Skip to content

build(deps): bump actions/github-script from 8 to 9 in the all-actions-dependencies group across 1 directory#15

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-dependencies-556be15a16
Open

build(deps): bump actions/github-script from 8 to 9 in the all-actions-dependencies group across 1 directory#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/all-actions-dependencies-556be15a16

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github May 1, 2026 •
edited
Loading

Bumps the all-actions-dependencies group with 1 update in the / directory: actions/github-script.

Updates actions/github-script from 8 to 9

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

  • getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.
  • Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

  • require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.
  • getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.
  • If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

New Contributors

Full Changelog: actions/github-script@v8.0.0...v9.0.0

Commits
  • 3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
  • ca10bbd fix: use @​octokit/core/types import for v7 compatibility
  • 86e48e2 merge: incorporate main branch changes
  • c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
  • afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
  • ff8117e ci: fix user-agent test to handle orchestration ID
  • 81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
  • 3953caf docs: update README examples from @​v8 to @​v9, add getOctokit docs and v9 brea...
  • c17d55b ci: add getOctokit integration test job
  • a047196 test: add getOctokit integration tests via callAsyncFunction
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 1, 2026
@bearomorphism bearomorphism mentioned this pull request May 8, 2026
Closed
2 tasks
bearomorphism added a commit to bearomorphism/setup-cz that referenced this pull request May 8, 2026
@bearomorphism
ci(test): skip test-trigger-other-job when token is read-only
bc2eb75 
The test-trigger-other-job job runs `gh workflow run`, which requires
`actions: write` on the GITHUB_TOKEN. The job has been failing on:

  - Fork PRs (e.g. contributor PRs from forks): fork-originated PRs
    always receive a read-only GITHUB_TOKEN.
  - Dependabot PRs (e.g. commitizen-tools#15): even though dependabot creates branches
    in the same repo, the dependabot[bot] actor receives a restricted
    token by default.

Both produce:

    could not create workflow dispatch event: HTTP 403:
    Resource not accessible by integration

Skip this job in both cases by gating on `head.repo.full_name` and on
`github.actor`. The job continues to run on PRs from same-repo
branches authored by humans, where the token has the required
permissions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bearomorphism added a commit to bearomorphism/setup-cz that referenced this pull request May 9, 2026
@bearomorphism
ci(test): skip test-trigger-other-job when token is read-only
5f65561 
The test-trigger-other-job job runs `gh workflow run`, which requires
`actions: write` on the GITHUB_TOKEN. The job has been failing on:

  - Fork PRs (e.g. contributor PRs from forks): fork-originated PRs
    always receive a read-only GITHUB_TOKEN.
  - Dependabot PRs (e.g. commitizen-tools#15): even though dependabot creates branches
    in the same repo, the dependabot[bot] actor receives a restricted
    token by default.

Both produce:

    could not create workflow dispatch event: HTTP 403:
    Resource not accessible by integration

Skip this job in both cases by gating on `head.repo.full_name` and on
`github.actor`. The job continues to run on PRs from same-repo
branches authored by humans, where the token has the required
permissions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bearomorphism bearomorphism mentioned this pull request May 9, 2026
Merged
2 tasks
woile pushed a commit that referenced this pull request May 11, 2026
@bearomorphism @woile
ci(test): skip test-trigger-other-job when token is read-only
8d4b4e8 
The test-trigger-other-job job runs `gh workflow run`, which requires
`actions: write` on the GITHUB_TOKEN. The job has been failing on:

  - Fork PRs (e.g. contributor PRs from forks): fork-originated PRs
    always receive a read-only GITHUB_TOKEN.
  - Dependabot PRs (e.g. #15): even though dependabot creates branches
    in the same repo, the dependabot[bot] actor receives a restricted
    token by default.

Both produce:

    could not create workflow dispatch event: HTTP 403:
    Resource not accessible by integration

Skip this job in both cases by gating on `head.repo.full_name` and on
`github.actor`. The job continues to run on PRs from same-repo
branches authored by humans, where the token has the required
permissions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@woile
Copy link
Copy Markdown
Member

woile commented May 11, 2026

@dependabot rebase

@dependabot
build(deps): bump actions/github-script
81cba7a 
Bumps the all-actions-dependencies group with 1 update in the / directory: [actions/github-script](https://github.com/actions/github-script).


Updates `actions/github-script` from 8 to 9
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v8...v9)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: '9'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump actions/github-script from 8 to 9 in the all-actions-dependencies group build(deps): bump actions/github-script from 8 to 9 in the all-actions-dependencies group across 1 directory May 11, 2026
@dependabot dependabot Bot force-pushed the dependabot/github_actions/all-actions-dependencies-556be15a16 branch from 5d06d9b to 81cba7a Compare May 11, 2026 14:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@woile