Bump actions/github-script from 7.1.0 to 9.0.0 by dependabot[bot] · Pull Request #998 · konflux-ci/multi-platform-controller

dependabot · 2026-08-03T07:49:11Z

Bumps actions/github-script from 7.1.0 to 9.0.0.

Release notes

Sourced from actions/github-script's releases.

v9.0.0

New features:

getOctokit factory function — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See Creating additional clients with getOctokit for details and examples.

Orchestration ID in user-agent — The ACTIONS_ORCHESTRATION_ID environment variable is automatically appended to the user-agent string for request tracing.

Breaking changes:

require('@actions/github') no longer works in scripts. The upgrade to @actions/github v9 (ESM-only) means require('@actions/github') will fail at runtime. If you previously used patterns like const { getOctokit } = require('@actions/github') to create secondary clients, use the new injected getOctokit function instead — it's available directly in the script context with no imports needed.

getOctokit is now an injected function parameter. Scripts that declare const getOctokit = ... or let getOctokit = ... will get a SyntaxError because JavaScript does not allow const/let redeclaration of function parameters. Use the injected getOctokit directly, or use var getOctokit = ... if you need to redeclare it.

If your script accesses other @actions/github internals beyond the standard github/octokit client, you may need to update those references for v9 compatibility.

What's Changed

Add ACTIONS_ORCHESTRATION_ID to user-agent string by @Copilot in actions/github-script#695

ci: use deployment: false for integration test environments by @salmanmkc in actions/github-script#712

feat!: add getOctokit to script context, upgrade @actions/github v9, @octokit/core v7, and related packages by @salmanmkc in actions/github-script#700

New Contributors

@Copilot made their first contribution in actions/github-script#695

Full Changelog: actions/github-script@v8.0.0...v9.0.0

v8.0.0

What's Changed

Update Node.js version support to 24.x by @salmanmkc in actions/github-script#637

README for updating actions/github-script from v7 to v8 by @sneha-krip in actions/github-script#653

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

@salmanmkc made their first contribution in actions/github-script#637

@sneha-krip made their first contribution in actions/github-script#653

Full Changelog: actions/github-script@v7.1.0...v8.0.0

Commits

3a2844b Merge pull request #700 from actions/salmanmkc/expose-getoctokit + prepare re...
ca10bbd fix: use @octokit/core/types import for v7 compatibility
86e48e2 merge: incorporate main branch changes
c108472 chore: rebuild dist for v9 upgrade and getOctokit factory
afff112 Merge pull request #712 from actions/salmanmkc/deployment-false + fix user-ag...
ff8117e ci: fix user-agent test to handle orchestration ID
81c6b78 ci: use deployment: false to suppress deployment noise from integration tests
3953caf docs: update README examples from @v8 to @v9, add getOctokit docs and v9 brea...
c17d55b ci: add getOctokit integration test job
a047196 test: add getOctokit integration tests via callAsyncFunction
Additional commits viewable in compare view

fullsend-ai-review · 2026-08-03T07:51:18Z

🤖 Finished Review · ✅ Success · Started 7:51 AM UTC · Completed 8:03 AM UTC
Commit: 701e62a · View workflow run →

codecov-commenter · 2026-08-03T08:02:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.28%. Comparing base (8c12c4b) to head (179da83).

❗ There is a different number of reports uploaded between BASE (8c12c4b) and HEAD (179da83). Click for more details.

HEAD has 3 uploads less than BASE

Flag BASE (8c12c4b) HEAD (179da83)

e2e-tests 2 1

unit-tests 2 0

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #998       +/-   ##
===========================================
- Coverage   76.92%   30.28%   -46.65%     
===========================================
  Files          26       26               
  Lines        2817     2817               
===========================================
- Hits         2167      853     -1314     
- Misses        452     1799     +1347     
+ Partials      198      165       -33

Flag	Coverage Δ
e2e-tests	`30.28% <ø> (ø)`
unit-tests	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.
see 22 files with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8c12c4b...179da83. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

fullsend-ai-review · 2026-08-03T08:03:24Z

Review

Findings

High

[protected-path] .github/workflows/agent-files-detect.yaml, .github/workflows/agent-files-enforce.yaml — This PR modifies files under the protected path .github/. No linked issue provides authorization for these changes. The repository's dependabot.yml is configured to manage github-actions updates weekly, and the code change itself is safe — all inline scripts use only injected github.rest.*, core.*, and context.* APIs, with no require('@actions/github') calls or getOctokit re-declarations that would break under actions/github-script v9.0.0. Human approval is always required for protected-path changes, regardless of authorization context.
Remediation: A maintainer with write access should review and approve this dependency update, then remove the agent-config-review-required label.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

[protected-path] .github/workflows/agent-files-detect.yaml — This PR modifies files under the protected .github/ path: .github/workflows/agent-files-detect.yaml and .github/workflows/agent-files-enforce.yaml. The PR has no linked issue justifying the modification of governance/infrastructure files. Human approval is always required for protected-path changes, regardless of whether the change is mechanical.
Remediation: A reviewer with write access must review the agent config changes and remove the agent-config-review-required label to unblock merging.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

High

[protected-path] .github/workflows/agent-files-enforce.yaml — This PR modifies a file under .github/ (a protected path). No linked issue authorizes changes to governance/infrastructure files. Human approval is required for all protected-path changes regardless of context.

