddaa5d8feaa63e36b76fdaad77386f024f","version":"v7"}]} | ||
| # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9"},{"repo":"actions/github-script","sha":"ed597411d8f924073f98dfc5c65a23a2325f34cd","version":"v8"},{"repo":"actions/upload-artifact","sha":"bbbca2ddaa5d8feaa63e36b76fdaad77386f024f","version":"v7"}]} | ||
| # ___ _ _ | ||
| # / _ \ | | (_) | ||
| # | |_| | __ _ ___ _ __ | |_ _ ___ |
There was a problem hiding this comment.
This lock file still includes actions/github-script v8 in the manifest (and there are still uses: actions/github-script@...ed597411... occurrences later). If the repo is migrating to github-script v9, the remaining v8-pinned steps should be updated so the manifest reflects a single, consistent github-script version.
| @@ -209,7 +209,7 @@ jobs: | |||
| steps: | |||
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |||
| - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6 | |||
| - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 | |||
| - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v8.0.0 | |||
| - name: Run tests | |||
| run: npm test | |||
There was a problem hiding this comment.
The fixture uses the v9 SHA (3a2844…) but the version comment still says # v8.0.0, which makes the test data misleading. Update the comment (and expected extracted version, if needed) to match the v9 pin being used.
| }, | ||
| }, | ||
| path: "/tmp/test-cache.json", | ||
| } | ||
|
|
||
| // Add a second entry with the same SHA but different version | ||
| cache.Set("actions/github-script", "v8.0.0", "ed597411d8f924073f98dfc5c65a23a2325f34cd") | ||
| cache.Set("actions/github-script", "v8.0.0", "3a2844b7e9c422d3c10d287c895573f7108da1b3") | ||
|
|
There was a problem hiding this comment.
These tests are still keyed around actions/github-script@v8/v8.0.0 but now use the v9 SHA. This works for the duplicate-SHA scenario, but it no longer matches the repo’s default github-script major and is confusing. Consider updating the versions used in the test names/keys to v9/v9.0.0 to reflect the current pin.
There was a problem hiding this comment.
👋 Smoke test agent agrees — updating test names/keys from v8/v8.0.0 to v9/v9.0.0 would remove the confusion between the SHA pin and the version label.
📰 BREAKING: Report filed by Smoke Copilot · ● 963.8K
|
need to add getOctokit to actions/setup/js/types/github-script.d.ts |
🧪 Test Quality Sentinel ReportTest Quality Score: 96/100✅ Excellent test quality
Test Classification DetailsAll 7 analyzed tests
Test Change SummaryThis PR's test changes fall into three categories: 1.
|
| File | Test lines added | Prod lines added | Ratio | Status |
|---|---|---|---|---|
handler_auth.test.cjs |
9 | 0 (1 deleted) | N/A (refactor) | ✅ No inflation — production change was a deletion; test swapped one mock approach for another with identical net line count |
Language Support
Tests analyzed:
- 🐹 Go (
*_test.go): 1 test (unit —//go:build !integration) — build tags verified on all modified files ✅ - 🟨 JavaScript (
*.test.cjs): 6 tests (vitest)
Verdict
✅ Check passed. 0% of new tests are implementation tests (threshold: 30%). All modified tests enforce observable behavioral contracts. The changes correctly reflect the
actions/github-script@v9API change — tests were updated in lock-step with the production code, a deleted feature's tests were removed, and no behavioral coverage was lost.
📖 Understanding Test Classifications
Design Tests (High Value) verify what the system does:
- Assert on observable outputs, return values, or state changes
- Cover error paths and boundary conditions
- Would catch a behavioral regression if deleted
- Remain valid even after internal refactoring
Implementation Tests (Low Value) verify how the system does it:
- Assert on internal function calls (mocking internals)
- Only test the happy path with typical inputs
- Break during legitimate refactoring even when behavior is correct
- Give false assurance: they pass even when the system is wrong
Goal: Shift toward tests that describe the system's behavioral contract — the promises it makes to its users and collaborators.
🧪 Test quality analysis by Test Quality Sentinel · ● 736.5K · ◷
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Test Quality Sentinel: 96/100. Test quality is excellent — 0% of new tests are implementation tests (threshold: 30%). All 7 analyzed tests enforce observable behavioral contracts. Mock strategy in handler_auth.test.cjs was correctly updated for github-script@v9's builtin getOctokit global, TestSafeOutputsCustomRunnerNodeSetup was properly removed with the deleted feature, and 16 SHA constants were updated mechanically. No coding-guideline violations detected.
|
@copilot add getOctokit to actions/setup/js/types/github-script.d.ts |
1 similar comment
|
@copilot add getOctokit to actions/setup/js/types/github-script.d.ts |
…s, CI test fix Agent-Logs-Url: https://github.com/github/gh-aw/sessions/3be23d37-f9a1-4d8f-a5f8-a4c7c53e849c Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Fixed in 41d4059. The CI failure was Also addressed all code review feedback in the same commit:
Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
@copilot merge main and recompile |
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/43ae05b7-f9ab-42a8-839a-024e2e576626 Co-authored-by: salmanmkc <32169182+salmanmkc@users.noreply.github.com>
Added in 3c2de30. Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
|
@copilot fix merge conflicts |
Verified — both deep imports still work with v9. If we ever move to |
|
✅ All tools validated successfully! Agent Container Smoke Test confirms agent container is ready. |
|
🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨ |
|
📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing... |
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 |
Agent Container Tool Check
Result: 12/12 tools available ✅ Overall Status: PASS
|
|
Smoke Test: Codex (run 24220926458)
|
|
🚀 Smoke Test Results — run 24220926503
Overall: ✅ PASS —
|
There was a problem hiding this comment.
