Update actions/github-script action to v9 - #989
Conversation
AI Dependency Impact AnalysisPrevious analysisPrevious analysisPrevious analysisPrevious analysisPrevious analysisRisk Level: MEDIUMSummary of Dependency ChangesThe Affected CodeNo specific workflow snippets were provided in the prompt context. However, this change directly affects any GitHub Actions workflow files (located in Breaking Change AssessmentSeveral major breaking changes are introduced that may affect workflows:
Security AssessmentNo security advisories or vulnerability findings were provided in the PR context. Supply-Chain AssessmentNo supply-chain concerns detected. Recommended ActionReview specific areas: Medium risk. Reviewers should inspect all workflow files within Risk Level: MEDIUMSummary of Dependency ChangesThe Affected CodeNo Go source code files are directly affected as this is a GitHub Actions dependency update. The affected files are the GitHub Actions workflow YAML files (typically located in Breaking Change AssessmentMultiple breaking changes are introduced that may impact existing workflows:
Security AssessmentNo security advisories or vulnerability findings were provided in the update context. Supply-Chain AssessmentNo supply-chain concerns detected. Recommended ActionReview specific areas: Medium risk. A reviewer should inspect the
Risk Level: MEDIUMSummary of Dependency ChangesThe Affected CodeNo Go package dependencies are directly affected. This change impacts GitHub Action workflows located in Breaking Change AssessmentBreaking changes in
Security AssessmentNo security advisories or vulnerability findings were provided in the context. Supply-Chain AssessmentNo supply-chain concerns detected. Recommended ActionReview specific areas: Medium risk. The reviewer should check the Risk Level: MEDIUMSummary of Dependency ChangesThe Affected CodeThis change affects GitHub Action workflows (typically located under Breaking Change AssessmentThe following breaking changes are introduced in this major release:
Security AssessmentNo security advisories or vulnerability findings were provided for this update. Supply-Chain AssessmentNo supply-chain concerns detected. Recommended ActionReview specific areas: Medium risk, reviewer should check all workflow files under Risk Level: MEDIUMSummary of Dependency ChangesThe Affected CodeThis is a GitHub Action update rather than a Go package dependency. It affects YAML workflow definitions within the Breaking Change AssessmentSeveral breaking changes in
Security AssessmentNo security advisories were reported for this release. Supply-Chain AssessmentNo supply-chain concerns detected. Recommended ActionReview specific areas: Medium risk. Reviewers must inspect all Risk Level: MEDIUMSummary of Dependency ChangesThe Affected CodeGitHub Actions workflow files (located in Breaking Change AssessmentSeveral breaking changes are highly likely to affect existing workflows:
Security AssessmentNo security advisories or vulnerabilities were reported in the context. Supply-Chain AssessmentNo supply-chain concerns detected. Recommended ActionReview specific areas: Medium risk. A reviewer must inspect all |
github-actions
Bot
added
the
risk/medium
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Risk Level: MEDIUM
Summary of Dependency Changes
The actions/github-script action was updated from v7 to v9 (with v8 included in the transition). This update transitions the underlying runner to Node.js 24, requiring GitHub Runner version v2.327.1 or newer. Additionally, @actions/github was upgraded to v9 (ESM-only), and a new pre-injected getOctokit helper has been added directly to the script context.
Affected Code
No specific workflow snippets were provided in the prompt context. However, this change directly affects any GitHub Actions workflow files (located in .github/workflows/) that utilize the actions/github-script action.
Breaking Change Assessment
Several major breaking changes are introduced that may affect workflows:
- ESM-only
@actions/github: Any script block containingrequire('@actions/github')will now fail at runtime. Workflows must be updated to use the injected context variables. getOctokitParameter Injection: Scripts that declareconst getOctokit = ...orlet getOctokit = ...will fail with aSyntaxErrorbecausegetOctokitis now an injected function parameter and cannot be redeclared.- Runner Version Requirement: This update requires GitHub Runner version
v2.327.1or newer to support the updated Node.js execution environment. If self-hosted runners are used and are not up to date, workflows will fail.