Low

[dependency-pin-verification] .github/workflows/agent-files-enforce.yaml:27 — The diff bumps actions/github-script from v7 (SHA f28e40c7) to v9.0.0 (SHA 3a2844b7) across six call sites. All six references are updated consistently. The inline scripts use github.rest.*, github.paginate(), core.setOutput(), core.setFailed(), and core.info() — all compatible with the v9 API surface. No breaking change impact detected.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (3)

Review

Findings

High

[protected-path] .github/workflows/agent-files-enforce.yaml — This PR modifies a file under .github/, a protected path requiring human approval. The PR has no linked issue justifying the modification of governance/infrastructure files. The version bump itself appears safe — all seven inline scripts use only github.rest.*, context.*, and core.*, none of which are affected by the v9 breaking changes (require('@actions/github') removal and getOctokit parameter injection). However, human review is always required for protected-path changes regardless of technical safety.
Remediation: An infra-team reviewer should verify the actions/github-script v7→v9 version bump is compatible with all inline scripts, then remove the agent-config-review-required label to unblock merging.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

High

[protected-path] .github/workflows/agent-files-check.yaml — This PR modifies a file under the .github/ protected path. The PR has no linked issue authorizing changes to governance or infrastructure files. The dependency bump itself appears safe (SHA 3a2844b7e9c422d3c10d287c895573f7108da1b3 verified against the upstream v9.0.0 tag; the workflow scripts do not use any patterns broken by v9's breaking changes — they rely on the injected github, context, and core function parameters which remain unchanged in v9), but human approval is always required for protected-path changes.
Remediation: A human reviewer from the infrastructure team should verify this dependency upgrade is desired and approve the change.

Next steps:

/fs-fix — agent addresses review findings automatically
/fs-fix <your instruction> — agent fixes with your specific guidance
Push commits directly — review re-runs automatically on push
/fs-fix-stop — disable automatic fix runs for this PR

fullsend-ai-review · 2026-08-04T10:17:57Z

🤖 Finished Review · ✅ Success · Started 10:17 AM UTC · Completed 10:32 AM UTC
Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-07T16:45:22Z

🤖 Finished Review · ✅ Success · Started 4:45 PM UTC · Completed 4:55 PM UTC

Commit: 701e62a · View workflow run →

fullsend-ai-review · 2026-08-21T07:50:44Z

🤖 Finished Review · ✅ Success · Started 7:50 AM UTC · Completed 8:03 AM UTC

Commit: 9ee3c25 · View workflow run →

Bumps [actions/github-script](https://github.com/actions/github-script) from 7.1.0 to 9.0.0. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](actions/github-script@f28e40c...3a2844b) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

fullsend-ai-review · 2026-08-23T12:06:23Z

🤖 Finished Review · ✅ Success · Started 12:06 PM UTC · Completed 12:15 PM UTC

Commit: 9ee3c25 · View workflow run →

fullsend-ai-review

See the review comment for full details.

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Aug 3, 2026

This comment was marked as outdated.

Sign in to view

dependabot Bot force-pushed the dependabot/github_actions/actions/github-script-9.0.0 branch 2 times, most recently from b0981a3 to 11691d9 Compare August 4, 2026 10:16

github-actions Bot added the agent-config-review-required label Aug 4, 2026

This comment was marked as outdated.

Sign in to view

dependabot Bot force-pushed the dependabot/github_actions/actions/github-script-9.0.0 branch from 11691d9 to f1944ab Compare August 7, 2026 16:43

This comment was marked as outdated.

Sign in to view

mshaposhnik approved these changes Aug 20, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/github_actions/actions/github-script-9.0.0 branch from f1944ab to d9ce44c Compare August 21, 2026 07:49

This comment was marked as outdated.

Sign in to view

dependabot Bot force-pushed the dependabot/github_actions/actions/github-script-9.0.0 branch from d9ce44c to 179da83 Compare August 23, 2026 12:05

fullsend-ai-review Bot suggested changes Aug 23, 2026

View reviewed changes

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v9.0.0

What's Changed

New Contributors

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

New Contributors

Uh oh!

fullsend-ai-review Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

High

Review

Findings

High

Review

Findings

High

Low

Review

Findings

High

Review

Findings

High

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

fullsend-ai-review Bot commented Aug 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github Aug 3, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 3, 2026 •

edited

Loading

codecov-commenter commented Aug 3, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 3, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 4, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 7, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 21, 2026 •

edited

Loading

fullsend-ai-review Bot commented Aug 23, 2026 •

edited

Loading