Smoke test review of PR #25553 — upgrading actions/github-script to v9.0.0 with builtin getOctokit. The changes look solid: removing dynamic @actions/github imports is cleaner, and the 6th-parameter injection approach is well-executed across ~90 call sites. Minor suggestion: add JSDoc to setupGlobals and a changelog note about the new getOctokit usage pattern.
📰 BREAKING: Report filed by Smoke Copilot · ● 963.8K
| */ | ||
| function setupGlobals(coreModule, githubModule, contextModule, execModule, ioModule) { | ||
| function setupGlobals(coreModule, githubModule, contextModule, execModule, ioModule, getOctokitFn) { | ||
| // @ts-expect-error - Assigning to global properties that are declared as const | ||
| global.core = coreModule; |
There was a problem hiding this comment.
Adding getOctokit as a 6th parameter to setupGlobals is the right approach for v9 compatibility. Consider adding a JSDoc comment documenting all 6 parameters so callers know what to pass and in what order — the function signature is getting complex enough to warrant inline documentation.
| @@ -46,8 +46,7 @@ async function createAuthenticatedGitHubClient(config) { | |||
| return github; | |||
| } | |||
| core.info("Using per-handler github-token for cross-repository authentication"); | |||
| const { getOctokit } = await import("@actions/github"); | |||
| return getOctokit(token); | |||
| return global.getOctokit(token); | |||
| } | |||
There was a problem hiding this comment.
Good call removing @actions/github dynamic imports — this simplifies the dependency tree and aligns with v9's injection model. Worth adding a note in the PR description or CHANGELOG that scripts can now call getOctokit(token) directly without any imports.
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤 |
|
LGTM |
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude · ● 398.6K
| "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd" | ||
| }, | ||
| "actions/github-script@v9": { | ||
| "repo": "actions/github-script", |
There was a problem hiding this comment.
The SHA pin 3a2844b7e9c422d3c10d287c895573f7108da1b3 for actions/github-script@v9 looks correct. Good practice pinning to a specific commit SHA for security and reproducibility.
| steps: | ||
| - name: Post ACE editor session link | ||
| uses: actions/github-script@v8 | ||
| uses: actions/github-script@v9 |
There was a problem hiding this comment.
Good update from v8 to v9. The migration to use the builtin getOctokit injected into the script context is a clean improvement that removes the need for dynamic imports from @actions/github.
|
Smoke Test Run 24220926430 results: Core (#1–12): ✅✅✅✅✅✅✅✅✅✅✅✅ Overall: PARTIAL (17 pass, 2 skipped — resolve thread & close PR)
|
There was a problem hiding this comment.
💥 Automated smoke test review - all systems nominal!
💥 [THE END] — Illustrated by Smoke Claude · ● 295.4K
| steps: | ||
| - name: Post ACE editor session link | ||
| uses: actions/github-script@v8 | ||
| uses: actions/github-script@v9 |
There was a problem hiding this comment.
Good upgrade to actions/github-script@v9 here. The new getOctokit parameter is now properly included in the setupGlobals call, which is consistent with all other step updates in this PR.
| "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd" | ||
| }, | ||
| "actions/github-script@v9": { | ||
| "repo": "actions/github-script", |
There was a problem hiding this comment.
The new actions/github-script@v9 pin with SHA 3a2844b7e9c422d3c10d287c895573f7108da1b3 looks correct. This ensures reproducible builds by pinning to an exact commit rather than a floating tag.
|
Commit pushed:
|
Summary
Updates
actions/github-scriptfrom v8 to v9.0.0, using the new builtingetOctokitfactory function instead of dynamically importing@actions/github.In v9.0.0,
getOctokitis injected directly into the script context (likegithub,core,context, etc.), so scripts no longer need toimport("@actions/github")to create secondary authenticated clients.Changes
Core version update
DefaultGitHubScriptVersionfromv8tov9actions/github-script@v9SHA pin (3a2844b7e9c422d3c10d287c895573f7108da1b3) toactions-lock.jsonpackage.jsondev dependency toactions/github-script#v9.0.0for TypeScript typesBuiltin
getOctokitsupportsetup_globals.cjs: addsgetOctokitas a 6th parameter, stores it asglobal.getOctokitsetupGlobals(core, github, context, exec, io)calls in Go files updated tosetupGlobals(core, github, context, exec, io, getOctokit)(~90 call sites across 17 files)Remove
@actions/githubdynamic importhandler_auth.cjs: removesconst { getOctokit } = await import("@actions/github"), uses builtingetOctokit(token)directlyassign_to_agent.cjs: samecreate_issue.cjs: samecreate_pull_request.cjs: sameRemove npm install support for
@actions/githubactions/setup/setup.sh: removes the block that rannpm install @actions/githubwhen custom tokens were enabledactions/setup/action.yml: removes thesafe-output-custom-tokensinputcompiler_yaml_step_generation.go: removesenableCustomTokensparameter fromgenerateSetupStepcompiler_safe_outputs_job.go: removes custom-tokens Node.js setup logic for custom image runnerscompiler_safe_outputs_core.go: removeshasCustomTokenSafeOutputsandcollectBaseSafeOutputConfigs(now unused)Test updates
handler_auth.test.cjs: mocksglobal.getOctokitinstead of@actions/githubcjs_require_validation_test.go: removes exception forhandler_auth.cjssafe_outputs_runs_on_test.go: removesTestSafeOutputsCustomRunnerNodeSetup(no longer relevant)✨ PR Review Safe Output Test - Run 24220925131
✨ PR Review Safe Output Test - Run 24220926430
Changeset
actions/github-script@v9and the builtingetOctokitcontext API.