deps: Update actions/github-script action to v9#140
Conversation
renovate
Bot
added
dependencies
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
The pull request aims to update the actions/github-script dependency to version v9. However, the official action has only released versions up to v7. Referencing a non-existent version or an unverified commit hash introduces high risk of workflow failure and potential security concerns. Furthermore, the PR does not address or verify compatibility with the breaking changes typical of major version updates (e.g., Node.js runtime shifts or API changes). This update should be halted until the version reference is corrected to a stable, official release and verified against the existing script logic.
About this PR
- Major version updates for
actions/github-scriptoften involve breaking changes, such as the transition to ESM or updates to the Node.js runtime (Node 24). There are no automated tests or verification steps provided to ensure the current script functionality intriage-bot.ymlremains compatible with these changes.
Test suggestions
- Verify the Triage Bot script executes successfully without syntax errors related to
getOctokitredeclaration orrequireusage. - Confirm
github.graphqlcalls andcoreutilities function correctly in thev9runtime (Node 24).
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify the Triage Bot script executes successfully without syntax errors related to `getOctokit` redeclaration or `require` usage.
2. Confirm `github.graphql` calls and `core` utilities function correctly in the `v9` runtime (Node 24).
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| steps: | ||
| - name: Triage unresolved review threads | ||
| uses: actions/github-script@v7 | ||
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 |
There was a problem hiding this comment.
🔴 HIGH RISK
The actions/github-script action has not released a version 9 (the current latest stable version is v7). Please verify the version number and ensure the commit hash corresponds to an official release of actions/github-script to avoid potential security risks or execution failures.
renovate
Bot
force-pushed
the
renovate/actions-github-script-9.x
branch
from
a3a6611 to
7c3d4fb
Compare
|
@coderabbitai autofix |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
@coderabbitai autofix |
1 participant
This PR contains the following updates:
v7→v9Release Notes
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@​actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@​actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@​actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v9Compare Source
v8.0.0Compare Source
v8: .0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
New Contributors
Full Changelog: actions/github-script@v7.1.0...v8.0.0
v7.1.0Compare Source
What's Changed
actions/upload-artifactby @joshmgross in #512npm audit fixby @joshmgross in #515permissionsin workflows and update actions by @joshmgross in #531octokitREADME updates for v7 by @joshmgross in #557scriptby @joshmgross in #603New Contributors
Full Changelog: actions/github-script@v7...v7.1.0
v7.0.1Compare Source
What's Changed
baseUrlto undefined when input is not provided by @joshmgross in #439Full Changelog: actions/github-script@v7.0.0...v7.0.1
Configuration
📅 Schedule: (in timezone UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.