Security Assessment
No security advisories or vulnerability findings were provided in the PR context.
Supply-Chain Assessment
No supply-chain concerns detected.
Recommended Action
Review specific areas: Medium risk. Reviewers should inspect all workflow files within .github/workflows/ utilizing actions/github-script to ensure they do not attempt to import @actions/github via require() or re-declare getOctokit, and verify that self-hosted runners (if applicable) meet the minimum version requirement (v2.327.1).
|
🤖 Finished Review · ✅ Success · Started 7:30 PM UTC · Completed 7:42 PM UTC |
ReviewFindingsHigh
Next steps:
Previous runReviewFindingsHigh
Next steps:
Previous run (2)ReviewFindingsHigh
Next steps:
Previous run (3)ReviewFindingsHigh
Next steps:
Previous run (4)ReviewFindingsHigh
Next steps:
Previous run (5)ReviewNo findings above threshold. Automated dependency update (Renovate/MintMaker) bumping The workflow scripts are compatible with v9 — none use
Labels: PR modifies GitHub Actions workflow file and is an automated dependency update |
fullsend-ai-review
Bot
added
requires-manual-review
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #989 +/- ##
==========================================
- Coverage 76.92% 76.74% -0.18%
==========================================
Files 26 26
Lines 2817 2817
==========================================
- Hits 2167 2162 -5
- Misses 452 456 +4
- Partials 198 199 +1
Flags with carried forward coverage won't be shown. Click here to find out more. Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
4043e8c to
7e68aad
Compare
github-actions
Bot
added
risk/medium
There was a problem hiding this comment.
Risk Level: MEDIUM
Summary of Dependency Changes
The actions/github-script action is updated from v7 to v9 (spanning two major releases, v8 and v9). Key changes include upgrading the underlying @actions/github to v9 (ESM-only), adding an injected getOctokit helper directly into the script context, updating Node.js support, and bumping the minimum compatible GitHub Actions runner version to v2.327.1.
Affected Code
No Go source code files are directly affected as this is a GitHub Actions dependency update. The affected files are the GitHub Actions workflow YAML files (typically located in .github/workflows/) that reference actions/github-script.
Breaking Change Assessment
Multiple breaking changes are introduced that may impact existing workflows:
- ESM-only
@actions/github: Any script in our workflows usingrequire('@actions/github')will now fail at runtime. Workflows must be updated to use the newly injectedgetOctokithelper instead of importing it manually. getOctokitSyntax Error: If a script declaresconst getOctokit = ...orlet getOctokit = ..., it will throw aSyntaxErrordue to duplicate parameter declaration in the execution context.- Runner Version Requirement: If the repository uses self-hosted runners, they must be upgraded to at least version
v2.327.1to be compatible withv8.0.0and above.
Security Assessment
No security advisories or vulnerability findings were provided in the update context.
Supply-Chain Assessment
No supply-chain concerns detected.
Recommended Action
Review specific areas: Medium risk. A reviewer should inspect the .github/workflows/ directory to identify all steps utilizing actions/github-script and ensure:
- They do not contain
require('@actions/github'). - They do not redeclare
getOctokitusingconstorlet. - Any self-hosted runner environments meet the minimum runner version of
v2.327.1.
|
🤖 Finished Review · ✅ Success · Started 4:34 PM UTC · Completed 4:43 PM UTC |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fullsend-ai-review
Bot
removed
the
requires-manual-review
7e68aad to
befe2e8
Compare
github-actions
Bot
added
risk/medium
There was a problem hiding this comment.
Risk Level: MEDIUM
Summary of Dependency Changes
The actions/github-script GitHub Action is updated from v7 to v9 (spanning major releases v8 and v9). This update bumps Node.js support to version 24.x, introduces an injected getOctokit factory function directly into the script context, and upgrades underlying dependencies like @actions/github to v9 which is now ESM-only.
Affected Code
No Go package dependencies are directly affected. This change impacts GitHub Action workflows located in .github/workflows/ that reference actions/github-script.
Breaking Change Assessment
Breaking changes in v9 will impact workflows if they:
- Use
require('@actions/github')in their scripts, which will now fail at runtime because the underlying@actions/githubis ESM-only. - Explicitly declare
const getOctokit = ...orlet getOctokit = ...within the script block, which will now throw aSyntaxErrorbecausegetOctokitis now a pre-declared injected parameter. - Run on older self-hosted runner environments (requires Runner version
v2.327.1or newer).
Security Assessment
No security advisories or vulnerability findings were provided in the context.
Supply-Chain Assessment
No supply-chain concerns detected.
Recommended Action
Review specific areas: Medium risk. The reviewer should check the .github/workflows/ directory for any YAML files utilizing actions/github-script and verify that the scripts do not use require('@actions/github') or redeclare the getOctokit variable.
|
🤖 Finished Review · ✅ Success · Started 7:50 PM UTC · Completed 7:59 PM UTC |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
befe2e8 to
0f33d1b
Compare
red-hat-konflux
Bot
changed the title
github-actions
Bot
added
risk/medium
There was a problem hiding this comment.
Risk Level: MEDIUM
Summary of Dependency Changes
The actions/github-script action is updated from v7 to v9 (incorporating v8 changes). Key updates include upgrading the runtime to support Node.js 24, requiring GitHub runner version v2.327.1 or newer, and upgrading internal dependencies to ESM-only versions which changes script execution behavior.
Affected Code
This change affects GitHub Action workflows (typically located under .github/workflows/) that utilize actions/github-script. Any workflow step running inline or external JavaScript via this action must be reviewed; no Go source code is directly impacted by this update.
Breaking Change Assessment
The following breaking changes are introduced in this major release:
require('@actions/github')is no longer supported and will fail at runtime. Scripts must use the newly injectedgetOctokitcontext or standard parameters instead.- Declaring
const getOctokitorlet getOctokitin scripts will result in aSyntaxErrorbecausegetOctokitis now an injected function parameter. - The action requires a minimum runner version of
v2.327.1. If self-hosted runners are used, they must be verified for compatibility.
Security Assessment
No security advisories or vulnerability findings were provided for this update.
Supply-Chain Assessment
No supply-chain concerns detected.
Recommended Action
Review specific areas: Medium risk, reviewer should check all workflow files under .github/workflows/ that reference actions/github-script to ensure they do not use require('@actions/github'), do not redeclare getOctokit, and that runners meet the minimum version requirement.
|
🤖 Finished Review · ✅ Success · Started 5:55 PM UTC · Completed 6:04 PM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
0f33d1b to
7b3a9de
Compare
github-actions
Bot
added
risk/medium
There was a problem hiding this comment.
Risk Level: MEDIUM
Summary of Dependency Changes
The actions/github-script action is updated from v7 to v9 (spanning major versions v8 and v9). Key changes include upgrading the runtime to Node.js 24 (requiring runner version v2.327.1 or newer), injecting a new getOctokit factory function directly into the script context, and upgrading internal dependencies to @actions/github v9 (ESM-only), which breaks traditional require imports.
Affected Code
This is a GitHub Action update rather than a Go package dependency. It affects YAML workflow definitions within the .github/workflows/ directory that utilize the actions/github-script step. There are no direct Go imports for this dependency.
Breaking Change Assessment
Several breaking changes in v8 and v9 could impact existing workflows:
require('@actions/github')is no longer supported: If your scripts import the GitHub client usingrequire('@actions/github'), they will fail at runtime. You must use the newly injectedgetOctokitfunction instead.getOctokitSyntax Errors: If your scripts manually define a variable namedgetOctokitusingconstorlet(e.g.,const getOctokit = ...), it will throw aSyntaxErrordue to redeclaration of an injected parameter.- Runner Version Requirement: Self-hosted runners must be at version
v2.327.1or newer to support the updated Node.js 24 execution environment.
Security Assessment
No security advisories were reported for this release.
Supply-Chain Assessment
No supply-chain concerns detected.
Recommended Action
Review specific areas: Medium risk. Reviewers must inspect all .github/workflows/ files using actions/github-script to ensure they do not perform require('@actions/github') or redeclare getOctokit. If self-hosted runners are used, verify they meet the minimum version requirement (v2.327.1).
|
🤖 Finished Review · ✅ Success · Started 1:10 AM UTC · Completed 1:22 AM UTC Commit: |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
7b3a9de to
e1130f2
Compare
github-actions
Bot
added
risk/medium
There was a problem hiding this comment.
Risk Level: MEDIUM
Summary of Dependency Changes
The actions/github-script action is being updated across two major versions, from v7 to v9. Key changes include an updated minimum runner version of v2.327.1 (introduced in v8), Node.js support bump, and a major breaking change in v9.0.0 where @actions/github was upgraded to an ESM-only package, causing require('@actions/github') to fail in scripts.
Affected Code
GitHub Actions workflow files (located in .github/workflows/) that utilize the actions/github-script action are affected. Any inline JavaScript code within these workflows that interacts with the GitHub API or helper libraries must be checked.
Breaking Change Assessment
Several breaking changes are highly likely to affect existing workflows:
- ESM-only
@actions/github: If workflows currently userequire('@actions/github')to instantiate secondary Octokit clients, this will now fail at runtime. Users must use the newly injectedgetOctokitfactory function instead. getOctokitScope Conflict: Scripts that declareconst getOctokit = ...orlet getOctokit = ...will throw aSyntaxErrorbecausegetOctokitis now injected as a parameter in the script context and cannot be redeclared.- Runner Compatibility: If the repository runs on self-hosted runners, they must be updated to at least version
v2.327.1.
Security Assessment
No security advisories or vulnerabilities were reported in the context.
Supply-Chain Assessment
No supply-chain concerns detected.
Recommended Action
Review specific areas: Medium risk. A reviewer must inspect all .github/workflows/ files using actions/github-script to verify that they do not use require('@actions/github') or redeclare getOctokit. If self-hosted runners are used, verify their version is at or above v2.327.1.
|
🤖 Finished Review · ✅ Success · Started 6:21 AM UTC · Completed 6:33 AM UTC Commit: |
1 participant
This PR contains the following updates:
v7→v9Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
actions/github-script (actions/github-script)
v9.0.0Compare Source
New features:
getOctokitfactory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients withgetOctokitfor details and examples.ACTIONS_ORCHESTRATION_IDenvironment variable is automatically appended to the user-agent string for request tracing.Breaking changes:
require('@​actions/github')no longer works in scripts. The upgrade to@actions/githubv9 (ESM-only) meansrequire('@​actions/github')will fail at runtime. If you previously used patterns likeconst { getOctokit } = require('@​actions/github')to create secondary clients, use the new injectedgetOctokitfunction instead — it's available directly in the script context with no imports needed.getOctokitis now an injected function parameter. Scripts that declareconst getOctokit = ...orlet getOctokit = ...will get aSyntaxErrorbecause JavaScript does not allowconst/letredeclaration of function parameters. Use the injectedgetOctokitdirectly, or usevar getOctokit = ...if you need to redeclare it.@actions/githubinternals beyond the standardgithub/octokitclient, you may need to update those references for v9 compatibility.What's Changed
New Contributors
Full Changelog: actions/github-script@v8.0.0...v9.0.0
v9Compare Source
v8.0.0Compare Source
v8: .0.0Compare Source
What's Changed
v2.327.1
Release Notes
Make sure your runner is updated to this version or newer to use this release.
New Contributors
Full Changelog: actions/github-script@v7.1.0...v8.0.0
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.